ocaps at the systemd level with guix?

[dckc]

I'm thinking about trying guix today.

For all the hate systemd gets, one thing I like about it is socket activation; sockets are the closest thing unix has to ocaps. Also, genode has systemd integration. guix uses somthing other than systemd; does that thing support socket activation?

How close can we get to "ocaps all the way down" in guix, @cwebber?

notes in #guix Nov 6 starting 10:32 KC time

[dckc]

got guix booted. config version 4e62840

https://logs.guix.gnu.org/guix/2021-11-12.log#091132

based on Running Guix on a Linode Server (GNU Guix Cookbook) via @cwebber

[dckc]

Hm... I'm pretty invested in Brave these days, but it doesn't seem to be supported in guix.

Wow... guix/chromium.scm looks like a lot of code.

[dckc]

wow... a whole bunch of work in this area!

sysinit

Synit is an experiment in applying pervasive reactivity and object capabilities to the System Layer of an operating system for personal computers, including laptops, desktops, and mobile phones. Its architecture follows the principles of the Syndicated Actor Model. -- SYNIT

https://git.syndicate-lang.org/synit/synit e550d6c631

funded by NLnet Foundation: Structuring the System Layer with Dataspaces—Syndicated Actors

looks a lot like rholang / rspace

@tonyg have you ever looked at rholang / rspace / rhovm?

I gave a crash-course on the rho calculus and rholang in 2020. Slides and recording are in https://github.com/rchain-community/rv2020

on rspace and the rhoVM, I like @leithaus 's Boulder 2018 talk, to wit:

• Day 4 - RChain VM - Greg Meredith & VM Developer Team - YouTube

cited from: my notes on RChain Devcon Boulder

try not to get too distracted by the blockchain stuff :)

cc @kriskowal @cwebber

[tonyg]

Long ago! I used to work with Greg and his coauthor on the original Rho-calculus paper, Matthias Radestock. I haven't looked at the modern incarnation at all, though. Originally, Rho-calculus was a pi-calculus-like system, with point-to-point messaging over channels, though one of the attractions of the system was the way channel naming was richer than simple lambda-like binding and could be made more pub-sub-like. Is the current variant still a point-to-point system? Is it still message-based? One of the differences between Syndicate and other actor/pi-calculus systems is that Syndicate is about state replication more than it is about message passing...

[dckc]

... Also, genode has systemd integration [IOU link].

Ah. not systemd: seccomp.

• Capability-based security using seccomp on Linux 20.05

noted May 2020
dckc/madmode-blog#65 (comment)

[dckc]

cool! funding for this!

• Distributed System Daemons: More Than a Twinkle in Goblins' Eye -- Spritely Institute

[dckc]

A look at system.drv

Achievement unlocked:

• 2024-08-02 03:37 90eaafe feat(ps23): guix system init on boot, root partitions

yesterday in #guix...

<dckc> ok... I'm back to where `guix system vm` is working; let's see if `guix system init` reuses the same stuff
<dckc> no; "14.9 MB will be downloaded". odd.
<dckc> and then 40MB more, 50MB more...
<dckc> finally! copying to '/mnt'...
<dckc> building /gnu/store/2qaksznf6rni6iv46jr1jn4bbmkzyivg-install-bootloader.scm.drv...
<dckc> guix system: bootloader successfully installed on '#f'

The heart of it is:

ps23$ make
guix system build -d etc/config.scm
/gnu/store/5bqx8z19c578lzjp5zijrb5x18pgnnzr-system.drv

So what is a .drv file anyway?

less was cutting them it in odd ways...

~/projects/office-admin/ps23
09:05 connolly@bldbox$ less  /gnu/store/5bqx8z19c578lzjp5zijrb5x18pgnnzr-system.drv

, so I opened it it emacs... pleasantly surprised to find that it was auto-indented

I wondered how I was going to do that, since it's in a format that I don't recognize. Turns out to be ATerm. It overlaps with JS enough that prettier groks too.

interesting that with all the homoiconicity stuff around scheme / lisp, procedure definitions are not s-expressions...
I find the guix derivation procedure definition hard to read:

Scheme Procedure: derivation store name builder args [#:outputs '("out")] [#:hash #f] [#:hash-algo #f] [#:recursive? #f] [#:inputs '()] [#:env-vars '()] [#:system (%current-system)] [#:references-graphs #f] [#:allowed-references #f] [#:disallowed-references #f] [#:leaked-env-vars #f] [#:local-build? #f] [#:substitutable? #t] [#:properties '()]

Guix uses the .drv file format from nix.

• Eelco Dolstra, Merijn de Jonge, and Eelco Visser, “Nix: A Safe and Policy-Free System for Software Deployment” (2004).

5.4. Derivations in the nix docs is OK, but the definition in Derivation.hs in haskell-nix works better for me, especially in combination with the stuff around it to explain how to read and write it, including building things when you write it:

data Derivation = Derivation
  { name :: Text
  , outputs :: Map Text Text
  , inputs :: (Set Text, Map Text [Text])
  , platform :: Text
  , builder :: Text -- should be typed as a store path
  , args :: [ Text ]
  , env :: Map Text Text
  , mFixed :: Maybe Store.SomeNamedDigest
  , hashMode :: HashMode
  , useJson :: Bool
  }

It seems to be somewhat analogous to a make rule. "To build output, once you've built inputs, run builder":

output: inputs...
	builder...

[dckc]

guix systems are portable vats?

I have a spare box, P, that I want to re-outfit to run some services. Guix systems seem to be enough like vats that I think I can build a system on my main workstation, B, and migrate it to run on P.

I booted guix on P from a USB stick and took a look around; a storage inventory showed that I don't want to just wipe the disk by proceeding with the installation. (See also: #guix 22 Jul.)

guix system vm

Then I discovered the incredibly cool guix system vm subcommand (a bit buried under 12.15 Invoking guix system). And in a few minutes:

ps23$ make run
$(guix system vm etc/config.scm --no-graphic) -m 1024 -smp 2 -nic user,model=virtio-net-pci     
...
[    3.086122] shepherd[1]: Service mcron running with value 126.
[    3.086936] shepherd[1]: Service mcron has been started.


This is the GNU system.  Welcome.
ps23 login: root
This is the GNU operating system, welcome!

root@ps23 ~# ls
guix-home-config.scm

• guix system vm asciinema recording
• 2024-07-23 15:11 f6e45f1 feat: run ps23 in a VM

guix system init

B has some spare SSDs. How about I install guix on one of those and then move it to P?

After struggling with slow local source builds of where I expected to be provided with binaries (guix weather, guix archive --authorize, ...) I got it working.

• 2024-08-02 12:05 ec21fa7 chore(ps23): authorize north american substitute server
• 2024-08-02 03:37 90eaafe feat(ps23): guix system init on boot, root partitions

hardware migration

Next comes the moment of truth: will it boot in P?

[dckc]

stay tuned to fosdem in Feb...