Create a GUI profile

To begin, you must create a new profile specifically for managing GUI programs within the Incus container. This can be done using the following command:

incus profile create gui

And edit with incnus profile edit gui. Throw the following contents in and save it.

config:
  environment.DISPLAY: :0
description: ""
devices:
  X0:
    bind: container
    connect: unix:@/tmp/.X11-unix/X0
    listen: unix:@/tmp/.X11-unix/X0
    security.gid: "1000"
    security.uid: "1000"
    type: proxy
  mygpu:
    type: gpu
name: gui

We are using host's display so we will be using sockets.

Add NixOS configuration

Now add the following in configuration.nix, rebuild and switch.

users.users.root = {
  subUidRanges = [
    {
      count = 1000;
      startUid = 1000;
    }
  ];
  subGidRanges = [
    {
      count = 1000;
      startGid = 1000;
    }
  ];
};

This update enables the matching of users and groups between your host machine and container.

Configure default Incus settings

Create or edit the ~/.config/incus/default.conf file to provide default settings tailored specifically for running GUI applications within an Incus container. Add these configurations to your default.conf:

## For regular unpriv containers:
#incus.id_map = u 0 100000 65536
#incus.id_map = g 0 100000 65536
## For GUI upriv containers
incus.idmap = u 0 100000 1000
incus.idmap = g 0 100000 1000
incus.idmap = u 1000 1000 1
incus.idmap = g 1000 1000 1
incus.idmap = u 1001 101001 64535
incus.idmap = g 1001 101001 64535
incus.mount.entry = /dev/dri dev/dri none bind,optional,create=dir
incus.mount.entry = /dev/snd dev/snd none bind,optional,create=dir
incus.mount.entry = /tmp/.X11-unix tmp/.X11-unix none bind,optional,create=dir
incus.mount.entry = /dev/video0 dev/video0 none bind,optional,create=file

These configurations allow for the proper mapping of GUI applications within Incus and provide mounting entries that correspond to essential devices required by these programs (e.g., graphics card drivers).

On host machine, run

xhost +local:

Add your container to gui profile:

incus profile add <container> gui

Running X Server Inside Your Container:

Now that you've set up your profile, it's time to install an X server inside your container to render graphical elements on the GUI applications. The installation process may vary depending on your distribution and version. For example, if using Arch Linux, run these commands:

yay -S xorg-server xorg-xauth xorg-drivers mesa-utils

This will install X server components required to render the GUI elements for your applications within Incus.

Executing a GUI Program in Your Container

Finally, let's test our setup by running an example GUI program inside the container with the appropriate user permissions. To do this, use the following command:

incus exec <container> --user 1000 -- glxgears

After executing the above command, you should see a window displaying spinning gears from the GLXGEARS program - indicating that your GUI application is now successfully running within Incus Container.

Happy hacking!

The One Liner Solution:

If you’re looking to share a specific directory containing your container data, here is the one-liner syntax for adding the file source and path within the container configuration:

incus config device add <container> <device name> <device type> source=/<path/to/directory/> path=/<mount/point/in/container>

To give you a better understanding, let’s look at an example. Suppose we have a container named container1 and want to share files located in the /srv/movies directory with a mount point of /mnt/movies within the container itself:

incus config device add container1 movies disk source=/srv/movies path=/mnt/movies

Alternative Method for Advanced Users:

If you’re feeling adventurous and want to directly edit the configuration, Incus provides an alternative method. With this approach, you can leverage YAML syntax within your container configuration file with incus config edit <container>. Here is how it works using our previous example:

dveices:
  movies:
    path: /mnt/movies
    source: /srv/movies
    type: disk

Happy hacking!

I found the documentation regarding NixOS lacking and thought I should put it somewhere for future reference. If you have experience with LXD, it will mostly be similar but expect things to get different as time passes.

Installation

Incus is already present in nixpkgs and can be installed by adding

virtualisation.incus.enable = true

to your configuration.nix. Consider adding yourself to incus-admin group to avoid using sudo every time. It can be done by

users.user.USER.extraGroups = [ "incus-admin" ];

Of course, replace USER with your username.

You need IP forwarding for NAT'ing to work

boot.kernel.sysctl = {
    "net.ipv4.conf.all.forwarding" = true;
    "net.ipv4.default.forwarding" = true;
};

Enable kernel module for IP forwarding to work

boot.kernelModules = [ "nf_nat_ftp" ];

Set up a bridge

networking.bridges = { incusbr0.interfaces = []; };

This is used to provide NAT'd internet to the guest. It is manipulated directly by incus, so no need to specify any bridged interfaces here.

Add firewall rules to enable networking in the container

networking.firewall.extraCommands = ''
    iptables -A INPUT incusbr0 -j ACCEPT
    iptables -A FORWARD -o incusbr0 -j ACCEPT
    iptables -A FORWARD -i incusbr0 -j ACCEPT
    iptables -A OUTPUT -o incusbr0 -j ACCEPT
'';

Enable lxcfs to use it

virtualisation.lxc.lxcfs.enable = true;

Now switch to the new configuration with

nixos-rebuild switch

Setting up incus

Incus requires initial setup for networking and storage. It can be done interactively by running

incus admin init

List all available images

incus image list images:

Create a new image alpine based on Alpine Linux

incus launch images:alpine/3.19 alpine

Interact with the newly created image

incus exec alpine -- ash

This will drop you in an ash shell in the container.

You can copy containers by running

incus copy $CONTAINER1 $CONTAINER2

List containers

incus list

Stop container

incus stop $CONTAINER

Delete container

incus delete $CONTAINER

Configuration

Launch a new container with resource constrants

incus launch images:alpine/3.19 alp1 --config limits.cpu=1 --config limits.memory=192MiB

Check configuration

incus config show alp1

Update configuration

incus config set alp1 limits.memory=128MiB

Interaction

Run arbitrary commands

incus exec alpine -- apk update

Pull a file from container

incus file pull alpine/etc/hosts .

Push file back to the container

incus file push hosts alpine/etc/hosts

Snapshots

Create a snapshot

incus snapshot create alpine alpine_snapshot

Restore the container to the snapshot

incus snapshot restore alpine alpine_snapshot

Delete the snapshot

incus delete alpine/alpine_snapshot

References

1. Howto setup LXD on NixOS with NixOS guest using unmanaged bridge network interface

2. First steps with Incus

Bash by itself is pretty basic. Syntax highlighting, auto-suggestion and history matching are pretty helpful features in any shell. Users might be worried about the bloat these features bring and add delay to the startup of the shell.

I've been using these features for quite a while and have yet to see a performance hit. So it should be safe to assume you won't be having any of these problems either.

The reason why I am configuring bash instead of using other shells that have a better support these features is nix develop and nix shell expect bash and most of its functionalities are built around bash. So I do not recommend using a different shell for these.

ble.sh

ble.sh or Bash Line Editor is a command line editor written in pure Bash and replaces GNU Readline. Although it is written in Bash, it relies on POSIX stty to set up TTY states before and after the execution of user commands.

Installing ble.sh on NixOS is pretty straight forward as documented in the git repo.

# Spawn a development shell to bring in dependencies
nix develop nixpkgs#bash
# Bring build dependencies to path
nix shell nixpkgs#git nixpkgs#gnumake

# Try without installing
git clone --recursive --depth 1 --shallow-submodules https://github.com/akinomyoga/ble.sh.git
make -C ble.sh
source ble.sh/out/ble.sh

# Install to ~/.bashrc
git clone --recursive --depth 1 --shallow-submodules https://github.com/akinomyoga/ble.sh.git
make -C ble.sh install PREFIX=~/.local
echo 'source ~/.local/share/blesh/ble.sh' >> ~/.bashrc

Now add the following line to home.nix:

programs.bash = {
    bashrcExtra = ''
        . ~/.bashrc
    '';
};

Switch to the new configuration:

home-manager switch

Now the changes should persist across sessions.

ble.sh brings syntax highlighting, auto-completion, auto-suggestion, menu-complete and more.

Starship

Starship customizes shell prompt. The defaults are surprisingly sane for what it does. It is fast and does not get in the way. The prompt changes based on your directory. You can install it by adding it to home.nix:

home.packages = with pkgs; [ starship ];

Append the line to ~/.bashrc

eval "$(starship init bash)"

Personally, I never felt the need to change it but you can choose from the many existing configurations. Oh, and have Nerd Font enabled.

Problem Statement & Initial Investigation

Before I begin, I must state that I am using libvirt, docker and NetworkManager. Maybe the problem lies somewhere else if you are using something else like wpa_supplicant or systemd-resolved.

Recently I faced an issue where I could not access the internet within libvirt VMs and docker containers on both NixOS and Archlinux distributions. I had already explored several potential solutions, including checking iptables configurations, but found no blockages of internet traffic. The realization that the same problem occurred in different operating systems suggested that it was more likely an issue with network configuration rather than software faults.

Initial Steps Taken:

1. Examine ip a and ip r outputs for further information regarding network interfaces, IP addresses, and routes.

2. Check iptables configurations for any blockages or misconfigurations that might be affecting internet access within the VMs/containers.

3. Look into Ubuntu-related threads to compare similar issues with different operating systems to determine if it’s a configuration problem.

4. Research networkmanager, libvirt, and docker to better understand their interplay in managing networking aspects of virtual environments and containers.

5. Investigate possible solutions by modifying configurations based on user experience, documentation, and other online resources.

Resolving the Issue: The Solution Found

After a thorough examination of different potential causes and attempting several fixes, I stumbled upon an effective solution for the networking issues in VMs and containers. By adding virbr0 and docker0 as unmanaged interfaces within networkmanager configuration, I was able to successfully manage internet connectivity across these environments without interference from libvirt or docker.

Add the following line to configuration.nix:

networking.networkmanager.unamaged = [ "virbr0" "docker0" ];

For other distributions using NetworkManager, see NetworkManager.conf(5) and RedHat documentation:

[keyfile] unmanaged-devices=interface-name:virbr0;interface-name:docker0

Key Learnings & Takeaways:

• Virtual bridges should be managed automatically by software like libvirt; manual configurations could lead to unexpected consequences and complications in networking settings.

• Adding another bridge is not a suitable solution for resolving connectivity issues within VMs/containers, as this may create additional complexity and introduce potential conflicts with other network management systems.

• While libvirt automatically configures dnsmasq to establish internet access in virtual machines, it’s essential to understand how these components interact to maintain a stable connection across different environments.

• It is crucial for users facing similar networking issues to approach the problem from multiple angles and carefully evaluate potential solutions before making any changes. This ensures an informed decision-making process that prioritizes stability, security, and usability within their computing environment.

A question remains

Why did the problem surface only now? I have been using NetworkManager for a few years. Maybe something changed on their side.

LUKS Explained

LUKS (Linux Unified Key Setup) encryption refers to a secure, flexible, and robust full-disk encryption system designed for Linux operating systems. It provides an additional layer of security by encrypting the entire storage device or partition instead of just individual files or directories within the file system hierarchy. This makes it much more difficult for unauthorized access or data theft, ensuring privacy and protection against potential threats from malicious actors.

In simple terms, LUKS creates a secure encryption key that is required to decrypt your encrypted storage device before you can use it normally. The process of turning on this security feature starts with initializing the disk partition you want to protect using the ‘cryptsetup’ command line tool. Once initialized, you will need to create a strong passphrase or enter the encryption key which is used for unlocking the encrypted data later when you need access to your system.

LUKS uses AES (Advanced Encryption Standard) and two other ciphers - Serpent and Twofish as its primary options, although users can choose different encryption algorithms based on their requirements and preferences. The LUKS standard also offers several modes of operation including:

1. XTS Mode with a 512-bit key size: This is the default mode for LUKS, providing strong security without sacrificing performance. It uses the AES block cipher in an XEX (XOR Encrypted eXchange) mode and combines two keys to encrypt each data block.

2. CBC Mode with a 512-bit key size: This is an alternative mode that employs standard Cipher Block Chaining encryption. While it offers slightly less security compared to XTS, its performance may be faster on older hardware since the algorithm is simpler and requires fewer computational resources.

3. LRW Mode with a 512-bit key size: This provides an option for compatibility with Microsoft Windows BitLocker Drive Encryption (BDE). It uses AES in Cipher Feedback mode, which ensures that changes to one data block do not affect other blocks’ encryption state.

It is essential to note that once a storage device or partition has been encrypted using LUKS, it will remain encrypted even if the system crashes or shuts down unexpectedly without saving the unlocking key properly. In this case, you would need the passphrase or recovery keys (optional) to regain access and recover your data.

LUKS2 over LUKS

Although LUKS was initially introduced with the intention of providing an easy-to-use, flexible and secure mechanism to protect sensitive information stored on hard drives or other storage devices, over time, two main versions have been developed – LUKS1 (the original version) and LUKS2 (the newer enhanced version).

