Hacker News Reader

Comment by legrande | Hacker News Reader

You can always have a vanilla Debian or vanilla Arch install and add things on an as-needed basis and build the OS from scratch, minimizing complexity and have them as single-duty OSes.

View on HN

Yes but those aren’t single purpose OS’s like the ones described here. These typically come with immutability and a vastly reduced attack surface

The problem with single purpose OSs in my experience is adding stuff to them like kernel modules or drivers is such a pain in the ass that it negates the benefits. I'd rather just configure a general purpose OS to be immutable/have a reduced attack surface.

It can be if you use the right base OS. NixOS for all its issues checks most of the boxes for building a single purpose OS and the process of actually building one couldn't be easier. The whole process is effectively:

1. Write a config file

2. Run the command that builds the system

3. Test the system

4. (optional) Run the command that bakes the fresh system generated from the config into an image.

5. Deploy using either an image or NixOS's config based deployment tooling.

Shouldn’t nix be able just output an image?

It absolutely can. I made the distinction between generating an image and using the nix specific infra because once you are in the ecosystem, some people prefer to use that tooling. Also there are some fancy things you can do with config based deployment that are generally harder with image based deployments.

Reply on news.ycombinator.com