r/Qubes•
PigMannSweg

Shareable nix drive?

question

How can I get a shareable nix drive? I feel like this has a lot of potential with little downsides if done correctly. But I can't find anything specifically for this.

The idea is to have a NixOS standalone VM that shares its /nix folder with other VMs. Security wise, it's critical that packages installed aren't malicious, as it's being shared with many other VMs. In theory it may be possible to de anonymize someone, which can be solved by not using /nix folder on anon qubes. Are there any other security-type issues with this?

I was thinking I could do a NFS or create a loopback device that could be written by nixos and read only mounted on multiple vms.

The NFS would require more configuration per VM (firewalls in particular) and generally slower, but I think you would run into fewer issues with writing on a drive with multiple readers.

The problem, as I understand, with having multiple read mounts is caching. If NixOS writes to the /nix folder, read only mounts can get bad data. Can a lock can be managed through qrexec or something?

Are there any other potential avenues to achieve this?

Thanks!

Posted Nov 2, 2023, 1:17 AM UTC

40
Loading comments…