• 0 Posts
  • 165 Comments
Joined 1 year ago
cake
Cake day: May 22nd, 2023

help-circle
  • Then those containers or virtual machines should add this or create the home as needed.

    systemd has its own containers, so this is the implementation of that requirement; “virtual machines” might use this exact binary to create home, among other directories like srv and what not. Someone at one point probably said “we always need to create these when spinning up systems, maybe systems can provide a mechanism to do that for us?” and then it was implemented.

    Having/home listed as a tmp file on regular systems is problematic by the nature of what tmpfiles claims it does.

    systemd-tmpfiles claims the following:

    systemd-tmpfiles creates, deletes, and cleans up files and directories, using the configuration file format and location specified in tmpfiles.d(5). Historically, it was designed to manage volatile and temporary files, as the name suggests, but it provides generic file management functionality and can be used to manage any kind of files.

    I rather think having a purge command was the issue here, at the very least it should print a big fat warning at what it does, better even list all affected files and directories. There’s no reason a normal user needs this and with the name of the binary, it’s totally misleading, which is an issue in these situations.


  • E.g. for quick provisioning of containers or virtual machines, this is also to make sure the required directories always exist. In a normal distribution, /home already exists, so systemd-tmpfiles does nothing, but there are cases where you want to setup a standard directory structure and this is a declarative alternative to scripts with a lot of mkdir, chmod and chown.

    The name systemd-tmpfiles is kind of historic at this point, but wasn’t changed due to backwards compatibility and all.






  • OpenPGP is kind of like the opposite of that - it does a lot of things, and none of them particularly well. To quote:

    PGP does a mediocre job of signing things, a relatively poor job of encrypting them with passwords, and a pretty bad job of encrypting them with public keys. PGP is not an especially good way to securely transfer a file. It’s a clunky way to sign packages. It’s not great at protecting backups. It’s a downright dangerous way to converse in secure messages.

    minisign is more in the UNIX spirit.










  • Another aspect I like about Nix compared to what I understand from Ansible (which I used a bit but not much) is that your configuration describes your system without any hidden state. Yes, you only get your dependencies through full evaluation, but what I mean is this: Let’s say you install something on a system, i.e. you add it to your list of packages, which you later remove. To my knowledge, Ansible won’t remove the package if not explicitly asked. However, if you explicitly tell Ansible to not have it installed, what happens if that package is later introduced as a dependency?

    Ansible will always operate on a stateful system, which is kind of the combination of what others have already mentioned – it’s (EDIT: it being Nix) idempotent and there’s no hidden state that will break something down the way.