LUKS2 (Linux Unified Key Setup version 2) is a cryptographic disk encryption system designed specifically for Linux operating systems, which provides an extra layer of security by encrypting the data stored on your hard drive or other storage devices. It was created to improve upon its predecessor, LUKS1, by offering better usability and more advanced features like key wrapping and full-disk encryption capabilities.

LUKS2 functions as a framework that provides a standardized method of creating and managing encrypted partitions on your system. When you use LUKS2 to encrypt your hard drive or partition, the data stored within it is encoded with complex algorithms making it unreadable without access to its encryption key. This means that even if someone gains physical access to your storage device, they will not be able to read the information unless they have the correct decryption key.

LUKS1 has several limitations:

• Weak key management: Luks1 uses a fixed-size key for all devices, which can be problematic in scenarios where multiple users need to access the same device or when data ownership changes.

• No support for multi-factor authentication (MFA): LUKS1 does not provide any built-in MFA capabilities, which can be a significant security concern in today’s threat landscape.

LUKS2 offers several advantages over LUKS1:

• Better performance: One of the main improvements in LUKS2 is the reduced performance impact on the system during encryption and decryption processes. With LUKS1, there was a noticeable slowdown in system performance when dealing with encrypted disks. In contrast, LUKS2 has been optimized to provide better performance without compromising security, making it more suitable for everyday use.

• Improved security: LUKS2 includes several new security features compared to LUKS1. For instance, the new version supports per-file encryption and decryption, allowing users to encrypt individual files or directories rather than entire disks. This can be particularly useful when dealing with sensitive data that does not require full disk encryption. Additionally, LUKS2 has been updated to support the latest cryptographic algorithms, such as ChaCha20, which provides enhanced security compared to older ciphers like AES.

• Multi-factor authentication (MFA): LUKS2 provides built-in MFA capabilities through the use of hardware security tokens or other trusted authenticators, enhancing overall security posture.

• Enhanced support for larger drives: LUKS2 has been optimized for modern storage devices (e.g., SSDs) with higher capacities, ensuring faster encryption/decryption times and better performance under heavy workloads.

• Key Management: Another significant advantage of LUKS2 is its improved key management capabilities. In comparison to LUKS1’s limited key handling options (where you either needed to remember your passphrase or use a single keyfile), LUKS2 provides more flexibility with multiple key slots and the ability to use different keys for each slot, thus improving data security and making it easier to rotate encryption keys. This feature helps in better management of encryption keys and reduces the risk associated with storing sensitive information on a computer system.

• Flexible key sizes: LUKS2 supports flexible key sizes (e.g., 128-bit, 256-bit), enabling more secure key storage and reducing the risk of key exposure. It also allows multiple users to share a single device while maintaining individual access control.

• Compatibility: As LUKS1 was developed years before LUKS2, there is often compatibility issue when working across different Linux distributions. In contrast, LUKS2 has been designed to be more compatible with multiple versions of Linux and various other operating systems like FreeBSD, NetBSD, and OpenSolaris, thus making it an ideal choice for users who need their encryption solution to work seamlessly across diverse platforms.

• Integration: One of the key selling points of LUKS2 is its integration with full disk encryption tools such as dm-crypt (Device Mapper Cryptographic Volume Manager) and cryptsetup, which are used by most Linux distributions for handling encrypted partitions. This makes it easier to implement and maintain encryption on multiple systems using the same encryption methodology.

• Efficiency: LUKS2 provides better performance in terms of encryption and decryption processes compared to its predecessor. While both versions are known to have minimal impact on system performance when idle, LUKS1’s XTS mode can be a bit slower during data read or write operations due to the requirement for additional metadata processing that isn’t present in AES-XTS encryption used by LUKS2.

• Enhanced support for larger drives: LUKS2 has been optimized for modern storage devices (e.g., SSDs) with higher capacities, ensuring faster encryption/decryption times and better performance under heavy workloads.

• Backwards compatibility: Although LUKS2 is not directly compatible with LUKS1, you can use the cryptsetup command alongside the original LUKS for a transition period. This allows users to gradually migrate their systems from LUKS1 to LUKS2 without losing access to existing encrypted volumes or experiencing any performance issues during the transition.

LUKS serves as an essential tool in protecting data stored on your storage devices by providing powerful encryption capabilities with enhanced flexibility, compatibility, and security features. Its integration into popular Linux distributions and ease of use make it a valuable addition to any system administrator’s arsenal when securing sensitive information.

The project aims to create a custom Linux distribution from scratch. LFS provides users with a fully customizable and optimized Linux system that can be tailored to their specific needs and preferences.

The LFS Project Explained

It is designed to provide users with a fully customizable and optimized Linux system that can be tailored to their specific needs and preferences. The project provides a wide range of options for customizing the system, including the choice of base operating system, the selection of packages to be installed, and the configuration of various system settings. This process also enables developers to learn how to create their own custom distributions or modify existing ones.

LFS is a great resource for anyone who wants to learn more about building a Linux system from scratch. The project provides detailed instructions and scripts that make the process easy to follow, even for beginners. Additionally, the project provides a community of users who can offer support and guidance as needed.

The main goal of LFS is to teach users about Linux by having them compile and configure each component of the operating system manually, which helps to gain a deeper understanding of the system. By following the LFS book, users can learn about the Linux kernel, GNU tools, libraries, and other essential components.

The project begins with building the Linux kernel, which involves downloading the kernel source code, configuring it, and building it on your system. From there, you can add additional packages and software to your system, including a web server, a database server, and other applications.

It also encourages users to customize their system by writing their own scripts, configuring their own init scripts, and even adding their own custom applications. The LFS community provides detailed documentation on how to build and configure a custom Linux system, and the project is designed to be a learning experience for advanced Linux users.

It’s important to note that LFS is not intended for beginners, as it requires a solid understanding of Linux and experience with the command line. However, those who are willing to invest time and effort can gain valuable knowledge and experience by participating in this project.

A gist

The Linux From Scratch project starts by providing a detailed book, available online, that serves as a comprehensive guide for building a Linux system from scratch. The book outlines the process of manually building and configuring each component of the system, including the kernel, core libraries, and essential utilities. By following the instructions in the book, users gain a deep understanding of the Linux system and its components.

The process begins by setting up a minimal host system, which is typically an existing Linux distribution or Unix-like environment. The host system provides the necessary tools and utilities required for compiling the source code and building the LFS system. Once the host system is prepared, the LFS book guides users through the steps of creating a temporary system, which includes compiling and installing the basic toolchain, such as the GCC compiler and GNU Binutils.

After setting up the temporary system, the book walks users through the process of compiling and installing the Linux kernel. This involves configuring the kernel according to the desired system specifications and hardware, compiling it, and installing it onto the target system. From there, users proceed to compile and install various core libraries, such as glibc (GNU C Library), which provide essential functionality to the system.

As the process continues, users gradually build and configure additional components, including system utilities, shell, boot scripts, and configuration files. The LFS book provides clear instructions and explanations for each step, allowing users to understand the purpose and functionality of each component they are building.

By following the Linux From Scratch project, users gain a comprehensive understanding of the Linux system from the ground up. They learn about the intricacies of compilation, linking, dependency management, and configuration. Furthermore, LFS allows users to create a highly customizable Linux system, tailored to their specific needs, preferences, and desired level of system complexity.

It’s worth noting that Linux From Scratch is primarily intended for educational purposes and as a learning experience. It requires a significant time commitment and a strong willingness to delve into the technical details of the system. While it can be a valuable exercise in understanding Linux internals, it may not be practical or necessary for every user or development scenario.

Additionally, LFS is part of a broader family of related projects, such as Beyond Linux From Scratch (BLFS), which expands on the initial LFS system by providing instructions for installing and configuring additional software packages and building a more complete Linux distribution.

Is Linux from Scratch (LFS) a good way to learn Linux?

Linux from Scratch (LFS) can be a good way to learn Linux if you are an advanced user looking to dive deep into the inner workings of the Linux operating system. LFS provides a step-by-step guide for building a completely customized Linux system from scratch, which can be a rewarding learning experience if you are interested in learning more about Linux.

Like already highlighted, LFS is not for everyone. It requires a significant amount of time and effort to complete, and it can be challenging for beginners who are just getting started with Linux. If you are new to Linux, there are other resources and courses that may be more appropriate for your skill level and learning style.

In general, LFS is a good way to learn Linux if you are already familiar with the basics of Linux and are looking for a more hands-on, in-depth learning experience.

With that being said, let’s dive into why you should and should not use Linux From Scratch.

Using Linux From Scratch (LFS) offers several advantages and disadvantages. Let’s highlight some of the reasons why one should and should not use LFS:

Reasons to use Linux From Scratch:

Knowledge and understanding

Building your own Linux distribution from scratch provides a deep understanding of the inner workings of Linux, which can be beneficial for system administrators, developers, and enthusiasts alike.

By engaging in the Linux From Scratch (LFS) project, you have the opportunity to acquire a wealth of knowledge and understanding in several key areas. Firstly, you will gain a deep comprehension of Linux internals and the underlying mechanisms of the operating system. Through the process of building a Linux system from scratch, you will explore concepts such as process management, memory management, file systems, device drivers, and networking. This knowledge empowers you to have a comprehensive understanding of how the different components of a Linux system interact and work together.

Secondly, LFS enables you to develop proficiency in building and compiling software from source code. You will become familiar with essential tools like the GNU Compiler Collection (GCC), make, and various libraries. This expertise is valuable for working with custom software, optimizing performance, and resolving issues related to software compilation and linking.

The project also provides you with a solid understanding of dependency management. By manually managing dependencies during the LFS process, you will learn how to identify, resolve, and satisfy library and package dependencies. This knowledge is instrumental in dealing with complex software ecosystems and ensuring the compatibility of different software components.

Moreover, LFS fosters your ability to configure and customize a Linux system to suit specific requirements. You will gain insights into the configuration options and parameters that impact performance, security, and functionality. This skill is particularly useful for developing software in specialized environments or when working with unique system requirements.

As you encounter challenges and overcome obstacles during the LFS journey, you will enhance your troubleshooting and debugging skills. You will develop the ability to diagnose and resolve issues related to compilation, configuration, and integration of various components. This aptitude for troubleshooting is highly valuable in maintaining and managing Linux systems in real-world scenarios.

The knowledge gained through Linux From Scratch contributes to strengthening your system administration skills. You will become adept at package management, user management, system configuration, and maintenance. You will acquire the expertise to manage system services, create custom startup scripts, and fine-tune the system for optimal performance. These skills are highly relevant for professional Linux system administration roles.

Completing the Linux From Scratch project signifies a significant achievement. It demonstrates your in-depth understanding of the Linux system and the ability to construct a fully functional and customized Linux distribution from source code. This accomplishment showcases your expertise in Linux internals, software development, and system administration, making you an attractive candidate for roles involving Linux kernel development, device driver development, embedded systems, system administration, or software development in resource-constrained environments.

Customization

With LFS, you have full control over the selection and configuration of every component in your system. Customization in this context refers to tailoring the system’s components, configuration, and settings according to your preferences, needs, and intended use. It allows you to have full control over the software packages, kernel configuration, system services, and user environment.

Customization is helpful because it enables you to create a Linux system that is optimized for your specific use case. Whether you are developing software, setting up a server, or configuring an embedded system, being able to tailor the system to your exact needs can lead to improved performance, enhanced security, and increased productivity. You can selectively include or exclude software packages, fine-tune system parameters, and optimize resource utilization based on the specific requirements of your project or environment.

From a career perspective, proficiency in customization gained through Linux From Scratch can be highly beneficial. It showcases your ability to understand and manipulate the intricacies of a Linux system, highlighting your expertise in system administration, software development, or specialized fields like embedded systems. Employers often value individuals who can create tailored and efficient systems, as it demonstrates resourcefulness, problem-solving skills, and the ability to adapt to different scenarios.

The process of customization in LFS entails configuring various components of the Linux system. This includes selecting the appropriate software packages, setting up kernel options, configuring system services, creating custom startup scripts, and establishing user environments. The LFS book provides guidance on these customization steps, allowing you to make informed decisions and apply modifications to suit your specific requirements.

By engaging in customization through Linux From Scratch, you achieve a higher degree of control and ownership over your Linux system. You gain a deeper understanding of the interactions between different components, and you become proficient in managing software, system configuration, and user environments. Additionally, you develop the skills necessary to troubleshoot, adapt, and fine-tune the system for optimal performance.

Furthermore, the ability to customize a Linux system demonstrates your adaptability and flexibility in working with different software ecosystems and environments. It allows you to address specific challenges and requirements that may arise in your career, enabling you to take on diverse projects and contribute effectively to various development or system administration tasks.

Security

By building your own distribution, you can ensure that only the necessary and trusted components are included, reducing potential security risks.

