Talk:Packaging/Binaries - Revision history

imported>Milahu: add comment, remove indents

2021-10-08T10:27:51Z

add comment, remove indents

← Older revision		Revision as of 10:27, 8 October 2021
Line 12:		Line 12:
	--[[User:Milahu\|Milahu]] ([[User talk:Milahu\|talk]]) 16:47, 1 October 2021 (UTC)		--[[User:Milahu\|Milahu]] ([[User talk:Milahu\|talk]]) 16:47, 1 October 2021 (UTC)

	: A virtual machine is most robust. X11docker a good combo; x11docker supports [https://katacontainers.io/ Kata Containers], which aims to combine the security of VMs with speed of containers. [[Security]] a good page for this too. [https://spectrum-os.org/design.html Spectrum OS] is a Nix-based design with similar aims; they were looking at crosvm with virtio_wl. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 09:24, 2 October 2021 (UTC)		A virtual machine is most robust. X11docker a good combo; x11docker supports [https://katacontainers.io/ Kata Containers], which aims to combine the security of VMs with speed of containers. [[Security]] a good page for this too. [https://spectrum-os.org/design.html Spectrum OS] is a Nix-based design with similar aims; they were looking at crosvm with virtio_wl. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 09:24, 2 October 2021 (UTC)

	:: There is a demo here: https://alyssa.is/using-virtio-wl/#demo — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 09:28, 2 October 2021 (UTC)		: There is a demo here: https://alyssa.is/using-virtio-wl/#demo — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 09:28, 2 October 2021 (UTC)

	: Another relevant approach is Microsoft's [https://xdc2020.x.org/event/9/contributions/611/attachments/702/1298/XDC2020_-_X11_and_Wayland_applications_in_WSL.pdf development of VAIL with RDP] (extending Wayland's Weston compositing manager's RDP support) in order to support low-latency zero-copy GPU-accelerated X11/Wayland-graphical Linux virtual machines on Windows. The same technology could be deployed very similarly with a Linux-guest-on-Linux-host approach for the sake of of security. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 23:59, 7 October 2021 (UTC)		Another relevant approach is Microsoft's [https://xdc2020.x.org/event/9/contributions/611/attachments/702/1298/XDC2020_-_X11_and_Wayland_applications_in_WSL.pdf development of VAIL with RDP] (extending Wayland's Weston compositing manager's RDP support) in order to support low-latency zero-copy GPU-accelerated X11/Wayland-graphical Linux virtual machines on Windows. The same technology could be deployed very similarly with a Linux-guest-on-Linux-host approach for the sake of of security. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 23:59, 7 October 2021 (UTC)

	: I did some looking into [https://ostreedev.github.io/ostree/introduction/#introduction OSTree] today. They bill themselves as "git for operating system binaries," and were [https://ostree.readthedocs.io/en/stable/manual/related-projects/#nixos-nix largely inspired by] NixOS. Fedora is building [https://getfedora.org/coreos CoreOS] for containerized-cloud and [https://docs.fedoraproject.org/en-US/fedora-silverblue/ Silverblue] as an immutable containerized workstation OS. There's also projects like [https://github.com/containers/toolbox Toolbox] built around OSTree which look inspired by nix-shell, but adds containerization. Particularly interesting for this discussion is the model of Silverblue. They seem mostly to lean on Flatpaks though, which isn't very sound [https://flatkill.org as is]. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 00:47, 8 October 2021 (UTC)		I did some looking into [https://ostreedev.github.io/ostree/introduction/#introduction OSTree] today. They bill themselves as "git for operating system binaries," and were [https://ostree.readthedocs.io/en/stable/manual/related-projects/#nixos-nix largely inspired by] NixOS. Fedora is building [https://getfedora.org/coreos CoreOS] for containerized-cloud and [https://docs.fedoraproject.org/en-US/fedora-silverblue/ Silverblue] as an immutable containerized workstation OS. There's also projects like [https://github.com/containers/toolbox Toolbox] built around OSTree which look inspired by nix-shell, but adds containerization. Particularly interesting for this discussion is the model of Silverblue. They seem mostly to lean on Flatpaks though, which isn't very sound [https://flatkill.org as is]. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 00:47, 8 October 2021 (UTC)

