!zghijEASpYQWYFzriI:nixos.org

Hydra

390 Members
114 Servers

Load older messages

SenderMessageTime
22 Jun 2021
@janne.hess:helsinki-systems.dedas_j
In reply to @taneb:hacksrus.uk
Has there been any thought about making systemd-analyze security less upset by the Hydra units NixOS generates?
I can provide you with the units we use 		08:51:24
@janne.hess:helsinki-systems.dedas_j

well it's worse than I remembered:

hydra-check-space.service                  9.6 UNSAFE    😨
hydra-compress-logs.service                9.6 UNSAFE    😨
hydra-evaluator.service                    3.7 OK        🙂
hydra-notify.service                       5.0 MEDIUM    😐
hydra-queue-runner.service                 3.7 OK        🙂
hydra-server.service                       3.7 OK        🙂
hydra-update-gc-roots.service              3.2 OK        🙂
prometheus-hydra-exporter.service          5.0 MEDIUM    😐
09:25:05
@sandro:supersandro.deSandroAt least the emoji is not crying09:25:56
@taneb:hacksrus.ukTanebBy default they're all 9.6 or 9.2 and... I really don't think they need to be10:01:04
@janne.hess:helsinki-systems.dedas_jmy units would probably be a lot better if I used CapabilityBoundingSet but I'm doing that with AppArmor because it's a lot less annoying. systemd doesn't detect that and therefore scores my units worse than they really are10:02:01
@grahamc:nixos.org@grahamc:nixos.orgit'd be great to improve them13:57:09
@grahamc:nixos.org@grahamc:nixos.organyone want to open a bug?13:57:35
@taneb:hacksrus.ukTanebhttps://github.com/NixOS/hydra/issues/97714:49:20
@blaggacao:matrix.orgDavid Arnoldhttps://demo.hedgedoc.org/s/RO9YawHcY#20:03:32
@blaggacao:matrix.orgDavid Arnold(ideas worth spreading?)20:03:51
@tomberek:matrix.orgtomberek
In reply to @blaggacao:matrix.org
https://demo.hedgedoc.org/s/RO9YawHcY#
I enjoyed this article. https://gregoryszorc.com/blog/2021/04/07/modern-ci-is-too-complex-and-misdirected/ I prefer to take it farther and even consider some batch data flows to be “indistinguishable from a build/CI system”. And it just so happens we have a powerful+flexible build system to utilize. 		20:13:50
@blaggacao:matrix.orgDavid ArnoldThanks I'll put that in the intro!20:18:45
@blaggacao:matrix.orgDavid Arnold Nice! That guy had the same feeling... I'd like for that article to be updated and instead of directing towards taskcluster, let them shiver in awe for what can be done with nix and a declarative State Machine + a declarative rules evaluator. 20:23:48
@blaggacao:matrix.orgDavid Arnold * Nice! That guy had the same feeling... I'd like for that article to be updated and instead of directing towards taskcluster, let them shiver in awe for what can be done with nix (the build DAG) and a declarative State Machine + a declarative rules evaluator. 20:26:27
@blaggacao:matrix.orgDavid Arnold AM I correct that we are slowly working towards fanning out builds within a DAG in nix? 20:28:33
@blaggacao:matrix.orgDavid Arnold * Am I correct that we are slowly working towards fanning out builds to remote builders within a DAG in nix? 20:28:51
@blaggacao:matrix.orgDavid Arnold * Am I correct that we are slowly working towards fanning out builds to remote builders within a build DAG in nix? 20:28:57
@blaggacao:matrix.orgDavid ArnoldOn the partial build side of things, where are we standing vs. bazel? Do we have already have composable partial rebuilds according to subtree changes?20:30:25
@blaggacao:matrix.orgDavid Arnold I like the hydraJobs flake output special meaning, but I'd prefer it to be just jobs with a well informed interface. 20:32:30
@blaggacao:matrix.orgDavid Arnold * I like the hydraJobs flake output special meaning, but I'd prefer it to be just jobs with a well informed interface, that not only can return derivations but also talke to a remote resource (the state machine). Ideas? 20:33:12
@blaggacao:matrix.orgDavid ArnoldLooks like there is potential for entanglement ...20:33:46
@blaggacao:matrix.orgDavid Arnold * I like the hydraJobs flake output special meaning, but I'd prefer it to be just jobs with a well informed interface, that not only can return derivations but also talk to a remote resource (the state machine). Ideas? 20:34:06
@tomberek:matrix.orgtomberek The granularity (or lack of) of some builds is the primary limitation for partial rebuilds. I’ve thought of a check-pointing mechanism for certain builds would be helpful, but I don’t know how to make it general enough. I’m also under the impression some PoCs have been done with bazel and a few others. 20:38:25
@blaggacao:matrix.orgDavid ArnoldThanks! I think flakes with their very strict input / output interfaces can be a milestone towards granularity. What do you think?20:42:58
@blaggacao:matrix.orgDavid Arnold

Also I'm breading over this addition:

## `taskcluster`? (pha, `nix` build DAG!)

Let's circle back to `taskcluster` as mentioned in the introductory rant. It seems that task cluster knows how to run a DAG of batch jobs. That's a bit of a different focus than a proper state machine, though. As for the build itself, we have our beloved `nix` primitives to resolve the build DAG.
20:43:32
@blaggacao:matrix.orgDavid Arnold

I'm not familiar enough with how everything is currently working, but would it make sense to wish for

some remote build delegation and parallelization while observing the inherent build DAG.

20:44:43
@blaggacao:matrix.orgDavid Arnold (like builtin into nix itself, if that's not already the case?) 20:44:59
@rick:matrix.ciphernetics.nlRick (Mindavi)Content-addressability will ensure that partial rebuilds will work (when it's determined that there's no influence on the build)20:47:27
@rick:matrix.ciphernetics.nlRick (Mindavi)Nix will indeed build in parallel when it's possible20:47:43
@rick:matrix.ciphernetics.nlRick (Mindavi)Taking the graph into account20:47:56

Show newer messages

Back to Room ListRoom Version: 6