LFS empasizes on security. In this context, security refers to the implementation of measures and practices to protect the Linux system from unauthorized access, data breaches, and other potential security threats. LFS enables users to build a secure foundation for their Linux system by allowing them to make informed decisions regarding security-related configurations, software choices, and system hardening techniques.

Security is of utmost importance in the technology industry, and particularly in the realm of Linux systems. With the increasing reliance on digital infrastructure, the potential risks and threats to information security have become more prevalent. Cyberattacks, data breaches, and malicious activities can have severe consequences, including compromised sensitive data, financial losses, reputational damage, and legal implications. Therefore, organizations and individuals alike prioritize security to safeguard their systems, protect valuable assets, and maintain the privacy and trust of their users.

By using LFS, you have the opportunity to enhance security in your Linux system. You can make conscious decisions about security-related configurations during the build process, such as enabling secure kernel options, carefully selecting software packages with strong security track records, and properly configuring system services. LFS also provides insights into system hardening techniques, such as setting up appropriate user permissions, implementing secure network configurations, and applying access controls.

The knowledge and experience gained through implementing security practices in Linux From Scratch can significantly benefit your career. Employers highly value individuals who can demonstrate a strong understanding of security principles and possess the skills to build secure systems. In many organizations, security is a top priority, and having expertise in this area can make you an attractive candidate for roles such as system administrator, network security specialist, or software developer focused on secure coding practices.

Implementing security in LFS entails making informed choices and applying security best practices throughout the system configuration and software selection processes. This may involve researching security vulnerabilities, understanding the security implications of different configuration options, and staying updated with security-related developments and patches in the Linux community. Additionally, it involves being proactive in following security guidelines, industry standards, and best practices when it comes to securing the Linux system.

By emphasizing security in Linux From Scratch, you achieve a higher level of confidence in the security posture of your Linux system. You gain practical experience in implementing security measures, understanding security trade-offs, and making informed decisions that align with your security requirements. Additionally, you develop a comprehensive understanding of security concepts and practices, which can be applied not only in the LFS context but also in various professional settings where security is a critical concern.

Learning experience

LFS serves as a practical learning tool for those who want to gain hands-on experience with Linux system administration and understand the concepts behind it.

The project offers a valuable learning experience in the realm of Linux development and system administration. A learning experience refers to the process of gaining knowledge, skills, and practical insights through hands-on involvement in building a Linux system from scratch. LFS provides a structured and comprehensive approach that allows individuals to delve into the intricacies of the Linux operating system, understand its components, and develop a deep understanding of its inner workings.

A robust learning experience is crucial for professional and personal growth. It equips individuals with the knowledge and skills needed to excel in their careers and adapt to the ever-evolving technology landscape. In the case of LFS, the learning experience contributes to a multitude of benefits.

Firstly, the learning experience gained through LFS provides a thorough understanding of Linux internals. By actively participating in building a Linux system, individuals gain insights into core concepts such as process management, memory management, file systems, device drivers, and networking. This knowledge forms a solid foundation for further exploration and specialization in Linux development or system administration.

Secondly, the hands-on nature of the learning experience enhances practical skills. Through LFS, individuals develop proficiency in compiling software, managing dependencies, configuring system components, and troubleshooting issues that may arise during the build process. These practical skills are highly transferable and can be applied to various real-world scenarios, such as software development, system administration, or embedded systems.

Furthermore, the learning experience in LFS cultivates a mindset of continuous learning and exploration. Building a Linux system from scratch requires researching, understanding documentation, and actively seeking solutions to challenges encountered along the way. This mindset of curiosity and self-directed learning is invaluable in the technology industry, where new technologies and methodologies continuously emerge. It empowers individuals to stay up-to-date, adapt to changes, and remain effective in their careers.

The learning experience gained through LFS can have a positive impact on your career. It showcases your commitment to professional development, your ability to tackle complex projects, and your dedication to understanding the underlying mechanisms of the Linux system. Employers often value individuals who possess a deep understanding of the technologies they work with, as it demonstrates expertise and a strong foundation for problem-solving.

The learning experience in LFS entails actively engaging with the project’s resources, including the comprehensive book that provides step-by-step instructions and explanations. It involves following the instructions, researching and exploring concepts further, experimenting with different configurations, and troubleshooting any issues that arise. It is a self-driven and immersive process that encourages critical thinking, problem-solving, and the acquisition of practical skills.

By engaging in the learning experience provided by Linux From Scratch, you achieve a comprehensive understanding of the Linux system, gain practical skills applicable to various technology domains, and foster a mindset of continuous learning. You develop expertise in Linux internals, software compilation, configuration, and troubleshooting, positioning yourself for career advancement in Linux development, system administration, or related fields. Additionally, the learning experience hones your ability to adapt to new technologies and environments, ensuring long-term professional growth and success.

Performance

A custom-built LFS system can potentially offer better performance since you can optimize the chosen components for your specific hardware.

Using Linux From Scratch (LFS) can lead to improved performance in your Linux system. Performance refers to the system’s ability to efficiently utilize its resources, such as processing power, memory, and storage, to deliver optimal speed, responsiveness, and overall system efficiency. Achieving good performance is essential for maximizing productivity, user satisfaction, and system reliability.

Performance is crucial because it directly impacts the user experience and the efficiency of computing tasks. A system with good performance responds quickly to user input, runs applications smoothly, and completes tasks in a timely manner. This translates to increased productivity, reduced waiting times, and an overall more satisfying computing experience.

Despite advancements in hardware capabilities, performance optimization remains relevant. While hardware may be more powerful, software systems continue to evolve and become more complex, often demanding greater resources. Poorly optimized software can still lead to sluggish performance, even on powerful hardware.

Caring about performance is important because it allows you to leverage the full potential of your hardware investment. By optimizing the Linux system through LFS, you can ensure that system resources are efficiently utilized, leading to faster application execution, reduced latency, and improved overall system responsiveness. This is particularly crucial in resource-constrained environments, such as embedded systems or cloud computing, where efficient resource usage translates to cost savings and improved user experience.

Performance optimization is also important from a scalability perspective. In scenarios where systems need to handle a growing number of users, requests, or data, well-optimized systems can scale more effectively, accommodating increased workloads without significant performance degradation. This scalability is vital for systems that need to handle high-demand scenarios or rapidly evolving business needs.

Caring about performance and possessing the skills to optimize it can significantly benefit your career. Employers value professionals who can deliver efficient and high-performing systems, as it directly impacts business productivity and user satisfaction. Performance optimization skills are highly sought after in roles such as software engineering, system administration, cloud infrastructure management, and embedded systems development.

Achieving performance optimization through Linux From Scratch entails various aspects. It involves carefully selecting and configuring software components to minimize resource usage and eliminate unnecessary overhead. Optimizing compiler flags and build options can help generate more efficient executable code. Fine-tuning kernel parameters, memory management settings, and system services can also contribute to performance improvements. Additionally, leveraging performance analysis tools and techniques to identify bottlenecks and optimize critical sections of code or system configurations is essential.

By investing in performance optimization through Linux From Scratch, you achieve a Linux system that is finely tuned to maximize resource utilization, minimize latency, and enhance overall system responsiveness. You gain practical experience in performance analysis, optimization techniques, and system tuning, which are highly applicable in real-world scenarios. Moreover, you position yourself as a skilled professional capable of delivering high-performing systems, which can contribute to career growth, increased job opportunities, and recognition in the technology industry.

Complete Control

Building a Linux system from scratch using Linux From Scratch gives you complete control over every aspect of your system. You can customize it to your specific needs, ensuring that it includes only the components and features you require.

LFS provides you with complete control over your Linux system. Complete control means having the ability to make informed decisions and have full autonomy over the components, configurations, and functionalities of your Linux system. It allows you to tailor the system precisely to your needs, preferences, and specific use cases.

While vendors and distribution maintainers are knowledgeable about computers and their respective products, having complete control over your Linux system offers several advantages. First and foremost, it allows you to customize the system according to your specific requirements. You can choose the software packages, libraries, and kernel options that best suit your needs, ensuring optimal performance, functionality, and security.

Having complete control also enables you to avoid unnecessary bloat and overhead. By selectively including only the components you need, you can create a lean and efficient system that minimizes resource usage. This is particularly important in resource-constrained environments, where efficient utilization of hardware resources is critical for performance and cost-effectiveness.

Furthermore, complete control provides the flexibility to experiment, innovate, and adapt. You are not limited to the choices and configurations offered by vendors or predefined distributions. Instead, you can explore different software combinations, experiment with cutting-edge technologies, and fine-tune the system to optimize performance for your specific use cases. This flexibility allows you to stay ahead of the curve and adapt to changing requirements and emerging technologies.

While vendors may have extensive knowledge and expertise, having complete control over your Linux system empowers you to take ownership and responsibility for its configuration and management. It allows you to better understand the system’s inner workings, gain insights into Linux internals, and sharpen your problem-solving skills. This knowledge and experience are highly valuable in roles such as system administration, software development, or specialized fields like embedded systems.

Having the ability to exercise complete control over your Linux system through LFS entails actively engaging in the process of building the system from scratch. It involves following the detailed instructions provided in the LFS book, making informed decisions regarding software packages, configurations, and optimizations, and actively troubleshooting any issues that arise. This hands-on approach fosters a deeper understanding of the Linux ecosystem, its components, and their interdependencies.

By achieving complete control over your Linux system through LFS, you gain a sense of ownership and mastery over the system. You acquire a comprehensive understanding of Linux internals, practical experience in system configuration and management, and the ability to customize the system to your exact specifications. This achievement can positively impact your career by demonstrating your expertise, problem-solving abilities, and adaptability to different environments. Employers value professionals who possess a deep understanding of the technologies they work with, and having complete control over your Linux system positions you as a knowledgeable and resourceful candidate.

Deep Understanding

By manually compiling and configuring each component of your Linux system, you gain a deep understanding of how it works. This knowledge can be invaluable for troubleshooting, optimizing performance, and expanding your Linux administration skills.

Using Linux From Scratch (LFS) offers the benefit of gaining a deep understanding of a Linux system. Deep understanding refers to a comprehensive knowledge of the inner workings, components, and interactions within a Linux system. It entails understanding core concepts, such as process management, memory management, file systems, networking, and device drivers.

While offloading tasks to professionals can be a viable option, caring about deep understanding of a Linux system brings several advantages. First and foremost, it empowers you to have greater control and autonomy over your systems. It allows you to make informed decisions, troubleshoot issues independently, and tailor the system to meet your specific requirements. This level of control can be invaluable when working on specialized projects, developing custom software, or managing complex environments.

Deep understanding of a Linux system also enhances your problem-solving abilities. It equips you with the knowledge and skills to diagnose and resolve issues efficiently. By comprehending the inner workings of the system, you can effectively troubleshoot, optimize performance, and identify root causes of problems. This problem-solving capability is highly valuable in various technology roles, including system administration, software development, and technical support.

Furthermore, a deep understanding of a Linux system fosters continuous learning and adaptability. It enables you to stay up-to-date with the latest technologies, security practices, and emerging trends within the Linux ecosystem. This adaptability allows you to tackle new challenges, explore cutting-edge technologies, and remain relevant in an ever-evolving industry.

Having a deep understanding of a Linux system can significantly benefit your career. It demonstrates your expertise and proficiency in Linux development, system administration, or related fields. Employers often value individuals who possess a strong foundation and in-depth knowledge of the technologies they work with. Your deep understanding can set you apart as a skilled professional capable of handling complex projects, troubleshooting critical issues, and making informed decisions.

Gaining a deep understanding of a Linux system through LFS entails actively engaging with the project’s resources, such as the LFS book. It involves following the step-by-step instructions, researching concepts further, and exploring the underlying principles behind each component. It also entails hands-on experience in configuring, compiling, and managing the system, as well as troubleshooting issues that may arise during the process.

By achieving a deep understanding of a Linux system through LFS, you achieve a solid foundation of knowledge and practical skills. You gain insights into Linux internals, develop problem-solving capabilities, and become proficient in system configuration and management. This achievement can contribute to career advancement, open doors to new opportunities, and increase your value as a technology professional. Moreover, the deep understanding you acquire positions you as a resourceful, adaptable, and knowledgeable individual in the Linux ecosystem.

Minimalistic Approach

Linux From Scratch follows a minimalistic approach, allowing you to create a lightweight and streamlined Linux system. This can be beneficial for resource-constrained environments or specialized use cases where efficiency is crucial.

LFS offers the benefit of adopting a minimalistic approach to building a Linux system. In this context, minimalistic approach refers to constructing a system that contains only the necessary components and avoids unnecessary bloat or overhead. It focuses on simplicity, efficiency, and resource optimization by including only what is essential for the system’s intended purpose.

Caring about minimalism in LFS is beneficial for several reasons. Firstly, a minimalistic approach allows for better resource utilization. By excluding unnecessary software packages and components, the system becomes leaner, resulting in reduced memory usage, faster boot times, and improved overall system performance. This efficiency is particularly important in resource-constrained environments, embedded systems, or scenarios where optimal resource utilization is critical.

Additionally, minimalism helps to reduce attack surfaces and enhance security. By including only essential components, the system minimizes the number of potential vulnerabilities, reducing the likelihood of security breaches. Fewer software packages mean fewer opportunities for exploitation, making the system more robust and easier to secure.

Caring about minimalism can also lead to easier system maintenance and management. With fewer components to manage and update, it becomes simpler to ensure system stability, apply patches, and keep the system up-to-date. The reduced complexity makes troubleshooting and resolving issues more straightforward, saving time and effort in the long run.

Adopting a minimalistic approach can also be valuable for your career. Employers often value professionals who understand the importance of resource optimization, system efficiency, and security. Demonstrating knowledge and skills in building lean and minimalistic systems can set you apart as someone who is meticulous, detail-oriented, and adept at streamlining processes and reducing unnecessary complexities.

To embrace the minimalistic approach in LFS, you will carefully select the necessary software packages and components required for your specific needs. This involves making informed decisions about which components to include, configuring them appropriately, and excluding anything that is not essential. It also entails researching and understanding the dependencies and interactions between different components to ensure a cohesive and functional system.

By adopting a minimalistic approach through LFS, you achieve a system that is optimized for efficiency, resource utilization, and security. You gain practical experience in system configuration, package selection, and dependency management. This achievement can positively impact your career by showcasing your ability to design and build lean, secure, and well-optimized systems. Moreover, the minimalistic approach demonstrates your attention to detail, ability to make informed decisions, and commitment to delivering high-quality solutions.

Stability

Building your own Linux system from scratch allows you to implement security measures and configure the system for optimal stability. You have full control over the software versions, patches, and security configurations, reducing the risk of vulnerabilities.

LFS can provide the benefit of stability in your Linux system. Stability refers to the reliability and consistency of the system’s performance, functionality, and behavior over time. A stable system minimizes unexpected crashes, errors, and inconsistencies, allowing for smooth and uninterrupted operation.

Caring about stability is important because it ensures the reliability and predictability of your system. A stable system enables you to have confidence in the performance and functionality of your Linux environment, minimizing downtime, data loss, and disruptions in critical operations. Stability is particularly crucial in professional settings where system failures can have significant consequences, such as financial losses, compromised data integrity, and negative impacts on user experience.

While vendors invest in maintaining the stability of their distributions, there are benefits to resorting to your own build of LFS. Building your own system through LFS gives you a deeper understanding and control over the components and configurations. It allows you to select and configure each component according to your specific needs, preferences, and use cases. This level of control empowers you to fine-tune the system for stability, ensuring that it is optimized for your specific requirements.

Moreover, by building your own system, you can avoid potential stability issues caused by unnecessary or conflicting software packages or configurations. Vendors strive to maintain stability in their distributions, but the vast array of available software and the complexity of system configurations can still introduce potential issues. With LFS, you have the ability to carefully select and configure components, minimizing the risk of instability caused by unwanted software interactions or conflicts.

Caring about stability through LFS can be beneficial for your career. Employers highly value professionals who can deliver stable and reliable systems, as it directly impacts business continuity and user satisfaction. By demonstrating expertise in building stable systems, you position yourself as a skilled professional capable of designing, managing, and troubleshooting stable environments. This expertise is highly relevant in roles such as system administration, software development, or technical support.

To achieve stability in LFS, you will follow the step-by-step instructions provided in the LFS book and make informed decisions regarding the selection and configuration of software components. This entails researching the stability track records of various software packages, understanding potential compatibility issues, and applying best practices for system stability. Additionally, it involves actively testing, monitoring, and optimizing the system to ensure reliable and consistent performance.

By achieving stability through LFS, you achieve a Linux system that is tailored to your specific requirements and optimized for stability. You gain practical experience in system configuration, package selection, and stability testing. This achievement can positively impact your career by showcasing your ability to build and manage stable systems. Moreover, the emphasis on stability demonstrates your attention to detail, commitment to quality, and dedication to providing reliable solutions.

Reasons not to use Linux From Scratch

Enough about reasons to use LFS. Every coin has two sides. Linux From Scratch comes with its own share of problems. Let’s have a look at some of those.

Time-consuming

Building a Linux distribution from scratch requires a significant investment of time and effort, especially for those new to Linux.

Using LFS can be time-consuming due to the comprehensive nature of the process and the level of involvement required. The time it takes to complete LFS can vary depending on factors such as the individual’s familiarity with Linux, technical proficiency, hardware specifications, and the complexity of the desired system configuration.

On an average machine, the process of building a Linux system with LFS can take several days or even weeks. This estimate includes time for reading and understanding the LFS book, following the instructions, resolving any encountered issues, and configuring the system to meet specific requirements. Additionally, the time required for software compilation and package installation can also contribute to the overall duration.

Whether the time investment is worth it depends on individual circumstances and objectives. LFS is primarily designed as a learning experience to gain a deep understanding of the Linux system and its components. If you are passionate about Linux, enjoy hands-on exploration, and are seeking a comprehensive understanding of the system, the time spent on LFS can be highly rewarding. It provides valuable insights into Linux internals, software compilation, system configuration, and troubleshooting, which can enhance your knowledge and skills in Linux development or system administration.

However, if your primary goal is to quickly set up a functional Linux system without delving into low-level details, or if time constraints are a significant consideration, then the time-consuming nature of LFS may not be ideal. In such cases, opting for a pre-packaged Linux distribution that aligns with your needs and provides a balance between customization and convenience may be a more practical choice.

It’s important to carefully assess your priorities, objectives, and available resources before embarking on the LFS journey. Consider whether the learning experience, deep understanding, and customization options provided by LFS align with your goals and justify the time investment. Additionally, evaluate alternative solutions and pre-packaged distributions to determine if they offer a better balance between time, convenience, and customization for your specific requirements.

Steep learning curve

LFS assumes a certain level of knowledge about Linux, and beginners may find it challenging to navigate through the process.

The steep learning curve is one of the limitations associated with using Linux From Scratch (LFS). It refers to the level of knowledge and expertise required to successfully complete the LFS project. LFS assumes a certain level of familiarity with Linux, system administration, and software development concepts.

The learning curve arises because LFS is intended to be a comprehensive learning experience rather than a straightforward, beginner-friendly process. It requires individuals to understand and apply concepts such as compiling software from source code, configuring system components, managing dependencies, and troubleshooting potential issues that may arise during the build process. This can be challenging for those who are new to Linux or lack prior experience in system administration.

The steep learning curve can be a significant limitation depending on individual circumstances and goals. For individuals who are new to Linux or have limited technical experience, the learning curve may pose a significant challenge and may require investing additional time and effort to grasp the necessary concepts. It can be overwhelming to navigate through the extensive documentation, comprehend complex instructions, and troubleshoot issues without prior knowledge or experience.

However, for individuals who are passionate about Linux, eager to deepen their understanding, and willing to invest the time and effort required, the steep learning curve can be a valuable aspect of LFS. It offers an opportunity to gain in-depth knowledge of Linux internals, software development practices, system configuration, and troubleshooting techniques. The learning experience derived from overcoming the learning curve can lead to enhanced skills, confidence, and expertise in Linux development and system administration.

Whether the steep learning curve is worth it depends on individual goals, interests, and available resources. If you are motivated by the prospect of a hands-on learning experience, enjoy diving into technical details, and are committed to building a solid foundation of Linux knowledge, then the effort to overcome the learning curve can be highly rewarding. It provides a deeper understanding of the Linux system, practical skills, and a sense of accomplishment.

However, if your primary objective is to quickly set up a functional Linux system without investing significant time in learning the intricacies of Linux internals, or if time constraints are a critical consideration, then the steep learning curve of LFS may be a significant limitation. In such cases, alternative solutions like pre-packaged Linux distributions that provide a balance between customization and convenience may be more suitable.

Limited support

Since LFS is a do-it-yourself project, you won’t have access to official support from a commercial Linux distribution, which might make troubleshooting more difficult.

Another limitation of using Linux From Scratch (LFS) is the limited support associated with the project. Limited support means that LFS does not have a dedicated support team or a large community of users compared to mainstream Linux distributions. While there is a supportive community of LFS enthusiasts, the resources and availability of immediate assistance may be more limited compared to widely-used distributions.

The limited support can be a significant consideration, particularly for those who prefer or require prompt assistance or comprehensive documentation for troubleshooting issues. With LFS, resolving problems or addressing specific configuration challenges may require more self-reliance, independent research, and problem-solving skills.

In contrast, mainstream Linux distributions have dedicated support teams, larger communities, and extensive documentation readily available. These distributions often offer comprehensive support channels, including forums, mailing lists, and official documentation, allowing users to seek assistance and find solutions to common problems more easily.

The limited support associated with LFS gives an edge to vendors of mainstream distributions. Vendors have dedicated teams working on maintaining the distribution, providing support, addressing security vulnerabilities, and ensuring compatibility across a wide range of hardware and software. They have the resources and expertise to quickly respond to issues, provide updates, and offer guidance to users.

However, whether the limited support of LFS is a significant limitation depends on individual circumstances and requirements. For those who enjoy the challenge of independent problem-solving, have a strong understanding of Linux, and are motivated by the learning experience that LFS offers, the limited support may not be a major concern. The self-sufficiency and independence gained through LFS can be a rewarding aspect, allowing individuals to develop their skills, explore solutions, and deepen their understanding of the Linux system.

Whether the limited support is worth it ultimately depends on individual needs and preferences. If immediate support and comprehensive documentation are critical, and there are time constraints or business requirements that necessitate prompt assistance, then relying on a mainstream Linux distribution with extensive support infrastructure may be more suitable.

Complexity

Manually configuring and compiling each component can be complex and error-prone, which may lead to frustration for novice users.

Complexity refers to the intricate and involved nature of the LFS process, which can be challenging for individuals who are new to Linux or lack extensive technical knowledge. LFS requires a deep understanding of Linux internals, system configuration, software compilation, and troubleshooting.

The complexity of LFS can be a barrier for newcomers or those seeking a quick and straightforward solution. It requires individuals to invest time and effort in comprehending the detailed instructions provided in the LFS book, researching concepts, and troubleshooting issues that may arise during the build process. The level of technical expertise required to successfully complete LFS can be daunting, especially for individuals who are not familiar with Linux or system administration practices.

In contrast, vendors of mainstream Linux distributions deal with complexity by providing pre-packaged distributions that abstract much of the underlying intricacies. Vendors simplify the user experience by offering user-friendly installers, automated configuration tools, and pre-configured software stacks. They streamline the process of setting up a functional Linux system, reducing the complexity for users who prefer a more straightforward and convenient approach.

The edge that vendors gain from dealing with complexity is the ability to cater to a broader user base. By simplifying the installation and configuration process, vendors make Linux more accessible to a wider range of users, including those with limited technical expertise. The ease of use, comprehensive documentation, and user-friendly interfaces offered by vendors can lower the barrier of entry for Linux adoption, attracting a larger user community.

Whether the complexity of LFS is worth it depends on individual circumstances and objectives. LFS is primarily designed as a learning experience to gain a deep understanding of the Linux system and its components. If you are passionate about Linux, enjoy hands-on exploration, and are seeking a comprehensive understanding of the system, the complexity of LFS can be an acceptable trade-off.

However, for individuals who prioritize simplicity, convenience, or have specific time constraints, the complexity of LFS may not be worth it. Mainstream Linux distributions offer pre-packaged solutions that provide a balance between customization and convenience, eliminating the need to navigate the intricacies of building a Linux system from scratch.

Availability of ready-made solutions

There are numerous Linux distributions available that cater to various needs and preferences, making it easier for users to choose an existing solution rather than building one from scratch.

One of the limitations of using Linux From Scratch (LFS) is the availability of ready-made solutions. This refers to the fact that LFS requires individuals to build a Linux system from scratch, which can be time-consuming and demanding. In contrast, there are pre-packaged Linux distributions readily available that offer a range of features, software packages, and configurations out of the box.

The availability of ready-made solutions is important because it provides convenience, time savings, and ease of use. Pre-packaged Linux distributions, such as Ubuntu, Fedora, or Debian, have undergone extensive development, testing, and refinement by dedicated teams. They offer a wealth of pre-configured software packages, desktop environments, and system settings, making it easier for users to get up and running quickly.

Ready-made solutions also provide a wide range of additional benefits. They often include comprehensive documentation, user-friendly installation processes, automatic hardware detection, and package management systems for easy software installation and updates. They have established support channels, vibrant communities, and extensive repositories of software packages and applications, enhancing the overall user experience.

While LFS offers the advantage of customization and a deep understanding of the Linux system, the availability of ready-made solutions is worth considering depending on individual needs and priorities. Using a pre-packaged Linux distribution can save time, provide a reliable and well-supported system, and offer a rich ecosystem of tools and resources. This is particularly valuable for those who prioritize convenience, require a stable and feature-rich environment, or have limited time or technical expertise.

Conclusion

In this blog post, we explored the benefits and limitations of using Linux From Scratch. LFS offers benefits such as knowledge, customization, security, learning experience, performance, control, stability, and minimalism, providing deep insights into Linux internals, tailored systems, enhanced security, learning opportunities, optimized performance, autonomy, reliability, and resource efficiency. However, LFS also has limitations including time consumption, steep learning curve, limited support, complexity, and absence of ready-made solutions. The decision to use LFS depends on individual goals, technical expertise, time availability, and the trade-off between customization and convenience, with pre-packaged distributions offering a more convenient alternative. Ultimately, the choice between LFS and pre-packaged distributions should consider individual circumstances, preferences, and the desired balance between customization, time investment, convenience, and support availability.

One common way to create python environments is to use tools like pip, virtualenv, pipenv or poetry. These tools allow you to specify your dependencies in a requirements.txt file or a similar format, and then install them in a virtual environment. However, these tools often suffer from some drawbacks, such as:

• They rely on the availability and consistency of online repositories, which may change or disappear over time.
• They do not guarantee that the same versions of packages and their dependencies will be installed on different machines or platforms.
• They do not handle non-python dependencies or system libraries very well.
• They may require additional tools or layers of virtualization to work properly.

Another way to create python environments is to use nix, a revolutionary build system that is known to achieve great reproducibility and portability. Nix allows you to declare your dependencies in a nix expression, and then build them in a sandboxed environment that is isolated from the rest of the system. Nix also caches the build results and allows you to share them with others. However, nix also has some drawbacks, such as:

• It has a steep learning curve and a different syntax than python.
• It requires you to write nix expressions for each python package you want to use, which can be tedious and error-prone.
• It may not support all the python packages or versions that you need.

This is where mach-nix comes in. Mach-nix is a project that aims to make it easy to create and share reproducible python environments or packages using nix. Mach-nix can install packages from three different sources: pypi, conda and nixpkgs. It also supports hardware optimizations, cross platform support, private packages and tweaking build parameters. You can use mach-nix with a simple requirements.txt file or a more advanced nix expression.

In this blog post, I will show you how to use mach-nix to create a python environment for a simple web application that uses Flask and requests.

Installing mach-nix

To use mach-nix, you need to have nix installed on your system. You can install nix by following the instructions on https://nixos.org/download.html.

Once you have nix installed, you can install mach-nix by running the following command:

nix-env -iA mach-nix -f https://github.com/DavHau/mach-nix/tarball/3.5.0

This will install mach-nix version 3.5.0 on your system. You can check the latest version of mach-nix on its GitHub page: https://github.com/DavHau/mach-nix.

Creating a requirements.txt file

The simplest way to use mach-nix is to create a requirements.txt file that lists the python packages you want to use. For example, for our web application, we need Flask and requests. We can create a requirements.txt file with the following content:

Flask
requests

Creating a python environment with mach-nix

To create a python environment with mach-nix, we can use the mach-nix.mkPython function. This function takes a list of requirements as an argument and returns a derivation that contains the python interpreter and the installed packages.

We can write a nix expression that uses mach-nix.mkPython as follows:

let
  # Import mach-nix
  mach-nix = import (builtins.fetchGit {
    url = "https://github.com/DavHau/mach-nix";
    ref = "refs/tags/3.5.0";
  }) {};
in
  # Create a python environment with our requirements
  mach-nix.mkPython {
    requirements = builtins.readFile ./requirements.txt;
  }

We can save this expression in a file called default.nix.

Building and entering the python environment

To build and enter the python environment, we can run the following command:

nix-shell default.nix

This will download and build the required packages and then drop us into a shell where we can access the python interpreter and the installed packages.

We can verify that we have Flask and requests available by running:

python -c "import flask; import requests; print(flask.__version__, requests.__version__)"

This should print something like:

2.0.2 2.26.0

Writing a simple web application

Now that we have our python environment ready, we can write a simple web application that uses Flask and requests. For example, we can create a file called app.py with the following content:

from flask import Flask, request, jsonify
import requests

app = Flask(__name__)

@app.route("/")
def index():
    return "Hello, world!"

@app.route("/weather")
def weather():
    city = request.args.get("city", "London")
    api_key = "your_api_key_here"
    url = f"https://api.openweathermap.org/data/2.5/weather?q={city}&appid={api_key}"
    response = requests.get(url)
    data = response.json()
    return jsonify(data)

This web application has two routes: / and /weather. The / route returns a simple greeting message. The /weather route takes a city name as a query parameter and returns the current weather data from the OpenWeather API. You need to replace your_api_key_here with your own API key, which you can get from https://openweathermap.org/api.

Running the web application

To run the web application, we can use the flask command from our python environment:

FLASK_APP=app.py flask run

This will start a development server on http://localhost:5000.

We can test our web application by opening http://localhost:5000 in a browser or using a tool like curl:

curl http://localhost:5000

This should return:

Hello, world!

We can also test the /weather route by passing a city name as a query parameter:

curl http://localhost:5000/weather?city=New%20York

This should return something like:

{"base":"stations","clouds":{"all":75},"cod":200,"coord":{"lat":40.7143,"lon":-74.006},"dt":1639764799,"id":5128581,"main":{"feels_like":276.05,"humidity":69,"pressure":1016,"temp":278.15,"temp_max":279.82,"temp_min":276.48},"name":"New York","sys":{"country":"US","id":2039034,"sunrise":1639734157,"sunset":1639767679,"type":2},"timezone":-18000,"visibility":10000,"weather":[{"description":"broken clouds","icon":"04n","id":803,"main":"Clouds"}],"wind":{"deg":280,"gust":11.32,"speed":7.72}}

Conclusion

In this blog post, we have seen how to use mach-nix to create reproducible python environments with nix. We have created a simple web application that uses Flask and requests and ran it from our python environment.

Mach-nix is a powerful and easy-to-use tool that can help you manage your python projects and dependencies in a reliable and portable way. You can learn more about mach-nix and its features on its GitHub page: https://github.com/DavHau/mach-nix.

The Fediverse (a portmanteau of "federation" and "universe") is an ensemble of federated (i.e. interconnected) servers that are used for web publishing (i.e. social networking, microblogging, blogging, or websites) and file hosting, which, while independently hosted, can communicate with each other. The Fediverse is a network of diverse and decentralized platforms that offer users more control over their data, privacy, and online interactions.

How Does the Fediverse Work?

The Fediverse works by using open communication protocols that allow different software packages to exchange information across servers. These protocols include ActivityPub, Diaspora, OStatus, Zot, and others. Each server (also called an instance) hosts a number of user accounts that can create and share content with other accounts on the same or different instances. Users can also follow accounts from other instances and interact with them through comments, likes, reblogs, etc.

The Fediverse is not controlled by any central authority or corporation. Each instance is run by its own administrator who sets the rules and policies for their community. Users can choose an instance that suits their preferences and needs, or even host their own instance if they have the technical skills and resources. This way, the Fediverse fosters diversity, freedom of expression, and self-governance.

What Can You Do on the Fediverse?

The Fediverse offers a variety of platforms for different purposes and audiences. Some of them are:

• Mastodon: A microblogging platform similar to Twitter, where users can post short messages (called toots) with media attachments and hashtags. Mastodon has a unique feature called the local timeline, which shows all the posts from the users on the same instance. Mastodon also supports content warnings, lists, polls, and emoji reactions.

• Pleroma: Another microblogging platform that is compatible with Mastodon, but with a smaller server footprint and more customization options. Pleroma also has a rich text editor, chat functionality, and support for multiple accounts.

• Pixelfed: A photo-sharing platform similar to Instagram, where users can post images and videos with filters, captions, and mentions. Pixelfed also has features like stories, collections, albums, and discover pages.

• PeerTube: A video-sharing platform similar to YouTube, where users can upload and watch videos without ads or tracking. PeerTube uses peer-to-peer technology to reduce bandwidth costs and censorship risks. PeerTube also has features like live streaming, playlists, subtitles, and comments.

• Friendica: A social networking platform similar to Facebook, where users can post status updates, photos, events, polls, and more. Friendica also has features like groups, pages, forums, calendars, and contacts.

• Hubzilla: A versatile platform that combines social networking, blogging, file storage, wiki editing, and more. Hubzilla also has features like channels, clones, webpages, nomadic identity, and access control lists.

These are just some examples of the many platforms available on the Fediverse. You can find more platforms on fediverse.party, a website that showcases different Fediverse projects.

How to Join the Fediverse?

To join the Fediverse, you need to choose a platform and an instance that you like. You can browse different instances on joinmastodon.org, the-federation.info, fediverse.network, or fediscan.xyz. You can also use trunk.madnificent.space to find people to follow based on your interests.

Once you have chosen an instance, you need to create an account with a username and a password. You will also get a unique identifier that looks like an email address (e.g. @user@instance.tld). This identifier is how you can be found and followed by other users on the Fediverse.

After creating your account, you can start posting content, following other accounts, and exploring the Fediverse.

Why Join the Fediverse?

The Fediverse is a great alternative to mainstream social media platforms that are often plagued by issues like censorship, surveillance, monetization, and centralization. The Fediverse gives you more choice, control, and creativity over your online presence and interactions. You can join communities that share your values and interests, or create your own. You can also enjoy a more diverse and respectful online environment, where you can learn from different perspectives and cultures.

The Fediverse is also a way to support free and open-source software, which is developed by volunteers and funded by donations. By joining the Fediverse, you are contributing to a more democratic and sustainable web.

So what are you waiting for? Join the Fediverse today and discover a whole new world of possibilities!

• Fediverse - Wikipedia.

• What Is the Fediverse and Can It Decentralize the Web? - MUO.

• Fediverse.Party - explore federated networks.

• What is the Fediverse? - Join the Fediverse.

Adding Multiple Push URLs

The easiest way to push your code to two remotes is to add multiple push URLs for a given remote. For example, if you have a remote called origin that points to your main repository, you can add another push URL for a different repository using this command:

git remote set-url --add --push origin git://existing/repo.git
git remote set-url --add --push origin git://another/repo.git

This will add a second push URL to your origin remote, so when you run git push origin, it will push your code to both repositories. You can verify the current push URLs for a remote by running git remote -v.

You can add as many push URLs as you want for a single remote, but keep in mind that this will affect all the branches that use that remote as their upstream. If you want more fine-grained control over which branches go to which remotes, you can use the next method.

Creating Separate Branches

Another way to push your code to two remotes is to create separate branches for each remote and set their upstreams accordingly. For example, if you have a branch called master that you want to push to your main repository, and another branch called deployment that you want to push to your deployment repository, you can do something like this:

# create the deployment branch from master
git checkout -b deployment master

# add the deployment remote
git remote add deployment git://another/repo.git

# set the upstream for the deployment branch
git push --set-upstream deployment deployment

This will create a new branch called deployment that tracks the deployment remote, and push it there. Now, whenever you want to update your deployment repository, you can simply run git push from the deployment branch.

You can also merge changes from your master branch into your deployment branch before pushing, or use rebase or cherry-pick if you prefer. The advantage of this method is that you can have different histories and configurations for each remote.

Conclusion

In this post, I showed you two ways to push your code to two remotes using git: adding multiple push URLs for a single remote, or creating separate branches for each remote. Both methods have their pros and cons, so choose the one that suits your workflow best.

I hope you found this post useful and learned something new.

References

• Git: Push to multiple remotes at once - Leigh McCulloch.
• github - Git - Pushing code to two remotes - Stack Overflow.
• How To Use git with Multiple Remote Repositories - How-To Geek.
• Git: Pushing to two repos in one command - Stack Overflow.

nix-shell

nix-shell is the original command for creating and entering Nix shells. It takes a Nix expression as an argument, which can be either a file name (such as shell.nix or default.nix), a derivation (such as nixpkgs#hello), or an arbitrary expression (such as -p python3). nix-shell then builds the expression and starts a Bash subshell with the environment variables and shell functions set up according to the expression.

