this post was submitted on 05 Aug 2023

44 points (92.3% liked)

Linux

48023 readers

962 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
No misinformation
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago

MODERATORS

[email protected]

How do you containerize stuff you install from source in a way that you can completely remove later? (lemmy.world)

submitted 1 year ago by [email protected] to c/[email protected]

48 comments fedilink hide all child comments

I'm doing a bunch of AI stuff that needs compiling to try various unrelated apps. I'm making a mess of config files and extras. I've been using distrobox and conda. How could I do this better? Chroot? Different user logins for extra home directories? Groups? Most of the packages need access to CUDA and localhost. I would like to keep them out of my main home directory.

all 50 comments

sorted by: hot top controversial new old

[–] [email protected] 19 points 1 year ago* (last edited 1 year ago) (3 children)

I did Linux From Scratch recently and they have a brilliant solution. Here's the full text but it's a long read so I'll briefly explain it. https://www.linuxfromscratch.org/hints/downloads/files/more_control_and_pkg_man.txt

Basically you make a new user with the name of the package you want to install. Login to that user then compile and install the package.

Now when you search for files owned by the user with the same name as the package you will find every file that package installed.

You can document that somewhere or just use the find command when you are ready to remove all files related to the package.

I didn't actually do this for my own LFS build so I have no further experience on the matter. I think it will eventually lead to dependency hell when two packages want to install the same file.

I guess flatpaks are better about keeping libraries separate but I'm not sure if they leave random files all over your hard drive the way apt remove/apt purge does. (Getting really annoyed about all the crud left in my home dir)

[–] [email protected] 6 points 1 year ago (1 children)

That’s clever. It should work on any system, shouldn’t it?

[–] [email protected] 2 points 1 year ago (1 children)

Any POSIX compliant system as far as I know.

[–] [email protected] 3 points 1 year ago

Thanks. I’ll keep that in mind for again.

[–] [email protected] 2 points 1 year ago (2 children)

Thanks for the read. This is what I was thinking about trying but hadn't quite fleshed out yet. It is right on the edge of where I'm at in my learning curve. Perfect timing, thanks.

Do you have any advice when the packages are mostly python based instead of makefiles?

[–] [email protected] 5 points 1 year ago

for python, a bunch of venvs should do it

[–] [email protected] 2 points 1 year ago (1 children)

This method should work with any command that's installing files on your disk but it's probably not worth the headache when virtual environments exist for python.

[–] [email protected] 2 points 1 year ago (1 children)

Python, in these instances, is being used as the installer script. As far as I can tell it involves all of the same packaging and directory issues as what make is doing. Like, most of the packages have a Python startup script that takes a text file and installs everything from it. This usually includes a pip git+address or two. So far, just getting my feet wet to try out AI has been enough for me to overlook what all is happening behind the curtain. The machine is behind an external whitelist firewall all by itself. I am just starting to get to the point where I want to dial everything in so I know exactly what is happening.

I've noticed a few oddball times during installations pip said something like "package unavailable; reverting to base system." This was while it is inside conda, which itself is inside a distrobox container. I'm not sure what "base system" it might be referring to here or if this is something normal. I am probing for any potential gotchas revolving around python and containers. I imagine it is still just a matter of reading a lot of code in the installation path.

[–] [email protected] 1 points 1 year ago* (last edited 1 year ago)

I hope someone who has more info comes along. It might be time for you to make a new post though since we're getting to the heart of the problem now.

Also it will be a lot easier for people to diagnose if you are specific about which programs you are failing to install.

I've only experimented with Python in docker and it gave me a lot of headaches.

That's why I prefer to pip install things inside venvs because I can just tar them myself and have decent portability.

But since your installing files across the system I'm not sure what the best solution is.

[–] [email protected] 12 points 1 year ago (1 children)

Nix

[–] [email protected] 4 points 1 year ago (1 children)

NixOS containers could do what OP's asking for, but it'll be trickier with just nix (on other distro). It'll handle build dependencies and such, but you'll still need to keep your home or other directories clean some other way.

[–] [email protected] 5 points 1 year ago (1 children)

OP could use flakes to create these dev environments and clean them up without a trace once done.

[–] [email protected] 0 points 1 year ago (1 children)

Any files created by programs running in the dev environments will remain.

[–] [email protected] 3 points 1 year ago (1 children)

nix-collect-garbage

[–] [email protected] 3 points 1 year ago* (last edited 1 year ago)

Does NOT delete any files that were written to, for example, ~/.local or ~/.config from dev shell.

One of OP's problems was,

I’m making a mess of config files and extras.

[–] [email protected] 8 points 1 year ago

I use a mixture of systemd-nspawn and different user logins. This is sufficient for experimentation, for actual use I try to package (makepkg) those tools to have them organized by my package manager.

