Hacker News new | past | comments | ask | show | jobs | submit login

One technique employed by microvm.nix[0] is to mount the hosts /nix/store into the guest. This won't shrink the size of the system, but should allow it to be amortized across many different VMs.

I'm not sure how exploitable a read-only virtiofs share is, so this is perhaps not appropriate in some circumstances.

[0]: https://github.com/astro/microvm.nix




I was thinking of a similar approach, but mounting /nix/store from the host into the guest will only work if you have a single guest.

For multiple guests, you should rely instead on: * A snapshot-able filesystem with the option to create clones (like ZFS). I think this is a great idea actually. * Exporting /nix/store via NFS, so you can have multiple writers (but this creates some tight coupling in that accidentally deleting stuff there may disrupt all guests).


mounting /nix/store from the host into the guest works with as many guests as you like - this is what the nixos tests framework does all the time, you just need a different "system" derivation for each (different) VM.

The problem with that is that the VM can see all the needless software, so if your goal is isolation, having a smaller closure is much better from a security point of view: if there's no coreutils bash etc then there's no risk of getting a shell spawned by an attack...


If you don't setup the mount, microvm.nix will create an erofs/squashfs image for /nix/store.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: