Thread

Dutch governments builds alternative for Microsoft based on NixOS

1021 points · 583 comments · fjfaase

solarkraft · 1790327717 · focus · HN ↗
Awesome! I believe NixOS is perfect for systems you just want to work and track reproducibly, like appliances (which a lot of server software is supposed to be). I’m glad people smarter than me are actually able to realize its advantages =)
In the same space, also check out openDesk initiated by the German Government (<a href="https://www.opendesk.eu/en" rel="nofollow">https://www.opendesk.eu/en) and La Suite by the French one (<a href="https://lasuite.numerique.gouv.fr/" rel="nofollow">https://lasuite.numerique.gouv.fr/).
AFAIK, there has been some collaboration with the German government on La Suite, not sure about the others.
1. skohan · 1790336306 · focus · HN ↗
  I recently got my feet wet with Nix for the purpose of agent sandboxing, and it's a really great concept!
  The issue I have run into is that for running llama.cpp, which is a very actively developed bleeding-edge software, it seems like experimenting with different versions/configs/patches etc. was fighting with the Nix philosophy of immutable software, so I ended up just managing it outside of nix.
  But this could be user-error, I've only spent a couple of weeks with it.
  1. fsiefken · 1790338614 · focus · HN ↗
    one can use direnv, nix-direnv and flake.nix to get an immutable and reproducible build toolchain protected from nix garbage collection, while keeping the llama.cpp branches and/or compiled binaries mutable on the local filesystem. <a href="https://github.com/nix-community/nix-direnv" rel="nofollow">https://github.com/nix-community/nix-direnv
    for agentic execution sandboxing, preventing 'rm -rf /home' nix or nix-direnv doesn't help, podman could be used next to nix. <a href="https://discourse.nixos.org/t/what-is-sandboxing-and-what-does-it-entail/15533" rel="nofollow">https://discourse.nixos.org/t/what-is-sandboxing-and-what-do...
    ireadmevs · 1790356066 · focus · HN ↗
    If it’s just filesystem sandboxing that you are after, then bubblewrap can help you stay in nix by just wrapping the agent’s derivation

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.