Also LVM thinpools with snapshots are a great tool. You can mount a dedicated LV to each single user home to keep everything separated.

[–] [email protected] 7 points 1 year ago

Qubes: you can install software inside of its own disposable VM. Or it can be a persistent VM we're only the data in home persists. Or it can be a VM where the root persists. You have a ton of control. And it's really useful to see what's changed in the system.

All the other solutions here are talking about in the operating system, qubes is doing it outside the operating system

[–] [email protected] 6 points 1 year ago (1 children)

I use Gentoo where builds from source are supported by the package manager. ;)

Overall though, any containerisation option such as Docker / Podman or Singularity is what I would typically do to put things in boxes.

For semi-persistent envs a chroot is fine, and I have a nice Gentoo-specific chroot script that makes my life easier when reproing bugs or testing software.

[–] [email protected] 1 points 1 year ago (1 children)

Wait. Does emerge support building packages natively when they are not from Gentoo?

Most of the stuff I'm messing with is mixed repos with entire projects that include binaries for the LLMs, weights, and such. Most of the "build" is just setting up the python environment with the right dependency versions for each tool. The main issues are the tools and libraries like transformers, pytorch, and anything that interacts with CUDA. These get placed all over the file system for each build.

[–] [email protected] 2 points 1 year ago

Ebuilds (Gentoo packages) are trivial to create for almost anything, so while the answer is 'no the package manager doesn't manage non PM packages', typically you'll make an ebuild (or two or three) to handle that because it's (typically) as easy as running make yourself. :)

[–] [email protected] 5 points 1 year ago

For "desktop" stuff (gaming, office etc.) I just install bare-metal, for "server" stuff I basically only look for containerisation in the form of Podman (Docker compatible). If it doesn't exist as a compose file it isn't worth my time.

[–] [email protected] 5 points 1 year ago

I think Podman should do a good job but I never used it myself, Distrobox is build on it and a lot easier to use so that's what I would recommend!

[+] [email protected] 5 points 1 year ago* (last edited 1 year ago) (1 children)

[deleted]

[–] [email protected] 5 points 1 year ago* (last edited 1 year ago) (2 children)

I have read up on it some, but Fedora does UEFI, secure boot, and a self compiling Nvidia driver that gets built for each kernel update so well that I hesitate to leave. I tried installing the NIX package manager on fedora, but having a user owned directory folder mounted in root is the ugliest thing I've ever seen and immediately removed it.

[–] [email protected] 4 points 1 year ago (1 children)

Secureboot can use your own keys, which any distro can do regardless. Nix essentially (simplified) rebuilds your whole rootfs every time you do a config change so that every change is fully reproducable.

having a user owned directory folder mounted in root

Do you mean the /nix directory? Nixos doesn't use the same FHS as most distros, so of course it would save its own data somewhere on root, since your actual rootfs is rebuilt declarativly when you request it. IMO it's really elegant, and its hard to go back to files strewn all over the place and the headache of trying to have multiple versions of the same library installed.

[–] [email protected] 1 points 1 year ago (1 children)

Unfortunately, the UEFI on my laptop doesn't allow custom keys. I can disable secure boot. I can make and place custom keys, but it never switches over from the initial unprotected state to whatever they call that transition state after the new custom PK key is added. Once all the custom keys are configured and I try to reinstate secure boot in the bios, it flushes the custom keys and recreates a new set automatically using the secret Trusted Protection Module key(s) built into the hardware.

Since my initial failure trying to add custom keys, I've come across Sakaki's old UEFI guide on Gentoo and noted the possibility of maybe installing keys with the EFI KeyTool to boot into EFI directly, but I have not tried it.

Do you mean the /nix directory?

Yeah. I wanted to try a flake I came across for an AI app I was having trouble compiling on my own. The flake was setup for a Linux/Windows subsystem though. I tried to install the Nix package manager as a single user because I don't want some extra daemon running or anything that has such an elaborate uninstall as the multiuser Nix lists. At least it is too much to deal with for a short term goal of installing a single app. After installing the single user Nix pm, the flake I was trying to use wasn't listed in the Nix repo and reconfiguring what was already setup looked like a waste of time.

In general I would rather have my entire root directory locked down. I don't really know the real world implications of having a user owned directory in my root file system. It just struck me as too strange to overlook, and it is far too deep into a rabbit hole for my goal that had proved fruitless already. I searched for several of the tools I've had to compile on my own, and none of them were listed in Nix. There are a couple on the AUR but no distro seems to do FOSS AI yet.

