[HN Gopher] Hard User Separation with NixOS ___________________________________________________________________ Hard User Separation with NixOS Author : ingve Score : 46 points Date : 2022-11-01 09:21 UTC (1 days ago) (HTM) web link (www.tweag.io) (TXT) w3m dump (www.tweag.io) | matthews2 wrote: | You could also use systemd-homed with dm-crypt or cryptfs to have | two users with two different encrypted home partitions. | solatic wrote: | This seems really dangerous. Wouldn't running garbage collection | on the nix store while in the work partition clean out nix paths | required by the home partition's install, and vice versa? | Ambroisie wrote: | I think both specializations are in the same profile, which is | a GC root. | freedinosaur wrote: | TIL specialisations: https://nixos.wiki/wiki/Specialisation | | I plan to use this for testing changes to my boot units. | | In theory, plain old generations allow you to safely test changes | to boot units, by allowing you to jump to the previous | generation. In practice, this involves remembering which | generations have known-good boots. | | Specialisations will allow me to run a stable and candy track, on | per generation. | | What other usecases do specialisations improve? | freedinosaur wrote: | This makes testing changes easier in other ways too: when I | make experimental changes, I'm reluctant to commit them until I | know they're working, since I like being able to checkout an | old commit and know it boots. In practice this means I end up | with a dirty checkout, and uncertainty on which changes have | been tested. | | In theory I could manage this with git rebasing and/or tagging, | but in practice I lose confidence in whether I've accurately | tracked. | | With specialisations, I'd comfortably commit an experimental | change to my canary track, even though it might break, safe in | the knowledge that the stable track continues to boot. | freedinosaur wrote: | > Specialisations will allow me to run a stable and candy | track, on per generation. | | Typos: | | Specialisations will allow me to run a stable and canary track, | one per generation. ___________________________________________________________________ (page generated 2022-11-02 23:00 UTC)