For example, if you have a shell.nix file in your project directory that looks like this:

{ pkgs ? import <nixpkgs> {} }:

pkgs.mkShell {
  buildInputs = [
    pkgs.python3
    pkgs.python3Packages.numpy
    pkgs.python3Packages.pandas
  ];
}

You can run nix-shell in the same directory and get a shell with Python 3 and its packages available:

$ nix-shell
[nix-shell:~/my-project]$ python3
Python 3.10.11 (main, Apr  4 2023, 22:10:32) [GCC 12.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import numpy
>>> import pandas
>>>

You can also use nix-shell to run a single command in a Nix shell, without entering it interactively. For example, you can run nix-shell -p curl --run "curl https://nixos.org" to download the NixOS homepage using the curl package from Nixpkgs.

nix-shell has some options that modify its behavior, such as:

• --pure: Clear the entire environment (except those specified with --keep) before entering the shell. This ensures that the shell is isolated from any impurities from the parent environment, such as system packages or environment variables.
• --run: Run the specified command inside the shell, instead of starting an interactive shell.
• --command or -c: Similar to --run, but allows multiple commands to be executed sequentially.
• --keep or -k: Keep the specified environment variable when entering the shell.
• --arg: Pass an argument to the Nix expression that defines the shell.
• --argstr: Similar to --arg, but passes a string argument.

nix shell

nix shell is a newer command that is part of the new Nix user interface introduced in Nix 2.0. It is similar to nix-shell, but has some differences and advantages. nix shell takes one or more installables as arguments, which can be either flake outputs (such as .#hello or nixpkgs#firefox) or legacy packages (such as hello or firefox). nix shell then builds and installs these installables into a temporary profile, and starts a Bash subshell with these installables available in $PATH.

For example, you can run nix shell nixpkgs#python3 nixpkgs#python3Packages.numpy --command "python3 -c 'import numpy; print(numpy.__version__)'" to print the version of numpy using Python 3 from Nixpkgs.

nix shell has some advantages over nix-shell, such as:

• It supports flakes, which are a new way of defining and composing Nix projects with improved reproducibility and composability.
• It does not require a shell.nix or default.nix file to exist in the current directory. You can specify any installable from any source as an argument.
• It does not use Bash-specific features to set up the environment, which makes it more portable and compatible with other shells.
• It does not leak any build-time dependencies into the shell environment, which makes it more lightweight and minimal.

However, nix shell also has some limitations compared to nix-shell, such as:

• It does not support arbitrary Nix expressions as arguments. You can only use installables that are defined in flakes or in Nixpkgs.
• It does not support setting up environment variables or shell functions that are not related to the installables. For example, you cannot use nix shell to set up a PostgreSQL service or a Python virtual environment.
• It does not support running a specific phase of a derivation, such as configure or build. You can only run the final result of the derivation.

nix develop

nix develop is another new command that is part of the new Nix user interface. It is similar to nix shell, but instead of providing a minimal environment with only the installables in $PATH, it provides a full-fledged build environment that is nearly identical to what Nix would use to build the installables. Inside this shell, environment variables and shell functions are set up so that you can interactively and incrementally build your project.

For example, if you have a flake.nix file in your project directory that looks like this:

{
  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

  outputs = { self, nixpkgs }: {

    packages.x86_64-linux.hello = nixpkgs.legacyPackages.x86_64-linux.hello;

    devShell.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.mkShell {
      buildInputs = [
        nixpkgs.legacyPackages.x86_64-linux.hello
      ];
    };

  };
}

You can run nix develop in the same directory and get a shell with the build environment of the hello package.

You can also use nix develop to run a single command in a Nix shell, without entering it interactively. For example, you can run nix develop .#hello --command "hello" to run the hello program from the flake output.

nix develop has some advantages over nix-shell, such as:

• It supports flakes, which are a new way of defining and composing Nix projects with improved reproducibility and composability.
• It does not require a shell.nix or default.nix file to exist in the current directory. You can specify any flake output as an argument.
• It does not use Bash-specific features to set up the environment, which makes it more portable and compatible with other shells.
• It allows you to run specific phases of a derivation, such as configure or build, by using options like --configure or --build.

However, nix develop also has some limitations compared to nix-shell, such as:

• It does not support arbitrary Nix expressions as arguments. You can only use flake outputs that are derivations.
• It does not support installing multiple installables into the same shell. You can only use one flake output as an argument.
• It does not support setting up environment variables or shell functions that are not related to the derivation. For example, you cannot use nix develop to set up a PostgreSQL service or a Python virtual environment.

Conclusion

In this post, I have explained what are the different types of Nix shells, how they work, and how to use them effectively. nix-shell is the original command for creating and entering Nix shells based on arbitrary Nix expressions. nix shell is a newer command for creating and entering minimal shells based on installables.

References

• Nix shells - tips, tricks, and best practices - NixOS Discourse.
• nix develop - Nix Reference Manual - NixOS Linux.
• Development environment with nix-shell - NixOS Wiki.

One of the features that you might want to enable on your NixOS system is Bluetooth support. Bluetooth is a wireless technology that allows you to connect various devices such as keyboards, mice, headphones, speakers and more. In this blog post, I will show you how to enable Bluetooth support on NixOS and how to pair and connect your Bluetooth devices.

Enabling Bluetooth Support

To enable Bluetooth support on NixOS, you need to add the following line to your /etc/nixos/configuration.nix file:

hardware.bluetooth.enable = true;

This will enable the hardware.bluetooth module that provides the necessary drivers and services for Bluetooth. You can also customize some options such as the device name, the pin code and the power management settings. For more details, you can check the NixOS Wiki.

If you want to check the battery status of your Bluetooth devices, you need to enable the experimental feature of BlueZ by adding the following snippet to your configuration.nix file:

hardware.bluetooth = {
  enable = true;
  settings = {
    General = {
      Experimental = "true";
    };
  };
};

This will allow you to use the bluetooth-battery python script or the GNOME extension to see the battery level of your devices.

After adding the lines to your configuration.nix file, you need to run the following command as root to apply the changes:

nixos-rebuild switch

This will rebuild your system configuration and activate the new settings. You can also use nixos-rebuild test or nixos-rebuild boot if you want to test or boot into the new configuration without switching to it immediately.

Checking Bluetooth Device Battery Status

Pairing Bluetooth Devices

After enabling Bluetooth support on NixOS, you need to pair your Bluetooth devices with your NixOS machine. There are two ways to do this: using a graphical user interface (GUI) or using a command line tool.

Using a GUI

If you are using a desktop environment that provides a Bluetooth management GUI, such as GNOME, KDE or Cinnamon, you can use it to pair your devices. You can usually find the Bluetooth icon in the system tray or the settings menu. You can click on it and then select "Add Device" or "Set Up New Device" to start the pairing process. You will see a list of available devices and you can select the one you want to pair with. You might need to enter a pin code or confirm the pairing on both devices.

If your desktop environment does not provide a Bluetooth management GUI, you can additionally enable the blueman service in your configuration.nix file with the following line:

services.blueman.enable = true;

This will install and enable blueman, a GTK-based Bluetooth manager that provides blueman-applet and blueman-manager. You can run blueman-applet to show the Bluetooth icon in the system tray and blueman-manager to open a window where you can manage your devices. You can use them in a similar way as described above.

Using bluetoothctl

Alternatively, you can pair your devices from the command line using bluetoothctl, a tool that is part of the BlueZ package. BlueZ is the official Linux Bluetooth protocol stack and it provides various utilities and libraries for Bluetooth functionality.

To use bluetoothctl, you need to open a terminal and run it with:

bluetoothctl

This will start an interactive shell where you can enter various commands to control your Bluetooth devices. You will see something like this:

Agent registered
[bluetooth]#

The [bluetooth]# prompt indicates that you are in bluetoothctl mode. You can type help to see a list of available commands and their descriptions. Some of the most useful commands are:

• power on: Turns on the Bluetooth controller.
• agent on: Enables the default agent that handles pairing requests.
• default-agent: Sets the default agent as the default one.
• scan on: Starts scanning for nearby devices.
• pair [hex-address]: Pairs with the device with the given hexadecimal address.
• connect [hex-address]: Connects to the device with the given hexadecimal address.
• trust [hex-address]: Trusts the device with the given hexadecimal address so that it automatically connects when available.
• info [hex-address]: Shows information about the device with the given hexadecimal address.
• devices: Shows a list of paired devices.
• remove [hex-address]: Removes the device with the given hexadecimal address from the list of paired devices.
• quit: Exits bluetoothctl mode.

To pair a device with bluetoothctl, you need to follow these steps:

1. Turn on the Bluetooth controller with power on.
2. Enable the default agent with agent on and default-agent.
3. Start scanning for nearby devices with scan on.
4. Put your device in pairing mode and wait for its hexadecimal address to appear in the output of bluetoothctl.
5. Pair with the device with pair [hex-address] where you replace [hex-address] with the actual address of your device.
6. Connect to the device with connect [hex-address].
7. Trust the device with trust [hex-address] if you want it to automatically connect when available.

You can also use tab completion to enter the hexadecimal address of your device more easily. For example, if your device's address is 11:22:33:44:55:66, you can type pair 11 and then press tab to complete the rest of the address.

Using Bluetooth Devices

After pairing and connecting your Bluetooth devices, you can use them as normal. For example, if you paired a Bluetooth keyboard or mouse, you can use them to input commands or move the cursor. If you paired a Bluetooth headset or speaker, you can use them to listen to audio or make calls.

If you are using a Bluetooth headset with PulseAudio, you will need to enable both hardware.pulseaudio.enable and hardware.bluetooth.enable in your configuration.nix file as follows:

hardware.pulseaudio.enable = true;
hardware.bluetooth.enable = true;

This will allow Bluetooth audio devices to be used with PulseAudio, the sound server that handles audio playback and recording on NixOS. You will also need to restart PulseAudio with:

systemctl --user daemon-reload; systemctl --user restart pulseaudio

You can verify that PulseAudio has loaded the Bluetooth module by running:

pactl list | grep -i 'Name.*module.*blue'

Bluetooth modules should be present in the list. You can also use tools like pavucontrol or pactl to manage your audio devices and streams.

If your Bluetooth headset has buttons for pause/play or to skip to the next track, you can use them to control media players that support the dbus-based MPRIS standard, such as VLC, Spotify or Rhythmbox. To make this work, you need to use mpris-proxy that is part of the BlueZ package. You can enable it as a systemd user service in your configuration.nix file with the following snippet:

systemd.user.services.mpris-proxy = {
  Unit.Description = "Mpris proxy";
  Unit.After = [ "network.target" "sound.target" ];
  Service.ExecStart = "${pkgs.bluez}/bin/mpris-proxy";
  Install.WantedBy = [ "default.target" ];
};

This will start mpris-proxy as a daemon that translates Bluetooth headset button events into MPRIS commands for media players.

Conclusion

In this blog post, I showed you how to enable Bluetooth support on NixOS and how to pair and connect your Bluetooth devices. I also showed you how to use Bluetooth headsets with PulseAudio and how to control media players with Bluetooth headset buttons. I hope you found this post useful and informative.

Nix flakes explained

A flake is a source tree (such as a Git repository) that contains a file named flake.nix in its root directory. This file provides a standardized interface to Nix artifacts such as packages, NixOS modules, or Nix functions. A flake can have dependencies on other flakes, which are specified using a URL-like syntax. For example, github:NixOS/nixpkgs refers to the nixpkgs flake hosted on GitHub.

A flake also has a lock file named flake.lock that pins the exact revisions of its dependencies to ensure reproducible evaluation. The lock file can be updated programmatically using the nix flake update command.

Flakes are evaluated in a hermetic way, meaning that they don't depend on any external factors such as environment variables, command-line arguments, or the system type. This makes them more reliable and portable across different platforms and environments.

Using nix flakes

To use nix flakes, you need to install an experimental version of Nix that supports them. You can get it from nixpkgs by running:

nix-shell -I nixpkgs=channel:nixos-23.05 --packages nixUnstable

You also need to enable the experimental features in your ~/.config/nix/nix.conf file by adding:

experimental-features = nix-command flakes

Once you have nix flakes enabled, you can create a new flake by running:

nix flake init

This will generate a flake.nix file with some basic attributes:

{
  description = "A very basic flake";

  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

  outputs = { self, nixpkgs }: {

    # A Nix package
    packages.x86_64-linux.hello = nixpkgs.legacyPackages.x86_64-linux.hello;

    # A NixOS module
    nixosModules.hello =
      { pkgs, ... }: {
        environment.systemPackages = [ pkgs.hello ];
      };
  };
}

The description attribute is a string that describes the flake. The inputs attribute is an attribute set of all the dependencies of the flake. In this case, we only have one dependency: the nixpkgs flake. The outputs attribute is a function that takes an attribute set of all the realized inputs and returns another attribute set with the artifacts produced by the flake.

In this example, we have two outputs: a Nix package named hello and a NixOS module named hello. The package is defined using the nixpkgs.legacyPackages attribute, which provides access to the packages defined in nixpkgs. The module is defined as a function that takes pkgs and other arguments and returns a NixOS configuration.

To build the package, we can run:

nix build .#hello

This will build the hello package defined in the current flake (denoted by .) and store it in the Nix store. We can also run it directly by using:

nix run .#hello

This will build and run the hello package without installing it.

To use the module, we can create a configuration.nix file that imports it:

{ config, pkgs, ... }:

{
  imports = [ ./flake.nix ];

  # Other configuration options...
}

Then we can build and activate our system configuration by running:

nixos-rebuild switch --flake .

This will use the current flake as the source of our system configuration and apply it to our machine.

How to compose nix flakes?

One of the main advantages of nix flakes is that they allow us to compose different Nix projects in a modular and declarative way. For example, suppose we want to use a flake that provides some useful Nix functions, such as flake-utils:

{
  description = "A flake with some useful Nix functions";

  inputs.flake-utils.url = "github:numtide/flake-utils";

  outputs = { self, nixpkgs, flake-utils }: {

    # A Nix package
    packages.x86_64-linux.hello = nixpkgs.legacyPackages.x86_64-linux.hello;

    # A NixOS module
    nixosModules.hello =
      { pkgs, ... }: {
        environment.systemPackages = [ pkgs.hello ];
      };

    # A function that creates a flake from a simple Nixpkgs overlay
    overlayFlake = flake-utils.lib.simpleFlake;
  };
}

Here we have added a new input for the flake-utils flake and a new output for the overlayFlake function. This function takes a simple Nixpkgs overlay and returns a flake that provides packages and apps based on it.

We can use this function to create another flake that uses an overlay to customize some packages:

{
  description = "A flake that uses an overlay to customize some packages";

  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
  inputs.flake-with-functions.url = "/path/to/flake-with-functions";

  outputs = inputs@{ self, nixpkgs, flake-with-functions, ... }:
    flake-with-functions.overlayFlake {
      # An overlay that adds a suffix to the hello package
      overlay = final: prev: {
        hello = prev.hello.overrideAttrs (old: {
          name = "${old.name}-customized";
        });
      };

      # Other arguments passed to simpleFlake
      inherit inputs;
      name = "customized-hello-flake";
    };
}

Here we have created a new flake that depends on the nixpkgs flake and the flake-with-functions flake. We use the overlayFlake function from the latter to create a flake that provides a customized version of the hello package. We pass an overlay that adds a suffix to the package name, as well as other arguments required by the simpleFlake function.

We can build and run the customized hello package by using:

nix run .#hello

This will show:

Hello, world!-customized

We can also use the niv tool to manage our flake dependencies in a more convenient way. For example, we can run:

niv init -f

This will create a sources.nix file that contains the URLs and revisions of our flake inputs. We can then use this file in our flake.nix file by importing it:

{
  description = "A flake that uses an overlay to customize some packages";

  inputs = import ./sources.nix;

  outputs = inputs@{ self, nixpkgs, flake-with-functions, ... }:
    flake-with-functions.overlayFlake {
      # An overlay that adds a suffix to the hello package
      overlay = final: prev: {
        hello = prev.hello.overrideAttrs (old: {
          name = "${old.name}-customized";
        });
      };

      # Other arguments passed to simpleFlake
      inherit inputs;
      name = "customized-hello-flake";
    };
}

We can also use niv to update our dependencies by running:

niv update

This will fetch the latest revisions of our inputs and update the sources.nix file accordingly.

Conclusion

Nix flakes are a new experimental feature that improve the reproducibility, composability, and usability of Nix projects. They provide a standardized interface to Nix artifacts, a way to specify and pin dependencies, and a hermetic evaluation model. They also enable new ways to deliver software to users, such as using nix profile or nix bundle. Flakes are still under development and may change in the future, but they are already usable and provide many benefits over the traditional Nix approach.

If you want to learn more about nix flakes, you can check out the following resources:

• The NixOS RFC for flakes
• The Nix manual for flakes
• The NixOS wiki for flakes

References

• Flakes - NixOS Wiki. https://nixos.wiki/wiki/Flakes.
• Nix Flakes, Part 1: An introduction and tutorial - Tweag. https://www.tweag.io/blog/2020-05-25-flakes/.
• Practical Nix Flakes - Serokell Software Development Company. https://serokell.io/blog/practical-nix-flakes.
• A Tour of Nix Flakes | Mattia Gheda. https://ghedam.at/a-tour-of-nix-flakes.

What is nix-shell?

Nix-shell is a command that comes with Nix, a package manager and system configuration tool that takes a unique approach to managing software. Nix allows you to declare your dependencies in a file called default.nix or shell.nix, and then builds them in a sandboxed environment, ensuring that they are isolated from each other and from the rest of your system.

Nix-shell will build the dependencies of the specified derivation (a term used in Nix to refer to a package or a build process), but not the derivation itself. It will then start an interactive shell in which all environment variables defined by the derivation have been set to their corresponding values, and the script $stdenv/setup has been sourced. This means that you get an environment that closely resembles the one that Nix would use to build your project, but without actually building it.

This is useful for reproducing the environment of a derivation for development. For example, if you have a Node.js project that depends on some npm packages, you can use nix-shell to install those packages and run your project without affecting your global npm installation or other projects.

How to use nix-shell?

To use nix-shell, you need to have Nix installed on your system. You can follow the instructions on NixOS website to install Nix on Linux, MacOS, or Windows.

Once you have Nix installed, you need to create a file called default.nix or shell.nix in your project directory. This file will contain the declaration of your dependencies and any other configuration options for your development environment. For example, here is a simple shell.nix file for a Node.js project:

{ pkgs ? import <nixpkgs> {} }:

pkgs.mkShell {
name = "node-project";
buildInputs = [ pkgs.nodejs ];
shellHook = ''
echo "Welcome to node-project"
export NODE_ENV=development
'';
}

This file uses some Nix syntax and functions that may look unfamiliar at first, but don't worry, I will explain them briefly.

• The first line is a function argument that allows us to import the nixpkgs package set, which contains thousands of pre-built packages for various languages and tools. We can access these packages through the pkgs variable.
• The second line uses the mkShell function from nixpkgs, which is a helper function that creates a derivation suitable for nix-shell. It takes some arguments, such as:
• name: The name of the derivation.
• buildInputs: A list of packages that will be available in the nix-shell environment. In this case, we only need nodejs, which is provided by nixpkgs.
• shellHook: A bash script that will be run after $stdenv/setup has been sourced. This allows us to perform some initialisation specific to nix-shell, such as printing a welcome message or setting some environment variables.

After creating this file, we can run nix-shell in our project directory, and we will be dropped into a shell where we have access to nodejs and our custom environment variables. We can then run our project as usual, for example:

$ nix-shell
Welcome to node-project

[nix-shell:~/node-project]$ node -v
v18.16.0

[nix-shell:~/node-project]$ node index.js 
Hello from nix-shell

[nix-shell:~/node-project]$ exit
exit

As you can see, nix-shell allows us to easily create and enter a development environment for our project without affecting our system or other projects. We can also share our shell.nix file with other developers and ensure that they have the same environment as us.

Conclusion

nix-shell is a powerful tool that allows you to create reproducible and isolated development environments for any project. In this blog post, I showed you how to use nix-shell to set up a development environment for a Node.js project. You can learn more about nix-shell and Nix in general by reading the Nix manual, the Nix pills, or the NixOS website. I hope you enjoyed this blog post and found it useful. Happy hacking!

After digging around on the Internet, I found the problem lies in the large size of the initramfs. My version was several hundred megabytes. For whatever reason, the large size renders it unable to serve its purpose. The kernel modules are not stripped. Stripping the image solves the issue.

cd /path/to/new-kernel
find . -name *.ko -exec strip --strip-unneeded {} +

Reference: How to reduce the size of the initrd when compiling your kernel?

Gitea is a self-hosted service to host and accept contributions to your git repositories on the web.

Prerequisites

• git

• curl/wget to obtain the binary

• MySQL/PostgreSQL/MSSQL/SQLite3/TiDB

Getting Gitea

Go to Gitea's official website for installation instructions.

It usually boils down to

1. Obtaining and verifying the binary

2. Creating a user

3. Creating directory structure

4. Creating a service file

5. Setting up a databse

6. Configuring Gitea

Create user

Create a user to run Gitea. Here we name it 'gitea' for the sake of our convenience.

adduer \
--system \
--shell /bin/bash \
--gecos 'Gitea' \
--group \
--disabled-password \
--home /home/gitea \
gitea

Create directory structure

mkdir -p /var/lib/gitea/{custom,data.log}
chown -R gitea:gitea /var/lib/gitea
chmod -R 750 /var/lib/gitea
mkdir /etc/gitea
chown root:gitea /etc/gitea
chmod 770 /etc/gitea

Copy Gitea binary to global location

cp gitea /usr/local/bin/gitea

Create a service file

Copy the sample gitea.service to /etc/systemd/system/gitea.service, then edit the file with a text editor.

Replace the lines starting with --- to +++.

--- #Wants=postgresql.service
--- #After=postgresql.service
+++ Wants=postgresql.service
+++ After=postgresql.service

--- User=git
--- Group=git
+++ User=gitea
+++ Group=gitea

Set up a database

As user postgres, run the following

createuser gitea
createdb gitea
psql
alter user gites with encrypted password 'super-secure-password';
grant all privileges on database gitea to gitea;
\q

Set up a web server

Put the following configuration in /etc/caddy/Caddyfile

gitea.adityakumar.com {
  reverse_proxy localhost:3000

}

Now reload caddy

systemctl reload caddy

Configure Gitea

Enable and start Gitea

systemctl enable --now gitea.service

Head to the website, or go to localhost:3000 if you have physical access to the server. Alternatively you can use port forwarding to configure Gitea using your local machine.

On the page,

• enter database username, password and database name.

• change Site Title to whatever you prefer.

• enter gitea in Run As Username field.

• change Gitea Base URL to the site's URL

Rest of the options should be left as is unless you have other requirements.

Click on Install Gitea. It should write the configuration to /etc/gitea/app.ini and be ready for use.

Now change permissions on /etc/gitea to make it read-only.

chmod 750 /etc/gitea
chmod 640 /etc/gitea/app.ini

gg=G

That's it. gg Goes to the top of the file. = tells vim to fix the indentation. G goes to the end of the file.

Trying to connect to postgresql database with a standard user fails with psql: FATAL: Peer authentication failed fr user "user1".

The second line of pg_hba.conf makes your connection attempt fail:

local   all     all     peer

The order of rules matter. If the first one that matches the access method, username, database name and source IP range fails, there will be no second attempt. So either remove this line, your place your rule above this one.

This post assumes you are on a non-NixOS Linux system.

Getting nix

Nix can be installed via a simple shell script provided on their website. Just use your judgement and follow the prompts.

Installing home-manager

The configuration is stored in ~/.config/nixpkgs/home.nix. Run home-manager switch to have changes take effect.

Export NIX_PATH to your shell

export NIX_PATH=$HOME/.nix-defexpr/channels:/nix/var/nix/profiles/per-user/root/channels${NIX_PATH:+:$NIX_PATH}

See issue#2033 and Nix discourse.

Now add unstable nix channel

 nix-channel --add https://github.com/nix-community/home-manager/archive/master.tar.gz home-manager

Or latest stable (as of writing this post) 22.05, if you prefer it

 nix-channel --add https://github.com/nix-community/home-manager/archive/release-22.05.tar.gz home-manager

And update

nix-channel --update

Install Home Manager

nix-shell '<home-manager>' -A install

Home Manager requires your shell to source ~/.nix-profile/etc/profile.d/hm-session-vars.sh. It can be easily done by setting programs.bash.enable = true; (of course, here bash is just an example). This way, Home Manager will manage your shell configuration. However, you will need to migrate your bashrc configurations over to Home Manager, which might take some time. An easier way out would be to move your existing bashrc and have Home Manager use that.

{ pkgs, ...}: {
  programs.bash = {
    enable = true;
    bashrcExtra = ''
      . ~/oldbashrc
    '';
  };
}

Since we are on a non-NixOS Linux system, Home Manager can automatically set some environment variables that will ease the usage of software installed with nix.

{pkgs, ...}: {
  targets.genericLinux.enable = true;
}

Now Home Manager is ready to use. There are many ways to install and configure packages using nix. Putting them here will make this post quite exhaustive. Check the links in the references as they go deeper and have up-to-date docs and examples.

References

NixOS Wiki - Home Manager

Home Manager Manual

I wrote a stupid gcd program that returns, well, GCD of two numbers. Funny enough, the program runs fine when compiled with gcc but crashes with illegal hardware instruction when compiled with clang.