	https://~~docs~~.~~fedoraproject~~.org~~/en~~-~~US/fedora~~-~~silverblue/~~		complex stuff! assuming that containers are too insecure, probably the simplest solution for running (and packaging) UNTRUSTED binaries is a microvm like [https://github.com/firecracker-microvm/firecracker firecracker], managed with [https://github.com/weaveworks/ignite ignite]. both packages are in nixpkgs. we can also use firecracker directly as in [https://github.com/astro/microvm.nix microvm.nix]. no need to install a new OS. no need for wayland. no need for sudo. it just takes some hours to compile a custom guest kernel, but sooner or later, the firecracker-kernel will be on cache.nixos.org. --[[User:Milahu\|Milahu]] ([[User talk:Milahu\|talk]]) 10:27, 8 October 2021 (UTC)

imported>Nix: Silverblue mostly working with Flatpaks

2021-10-08T02:57:23Z

Silverblue mostly working with Flatpaks

← Older revision		Revision as of 02:57, 8 October 2021
Line 18:		Line 18:
	: Another relevant approach is Microsoft's [https://xdc2020.x.org/event/9/contributions/611/attachments/702/1298/XDC2020_-_X11_and_Wayland_applications_in_WSL.pdf development of VAIL with RDP] (extending Wayland's Weston compositing manager's RDP support) in order to support low-latency zero-copy GPU-accelerated X11/Wayland-graphical Linux virtual machines on Windows. The same technology could be deployed very similarly with a Linux-guest-on-Linux-host approach for the sake of of security. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 23:59, 7 October 2021 (UTC)		: Another relevant approach is Microsoft's [https://xdc2020.x.org/event/9/contributions/611/attachments/702/1298/XDC2020_-_X11_and_Wayland_applications_in_WSL.pdf development of VAIL with RDP] (extending Wayland's Weston compositing manager's RDP support) in order to support low-latency zero-copy GPU-accelerated X11/Wayland-graphical Linux virtual machines on Windows. The same technology could be deployed very similarly with a Linux-guest-on-Linux-host approach for the sake of of security. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 23:59, 7 October 2021 (UTC)

	: I did some looking into [https://ostreedev.github.io/ostree/introduction/#introduction OSTree] today. They bill themselves as "git for operating system binaries," and were [https://ostree.readthedocs.io/en/stable/manual/related-projects/#nixos-nix largely inspired by] NixOS. Fedora is building [https://getfedora.org/coreos CoreOS] for containerized-cloud and [https://docs.fedoraproject.org/en-US/fedora-silverblue/ Silverblue] as an immutable containerized workstation OS. There's also projects like [https://github.com/containers/toolbox Toolbox] built around OSTree which look inspired by nix-shell, but adds containerization. Particularly interesting for this discussion is the model of Silverblue. ~~Worth looking into more~~. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 00:47, 8 October 2021 (UTC)		: I did some looking into [https://ostreedev.github.io/ostree/introduction/#introduction OSTree] today. They bill themselves as "git for operating system binaries," and were [https://ostree.readthedocs.io/en/stable/manual/related-projects/#nixos-nix largely inspired by] NixOS. Fedora is building [https://getfedora.org/coreos CoreOS] for containerized-cloud and [https://docs.fedoraproject.org/en-US/fedora-silverblue/ Silverblue] as an immutable containerized workstation OS. There's also projects like [https://github.com/containers/toolbox Toolbox] built around OSTree which look inspired by nix-shell, but adds containerization. Particularly interesting for this discussion is the model of Silverblue. They seem mostly to lean on Flatpaks though, which isn't very sound [https://flatkill.org as is]. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 00:47, 8 October 2021 (UTC)

	https://docs.fedoraproject.org/en-US/fedora-silverblue/		https://docs.fedoraproject.org/en-US/fedora-silverblue/

imported>Nix: thoughts on OSTree and Silverblue for security in NixOS

2021-10-08T00:48:22Z

thoughts on OSTree and Silverblue for security in NixOS

← Older revision		Revision as of 00:48, 8 October 2021
Line 17:		Line 17:

	: Another relevant approach is Microsoft's [https://xdc2020.x.org/event/9/contributions/611/attachments/702/1298/XDC2020_-_X11_and_Wayland_applications_in_WSL.pdf development of VAIL with RDP] (extending Wayland's Weston compositing manager's RDP support) in order to support low-latency zero-copy GPU-accelerated X11/Wayland-graphical Linux virtual machines on Windows. The same technology could be deployed very similarly with a Linux-guest-on-Linux-host approach for the sake of of security. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 23:59, 7 October 2021 (UTC)		: Another relevant approach is Microsoft's [https://xdc2020.x.org/event/9/contributions/611/attachments/702/1298/XDC2020_-_X11_and_Wayland_applications_in_WSL.pdf development of VAIL with RDP] (extending Wayland's Weston compositing manager's RDP support) in order to support low-latency zero-copy GPU-accelerated X11/Wayland-graphical Linux virtual machines on Windows. The same technology could be deployed very similarly with a Linux-guest-on-Linux-host approach for the sake of of security. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 23:59, 7 October 2021 (UTC)

			: I did some looking into [https://ostreedev.github.io/ostree/introduction/#introduction OSTree] today. They bill themselves as "git for operating system binaries," and were [https://ostree.readthedocs.io/en/stable/manual/related-projects/#nixos-nix largely inspired by] NixOS. Fedora is building [https://getfedora.org/coreos CoreOS] for containerized-cloud and [https://docs.fedoraproject.org/en-US/fedora-silverblue/ Silverblue] as an immutable containerized workstation OS. There's also projects like [https://github.com/containers/toolbox Toolbox] built around OSTree which look inspired by nix-shell, but adds containerization. Particularly interesting for this discussion is the model of Silverblue. Worth looking into more. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 00:47, 8 October 2021 (UTC)

			https://docs.fedoraproject.org/en-US/fedora-silverblue/

imported>Nix: on Microsoft's recent work to bring graphical Linux VMs to Windows and how that might be applied on Linux too

2021-10-08T00:00:36Z

on Microsoft's recent work to bring graphical Linux VMs to Windows and how that might be applied on Linux too

← Older revision		Revision as of 00:00, 8 October 2021
Line 15:		Line 15:

	:: There is a demo here: https://alyssa.is/using-virtio-wl/#demo — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 09:28, 2 October 2021 (UTC)		:: There is a demo here: https://alyssa.is/using-virtio-wl/#demo — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 09:28, 2 October 2021 (UTC)

			: Another relevant approach is Microsoft's [https://xdc2020.x.org/event/9/contributions/611/attachments/702/1298/XDC2020_-_X11_and_Wayland_applications_in_WSL.pdf development of VAIL with RDP] (extending Wayland's Weston compositing manager's RDP support) in order to support low-latency zero-copy GPU-accelerated X11/Wayland-graphical Linux virtual machines on Windows. The same technology could be deployed very similarly with a Linux-guest-on-Linux-host approach for the sake of of security. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 23:59, 7 October 2021 (UTC)

imported>Nix at 09:28, 2 October 2021

2021-10-02T09:28:12Z

← Older revision		Revision as of 09:28, 2 October 2021
Line 12:		Line 12:
	--[[User:Milahu\|Milahu]] ([[User talk:Milahu\|talk]]) 16:47, 1 October 2021 (UTC)		--[[User:Milahu\|Milahu]] ([[User talk:Milahu\|talk]]) 16:47, 1 October 2021 (UTC)

	: A virtual machine is most robust. X11docker a good combo; x11docker supports [https://katacontainers.io/ Kata Containers], which aims to combine the security of VMs with speed of containers. [[Security]] a good page for this too. [https://spectrum-os.org/design.html Spectrum OS] is a Nix-based design with similar aims; they were looking at crosvm with virtio_wl. — [[User:Nix\|Nix]] [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 09:24, 2 October 2021 (UTC)		: A virtual machine is most robust. X11docker a good combo; x11docker supports [https://katacontainers.io/ Kata Containers], which aims to combine the security of VMs with speed of containers. [[Security]] a good page for this too. [https://spectrum-os.org/design.html Spectrum OS] is a Nix-based design with similar aims; they were looking at crosvm with virtio_wl. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 09:24, 2 October 2021 (UTC)

			:: There is a demo here: https://alyssa.is/using-virtio-wl/#demo — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 09:28, 2 October 2021 (UTC)

imported>Nix: add Spectrum

2021-10-02T09:25:17Z

add Spectrum

← Older revision		Revision as of 09:25, 2 October 2021
Line 12:		Line 12:
	--[[User:Milahu\|Milahu]] ([[User talk:Milahu\|talk]]) 16:47, 1 October 2021 (UTC)		--[[User:Milahu\|Milahu]] ([[User talk:Milahu\|talk]]) 16:47, 1 October 2021 (UTC)

	: A virtual machine is most robust. X11docker a good combo; x11docker supports [https://katacontainers.io/ Kata Containers], which aims to combine the security of VMs with speed of containers. [[Security]] a good page for this too. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 09:19, 2 October 2021 (UTC)		: A virtual machine is most robust. X11docker a good combo; x11docker supports [https://katacontainers.io/ Kata Containers], which aims to combine the security of VMs with speed of containers. [[Security]] a good page for this too. [https://spectrum-os.org/design.html Spectrum OS] is a Nix-based design with similar aims; they were looking at crosvm with virtio_wl. — [[User:Nix\|Nix]] [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 09:24, 2 October 2021 (UTC)

imported>Nix at 09:19, 2 October 2021

2021-10-02T09:19:29Z

← Older revision		Revision as of 09:19, 2 October 2021
Line 11:		Line 11:

	--[[User:Milahu\|Milahu]] ([[User talk:Milahu\|talk]]) 16:47, 1 October 2021 (UTC)		--[[User:Milahu\|Milahu]] ([[User talk:Milahu\|talk]]) 16:47, 1 October 2021 (UTC)

			: A virtual machine is most robust. X11docker a good combo; x11docker supports [https://katacontainers.io/ Kata Containers], which aims to combine the security of VMs with speed of containers. [[Security]] a good page for this too. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 09:19, 2 October 2021 (UTC)

imported>Milahu at 16:52, 1 October 2021

2021-10-01T16:52:14Z

← Older revision		Revision as of 16:52, 1 October 2021
Line 6:		Line 6:
	* firejail?		* firejail?
	* virtual machine?		* virtual machine?
			* https://github.com/mviereck/x11docker - "Run GUI applications and desktops in docker. Focus on security." (via [https://unix.stackexchange.com/questions/421184/restrict-clipboard-for-untrusted-x11-clients stackexchange])

	for example jdownloader is closed source, so i want to limit access to files, clipboard, etc.		for example jdownloader is closed source, so i want to limit access to files, clipboard, etc.

	--[[User:Milahu\|Milahu]] ([[User talk:Milahu\|talk]]) 16:47, 1 October 2021 (UTC)		--[[User:Milahu\|Milahu]] ([[User talk:Milahu\|talk]]) 16:47, 1 October 2021 (UTC)

imported>Milahu: Created page with "== untrusted binaries == packaging and running untrusted binaries on nixos? * NixOS Containers? * firejail? * virtual machine? for example jdownloader is closed source,..."

2021-10-01T16:47:35Z

Created page with "== untrusted binaries == packaging and running untrusted binaries on nixos? * NixOS Containers? * firejail? * virtual machine? for example jdownloader is closed source,..."

New page

== untrusted binaries ==

packaging and running untrusted binaries on nixos?

* [[NixOS Containers]]?
* firejail?
* virtual machine?

for example jdownloader is closed source, so i want to limit access to files, clipboard, etc.

--[[User:Milahu|Milahu]] ([[User talk:Milahu|talk]]) 16:47, 1 October 2021 (UTC)

← Older revision		Revision as of 10:27, 8 October 2021
Line 12:		Line 12:
	--[[User:Milahu\|Milahu]] ([[User talk:Milahu\|talk]]) 16:47, 1 October 2021 (UTC)		--[[User:Milahu\|Milahu]] ([[User talk:Milahu\|talk]]) 16:47, 1 October 2021 (UTC)

	: A virtual machine is most robust. X11docker a good combo; x11docker supports [https://katacontainers.io/ Kata Containers], which aims to combine the security of VMs with speed of containers. [[Security]] a good page for this too. [https://spectrum-os.org/design.html Spectrum OS] is a Nix-based design with similar aims; they were looking at crosvm with virtio_wl. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 09:24, 2 October 2021 (UTC)		A virtual machine is most robust. X11docker a good combo; x11docker supports [https://katacontainers.io/ Kata Containers], which aims to combine the security of VMs with speed of containers. [[Security]] a good page for this too. [https://spectrum-os.org/design.html Spectrum OS] is a Nix-based design with similar aims; they were looking at crosvm with virtio_wl. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 09:24, 2 October 2021 (UTC)

	:: There is a demo here: https://alyssa.is/using-virtio-wl/#demo — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 09:28, 2 October 2021 (UTC)		: There is a demo here: https://alyssa.is/using-virtio-wl/#demo — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 09:28, 2 October 2021 (UTC)

	: Another relevant approach is Microsoft's [https://xdc2020.x.org/event/9/contributions/611/attachments/702/1298/XDC2020_-_X11_and_Wayland_applications_in_WSL.pdf development of VAIL with RDP] (extending Wayland's Weston compositing manager's RDP support) in order to support low-latency zero-copy GPU-accelerated X11/Wayland-graphical Linux virtual machines on Windows. The same technology could be deployed very similarly with a Linux-guest-on-Linux-host approach for the sake of of security. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 23:59, 7 October 2021 (UTC)		Another relevant approach is Microsoft's [https://xdc2020.x.org/event/9/contributions/611/attachments/702/1298/XDC2020_-_X11_and_Wayland_applications_in_WSL.pdf development of VAIL with RDP] (extending Wayland's Weston compositing manager's RDP support) in order to support low-latency zero-copy GPU-accelerated X11/Wayland-graphical Linux virtual machines on Windows. The same technology could be deployed very similarly with a Linux-guest-on-Linux-host approach for the sake of of security. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 23:59, 7 October 2021 (UTC)

	: I did some looking into [https://ostreedev.github.io/ostree/introduction/#introduction OSTree] today. They bill themselves as "git for operating system binaries," and were [https://ostree.readthedocs.io/en/stable/manual/related-projects/#nixos-nix largely inspired by] NixOS. Fedora is building [https://getfedora.org/coreos CoreOS] for containerized-cloud and [https://docs.fedoraproject.org/en-US/fedora-silverblue/ Silverblue] as an immutable containerized workstation OS. There's also projects like [https://github.com/containers/toolbox Toolbox] built around OSTree which look inspired by nix-shell, but adds containerization. Particularly interesting for this discussion is the model of Silverblue. They seem mostly to lean on Flatpaks though, which isn't very sound [https://flatkill.org as is]. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 00:47, 8 October 2021 (UTC)		I did some looking into [https://ostreedev.github.io/ostree/introduction/#introduction OSTree] today. They bill themselves as "git for operating system binaries," and were [https://ostree.readthedocs.io/en/stable/manual/related-projects/#nixos-nix largely inspired by] NixOS. Fedora is building [https://getfedora.org/coreos CoreOS] for containerized-cloud and [https://docs.fedoraproject.org/en-US/fedora-silverblue/ Silverblue] as an immutable containerized workstation OS. There's also projects like [https://github.com/containers/toolbox Toolbox] built around OSTree which look inspired by nix-shell, but adds containerization. Particularly interesting for this discussion is the model of Silverblue. They seem mostly to lean on Flatpaks though, which isn't very sound [https://flatkill.org as is]. — [[User:Nix\|Nix]] ([[User talk:Nix\|talk]]) 00:47, 8 October 2021 (UTC)

	https://~~docs~~.~~fedoraproject~~.org~~/en~~-~~US/fedora~~-~~silverblue/~~		complex stuff! assuming that containers are too insecure, probably the simplest solution for running (and packaging) UNTRUSTED binaries is a microvm like [https://github.com/firecracker-microvm/firecracker firecracker], managed with [https://github.com/weaveworks/ignite ignite]. both packages are in nixpkgs. we can also use firecracker directly as in [https://github.com/astro/microvm.nix microvm.nix]. no need to install a new OS. no need for wayland. no need for sudo. it just takes some hours to compile a custom guest kernel, but sooner or later, the firecracker-kernel will be on cache.nixos.org. --[[User:Milahu\|Milahu]] ([[User talk:Milahu\|talk]]) 10:27, 8 October 2021 (UTC)