Proof Of Concept Repl Bots via nix-shell

[solomon-b]

Adds python and nodejs repl bots as a proof of concept.

[solomon-b]

i need to get this command running in a docker container.

[solomon-b]

@JonathanLorimer for REPL bots I am building docker images with nix. Do you have any thoughts on how we can design this derivation to be more scalable for adding more languages?

[JonathanLorimer]

I honestly think these could all just be systemd jobs inside nix shells though...

  systemd.services.python-repl = {
      description = "Python repl";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
      serviceConfig = {
        Type = "notify";
        ExecStart = "nix-shell -p python3 --command "python -iq"";
      };
    };

[JonathanLorimer]

you could abstract the python specific stuff in a nix module and then your nixos configuration would just do this:

sercives.language-repls = [
  {name = "python"; package = pkgs.python3; binName = "python3"; opts = "-iq";}
   ...
]; 

you wouldn't even need the nix shell bit above if you did direct interpolation:
ExecStart = "${package}/bin/${binName} ${opts}"

[masaeedu]

@JonathanLorimer I don't think that's a good idea. The point of containerization is to isolate the server from untrusted code execution, so that if someone runs rm -rf / as a joke it doesn't actually nuke the entire server. You can increase the isolation of the server from these untrusted REPLs by using Linux namespacing stuff, but the more of that you do, the more of existing containerization solutions you reinvent.

[solomon-b]

@JonathanLorimer We are building these scripts for building deploy scripts for the bot and the repl images. We tried to make these apps rather then packages with pkgs.runCommand but werent able to run docker load. Do you know of any tricks to perform side effects in a flake output or is that off the table?

[solomon-b]

Also we need to get these images onto the server and loaded into docker. I don't want to put them on the github docker hub because they are going to take up too much space as we add more images. Can we modify our github deploy action to sync them onto the server directly?

[JonathanLorimer]

For the scripts, I would suggest moving them to a separate file parameterized by their dependencies.
I would also suggest using writeShellApplication https://github.com/NixOS/nixpkgs/blob/master/pkgs/build-support/trivial-builders.nix#L274-L305 it will set a bunch of sane defaults as well as the shebang, and you can specify sed as a runtime input. It will also run shellcheck in the check phase.

[JonathanLorimer]

Suggested change

	images =
	{
	python = mkImage pkgs.python3 [ "python" "-iq" ];
	node = mkImage pkgs.nodejs [ "node" "-i" ];
	ghci = mkImage pkgs.ghc [ "ghci" ];
	mitScheme = mkImage pkgs.mitscheme [ "mit-scheme" ];
	sbcl = mkImage pkgs.sbcl [ "sbcl" ];
	};
	images =
	foldl' (acc {name, package, cmd}: acc // { "${name}" = mkImage package cmd }) {} supportedLanguages;
	supportedLanguages =
	[ { name = "python"; package = pkgs.python3; cmd = [ "python" "-iq" ]}
	{ name = "node"; package = pkgs.nodejs; cmd = [ "node" "-i]}
	{ name = "ghci"; package = pgks.ghc; cmd = [ "ghci"]}
	{ name = "mitScheme"; package = pkgs.mitscheme; cmd = [ "mit-scheme ]
	{ name = "sbcl"; package = pkgs.sbcl; cmd = [ "sbcl"]}
	];

By more scalable do you mean something like this (like easier to add, although I am not sure this is an improvement). Or do you mean that a lot of docker containers is expensive.

[JonathanLorimer]

I honestly think these could all just be systemd jobs inside nix shells though...

  systemd.services.python-repl = {
      description = "Python repl";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
      serviceConfig = {
        Type = "notify";
        ExecStart = "nix-shell -p python3 --command "python -iq"";
      };
    };

[JonathanLorimer]

you could abstract the python specific stuff in a nix module and then your nixos configuration would just do this:

sercives.language-repls = [
  {name = "python"; package = pkgs.python3; binName = "python3"; opts = "-iq";}
   ...
]; 

you wouldn't even need the nix shell bit above if you did direct interpolation:
ExecStart = "${package}/bin/${binName} ${opts}"

[JonathanLorimer]

For the scripts, I would suggest moving them to a separate file parameterized by their dependencies.
I would also suggest using writeShellApplication https://github.com/NixOS/nixpkgs/blob/master/pkgs/build-support/trivial-builders.nix#L274-L305 it will set a bunch of sane defaults as well as the shebang, and you can specify sed as a runtime input. It will also run shellcheck in the check phase.