My tools

Here is the program:

#include <iostream>

size_t gcd(size_t dividend, size_t divisor) {
  if (divisor > dividend) std::swap(divisor, dividend);
  auto remainder = dividend % divisor;
  if (remainder == 0) return divisor;
  else gcd(divisor,remainder);
}

int main(int argc, char** argv) {
  auto dividend {std::stoul(argv[1])};
  auto divisor {std::stoul(argv[2])};
  std::cout << gcd(dividend, divisor) << std::endl;
  return 0;
}

Some more relevant info:

gcc --version                                                  
gcc (GCC) 12.2.0
[...]

clang --version                                                        
clang version 14.0.6
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/bin

yay -Qi glibc          
Name            : glibc
Version         : 2.36-3

Getting started

Compile it with gcc:

g++ -W -Wall -Wextra -pedantic -std=c++20 -g -o gcd gcd-gcc.cpp 
gcd-gcc.cpp: In function ‘int main(int, char**)’:
gcd-gcc.cpp:10:14: warning: unused parameter ‘argc’ [-Wunused-parameter]
   10 | int main(int argc, char** argv) {
      |          ~~~~^~~~
gcd-gcc.cpp: In function ‘size_t gcd(size_t, size_t)’:
gcd-gcc.cpp:8:1: warning: control reaches end of non-void function [-Wreturn-type]
    8 | }
      | ^

Compile it with clang:

clang++ -Weverything -Wno-c++98-compat -std=c++20 -g -o gcd gcd-new.cpp 
gcd-new.cpp:3:8: warning: no previous prototype for function 'gcd' [-Wmissing-prototypes]
size_t gcd(size_t dividend, size_t divisor) {
       ^
gcd-new.cpp:3:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
size_t gcd(size_t dividend, size_t divisor) {
^
static 
gcd-new.cpp:8:1: warning: non-void function does not return a value in all control paths [-Wreturn-type]
}
^
gcd-new.cpp:10:14: warning: unused parameter 'argc' [-Wunused-parameter]
int main(int argc, char** argv) {
             ^
3 warnings generated.

So far everything seems good. Now running gcc's version gives

./gcd 70 60
10

...which is expected.

And clang's version:

./gcd 70 60
[1]    12974 illegal hardware instruction  ./gcd 70 60

There it is! Let's dig in.

lldb ./gcd
(lldb) target create "./gcd"
Current executable set to '/tmp/gcd' (x86_64).
(lldb) r 70 60
Process 13207 launched: '/tmp/gcd' (x86_64)
Process 13207 stopped
* thread #1, name = 'gcd', stop reason = signal SIGILL: illegal instruction operand
    frame #0: 0x0000555555556368 gcd`gcd(dividend=70, divisor=60) at gcd-new.cpp:6:20
   3    size_t gcd(size_t dividend, size_t divisor) {
   4      if (divisor > dividend) std::swap(divisor, dividend);
   5      auto remainder = dividend % divisor;
-> 6      if (remainder == 0) return divisor;
   7      else gcd(divisor,remainder);
   8    }
   9   
(lldb)

Stop reason says signal SIGILL: illegal instruction operand.

Illegal instruction operand? dividend is of type size_t, divisor is of type size_t. The modulus operator, in this case, will always return an integer greater than 0. Considering the above cases, the compiler should assign type size_t to remainder. Let's verify this.

(lldb) frame variable remainder
(unsigned long) remainder = 10
(lldb)

Turns out remainder is of type unsigned long, which should be fine in this case since comparison between unsigned long and a literal 0 is perfectly legal. If my memory serves right a literal 0 will be treated as a decimal of type int. Comparing it with type unsigned long would promote it to unsigned long and result in potential data loss of the signed bit. I think I am able to see the problem. The compiler would definitely deny such implicit type conversions.

Okay let's try changing it's data type to long.

diff gcd-gcc.cpp gcd-new.cpp 
5c5
<   auto remainder = dividend % divisor;
---
>   long remainder = dividend % divisor;

Now we get a message from the compiler:

gcd-new.cpp:5:29: warning: implicit conversion changes signedness: 'unsigned long' to 'long' [-Wsign-conversion]
  long remainder = dividend % divisor;
       ~~~~~~~~~   ~~~~~~~~~^~~~~~~~~

Now we can be sure dividend and divisor will be of type long in this line of code.

Let's try running.

./gcd 70 60
[1]    13887 illegal hardware instruction  ./gcd 70 60

It crashes again.

lldb ./gcd
(lldb) target create "./gcd"
Current executable set to '/tmp/gcd' (x86_64).
(lldb) r 70 60
Process 13927 launched: '/tmp/gcd' (x86_64)
Process 13927 stopped
* thread #1, name = 'gcd', stop reason = signal SIGILL: illegal instruction operand
    frame #0: 0x0000555555556368 gcd`gcd(dividend=70, divisor=60) at gcd-new.cpp:6:20
   3    size_t gcd(size_t dividend, size_t divisor) {
   4      if (divisor > dividend) std::swap(divisor, dividend);
   5      long remainder = dividend % divisor;
-> 6      if (remainder == 0) return divisor;
   7      else gcd(divisor,remainder);
   8    }
   9   
(lldb)

And the reason remains the same. Let's revert the changes and debug again.

Checking all variables reveal

(lldb) frame variable
(size_t) dividend = 70
(size_t) divisor = 60
(unsigned long) remainder = 10
(lldb)

Everything is normal here. So what causes the comparison of remainder with 0 raise SIGILL?

Going deeper

Let's examine the assembly file.

  118 .Ltmp6:
  119     .loc    0 6 17 is_stmt 1                # gcd-new.cpp:6:17
  120     cmpq    $0, -32(%rbp)
  121 .Ltmp7:
  122     .loc    0 6 7 is_stmt 0                 # gcd-new.cpp:6:7
  123     jne .LBB1_5
  124 # %bb.3:
  125 .Ltmp8:
  126     .loc    0 6 30                          # gcd-new.cpp:6:30
  127     movq    -24(%rbp), %rax
  128     movq    %rax, -40(%rbp)                 # 8-byte Spill
  129     movq    %fs:40, %rax
  130     movq    -8(%rbp), %rcx
  131     cmpq    %rcx, %rax
  132     jne .LBB1_7
  133 # %bb.4:
  134     .loc    0 0 30                          # gcd-new.cpp:0:30
  135     movq    -40(%rbp), %rax                 # 8-byte Reload
  136     .loc    0 6 23                          # gcd-new.cpp:6:23
  137     addq    $48, %rsp
  138     popq    %rbp
  139     .cfi_def_cfa %rsp, 8
  140     retq

This is the entire code for line 6 in the C++ source file.

Here in line 120 is the code for the equality check. Line 123 tells the compiler to jump to else part if the comparison is not equal (section LBB1_5 contains code for else part). And a lot of stuff happening there like code to prevent buffer overflow (lines 129 - 132).

In short, I know what is happening but not enough to tell what is breaking. Maybe I'll just have lldb dump the assembly code of the function. It will probably be the same as what we already saw.

(lldb) disas -n gcd
gcd`gcd:
    0x5555555562e0 <+0>:   pushq  %rbp
    0x5555555562e1 <+1>:   movq   %rsp, %rbp
    0x5555555562e4 <+4>:   subq   $0x30, %rsp
    0x5555555562e8 <+8>:   movq   %fs:0x28, %rax
    0x5555555562f1 <+17>:  movq   %rax, -0x8(%rbp)
    0x5555555562f5 <+21>:  movq   %rdi, -0x10(%rbp)
    0x5555555562f9 <+25>:  movq   %rsi, -0x18(%rbp)
    0x5555555562fd <+29>:  movq   -0x18(%rbp), %rax
    0x555555556301 <+33>:  cmpq   -0x10(%rbp), %rax
    0x555555556305 <+37>:  jbe    0x555555556318            ; <+56> at gcd-new.cpp:5:20
    0x55555555630b <+43>:  leaq   -0x18(%rbp), %rdi
    0x55555555630f <+47>:  leaq   -0x10(%rbp), %rsi
    0x555555556313 <+51>:  callq  0x555555556550            ; std::swap<unsigned long> at move.h:199
    0x555555556318 <+56>:  movq   -0x10(%rbp), %rax
    0x55555555631c <+60>:  xorl   %ecx, %ecx
    0x55555555631e <+62>:  movl   %ecx, %edx
    0x555555556320 <+64>:  divq   -0x18(%rbp)
    0x555555556324 <+68>:  movq   %rdx, -0x20(%rbp)
    0x555555556328 <+72>:  cmpq   $0x0, -0x20(%rbp)
    0x55555555632d <+77>:  jne    0x55555555635b            ; <+123> at gcd-new.cpp:7:12
    0x555555556333 <+83>:  movq   -0x18(%rbp), %rax
    0x555555556337 <+87>:  movq   %rax, -0x28(%rbp)
    0x55555555633b <+91>:  movq   %fs:0x28, %rax
    0x555555556344 <+100>: movq   -0x8(%rbp), %rcx
    0x555555556348 <+104>: cmpq   %rcx, %rax
    0x55555555634b <+107>: jne    0x55555555636a            ; <+138> at gcd-new.cpp
    0x555555556351 <+113>: movq   -0x28(%rbp), %rax
    0x555555556355 <+117>: addq   $0x30, %rsp
    0x555555556359 <+121>: popq   %rbp
    0x55555555635a <+122>: retq   
    0x55555555635b <+123>: movq   -0x18(%rbp), %rdi
    0x55555555635f <+127>: movq   -0x20(%rbp), %rsi
    0x555555556363 <+131>: callq  0x5555555562e0            ; <+0> at gcd-new.cpp:3
->  0x555555556368 <+136>: ud2    
    0x55555555636a <+138>: callq  0x555555556140            ; symbol stub for: __stack_chk_fail
(lldb)

...and there we go. It seems more or less the same except the second last line. The arrow tells that is where things fell apart. Seems like things got a little bit wilder.

Apparently, line 6 in the C++ source is undefined behaviour and LLVM decided to put ub2 to crash the program instead of doing anything it could have (because it is undefined behaviour).

Now this brings me to my next question: why does it work on gcc's version? Let's check out.

(lldb) disas -n gcd
gcd`gcd:
0x555555556289 <+0>:   pushq  %rbp
0x55555555628a <+1>:   movq   %rsp, %rbp
0x55555555628d <+4>:   subq   $0x20, %rsp
0x555555556291 <+8>:   movq   %rdi, -0x18(%rbp)
0x555555556295 <+12>:  movq   %rsi, -0x20(%rbp)
0x555555556299 <+16>:  movq   -0x20(%rbp), %rax
0x55555555629d <+20>:  movq   -0x18(%rbp), %rdx
0x5555555562a1 <+24>:  cmpq   %rax, %rdx
0x5555555562a4 <+27>:  jae    0x22b9                    ; <+48> at gcd-gcc.cpp:5:29
0x5555555562a6 <+29>:  leaq   -0x18(%rbp), %rdx
0x5555555562aa <+33>:  leaq   -0x20(%rbp), %rax
0x5555555562ae <+37>:  movq   %rdx, %rsi
0x5555555562b1 <+40>:  movq   %rax, %rdi
0x5555555562b4 <+43>:  callq  0x2911                    ; _ZSt4swapImENSt9enable_ifIXsrSt6__and_IJSt6__not_ISt15__is_tuple_likeIT_EESt21is_move_constructibleIS4_ESt18is_move_assignableIS4_EEE5valueEvE4typeERS4_SE_ at move.h:196:5
0x5555555562b9 <+48>:  movq   -0x18(%rbp), %rax
0x5555555562bd <+52>:  movq   -0x20(%rbp), %rcx
0x5555555562c1 <+56>:  movl   $0x0, %edx
0x5555555562c6 <+61>:  divq   %rcx
0x5555555562c9 <+64>:  movq   %rdx, -0x8(%rbp)
0x5555555562cd <+68>:  cmpq   $0x0, -0x8(%rbp)
0x5555555562d2 <+73>:  jne    0x22da                    ; <+81> at gcd-gcc.cpp:7:11
0x5555555562d4 <+75>:  movq   -0x20(%rbp), %rax
0x5555555562d8 <+79>:  jmp    0x22ed                    ; <+100> at gcd-gcc.cpp:8:1
0x5555555562da <+81>:  movq   -0x20(%rbp), %rax
0x5555555562de <+85>:  movq   -0x8(%rbp), %rdx
0x5555555562e2 <+89>:  movq   %rdx, %rsi
0x5555555562e5 <+92>:  movq   %rax, %rdi
0x5555555562e8 <+95>:  callq  0x2289                    ; <+0> at gcd-gcc.cpp:3:45
0x5555555562ed <+100>: leave  
0x5555555562ee <+101>: retq   
(lldb)

The instructions look a little bit smaller and it looks like there is no stack canary? I am not sure. A few more things are different. Apart from that everything else seems similar.

Lessons learnt

In the end I couldn't figure out what broke. I'll probably ask someone smarter.

Wrapping up

While I definitely was unable to tell what broke, I enjoyed every bit of it. I learned a lot about compiler's behaviour and what looks like seemingly harmless code may just be very unsafe waiting for a disaster to unfold.