I've already been burned by running Arch natively years ago. I dropped it and installed Gentoo which I ran for a few months before switching to Silverblue because I didn't really have the scripting skills to make Gentoo work for me at the time. I'm very weary of any elitist rhetoric about any distro now. When I see stuff like 'Nix is a language you just learn/only for power users,' I have flashbacks of dozens of tabs open in the arch wiki, back when I learned what a fractal link chasm is, and all those times I had to actually use backups to function with Arch; the only time I've ever needed to restore backups in my life. At this point, I think I'm on the edge of transitioning from an intermediate to "power user" after ten years on Linux exclusively, but I know there is a lot of stuff I do not grasp yet. An operating system shouldn't be a project I need to actively manage, maintain, or stop what I am working on for a random tangential deep dive just to use. I can't tell what Nix is like in practice. The oddity of the package manager does not inspire confidence, but I'm admittedly skeptical by default. I see how dependencies are handled better in Nix in some ways, but I do not have infinite storage for a bunch of redundant copies of everything just for every obscure package on my base system. I'm not clear about how Nix does configs and dot files "better" than my present situation. The lack of a deep dive into UEFI security and details about the ability of Nix to coexist in a system with a separate Windows drive (because laptop has a few configuration elements only available in Windows), I haven't tried Nix OS.

[–] [email protected] 2 points 1 year ago (1 children)

No worries, UEFI is definitely a "milage may vary" kinda standard.

I've personally only used NixOS and not Nix on a different distro by itself so I'm less familiar with that setup. No system is perfect for all use cases, but that's sorta the point in Unix-land. I personally have been gripped by NixOS and having to go back to Fedora for some of my old servers has been a pain. They use it like a buzzword all the time, but declarative administration is so awesome. It does have a heck of a learning curve though.

[–] [email protected] 1 points 1 year ago (1 children)

Is the Nix learning curve like Arch's f.u. user-go cry to rsync/CS Masters expectations, or like Gentoo's tl;dr approach of "our packagers know how to create sane defaults and include key info you need for sound decisions" approach. I never want to deal with another distro that randomly dumps me into an enormous subject to read because they made a change in a dependency that requires me to manually intervene in a system update, or any OS that makes basic FOSS tools like gimp and FreeCAD tedious.

[–] [email protected] 4 points 1 year ago

In my experience its mostly sane defaults and a mixed bag in terms of documentation. For anyone else reading this, https://search.nixos.org/options using this to search for all the built in options is usually a good enough starting point for installing something.

Nix does dependencies very differently, since every program and everything it needs are put into their own checksummed directory, then linked into your PATH as requested in your config. So far I've never needed to do anything other than nixos-rebuild --upgrade switch and only needed to reboot for kernel updates.

I mostly work in container spaces, so building things from source, or out-of-repo pkgs, while rare, are done in containers with podman. For example, running Automatic1111's stable diffusion works perfectly for me in a container with an AMD GPU no less. Eventually I'd like to get into flakes, but their still marked experimental so I haven't looked too much into it.

Overall the learning experience is figuring out the overall structure of the system, then taking advantage of all the super powerful tooling and consistency those tools offer.

[–] [email protected] 2 points 1 year ago

If you're not comfortable using Nix flakes check out toolbox

[–] [email protected] 4 points 1 year ago (1 children)

Not sure if that's a good idea but if you use Fedora, you also have your root on a BTRFS partition after a default installation. You could utilize the snapshot features of BTRFS to roll back after testing.

[–] [email protected] 2 points 1 year ago

I need to explore this BTRFS feature, I just don't have a good place or reason to start Dow that path yet. I've been on Silverblue for years, but decided to try Workstation for now. Someone in the past told me I should have been using BTRFS for FreeCAD saves, but I never got around to trying it.

[–] [email protected] 3 points 1 year ago

software like stow keeps track of files installed, and helps you remove it later

[–] [email protected] 3 points 1 year ago (1 children)

it it does not need a gui, use docker and log in into it. do the stuff and when you are done, docker rm and everything disappear.

you can enable cuda inside the container, follow the docs for that.

bonus point, vs code can open itself inside a container.

[–] [email protected] 2 points 1 year ago* (last edited 1 year ago)

You can use GUI stuff in docker as well, though it can be a bit fiddly to setup.

[–] [email protected] 2 points 1 year ago (1 children)

I've never worried about this but I'd use Flatpak. The whole install goes in a specific directory and the metadata/config/data files go in their own specific directory.

[–] [email protected] 1 points 1 year ago

Those Flatpak configs are not quite as scattered, most are in .config .var or .local. Most Flatpaks leave junk behind in these directories. I just deleted a few today. A lot of the problems start happening when you need to compile stuff where each package has the same dependency but a different version of the dep in each one. Then you have a problem and need to track down some related library that is not in the execution path and suddenly there are 10 copies of a dozen files all related to the stupid thing on your system and scattered all over the place. It becomes nearly impossible to track down which file is related to the container with the problem.

This is only an issue if you find yourself playing in software that is not yet supported directly my any packagers for Linux distros; stuff like FOSS AI right now.

[–] [email protected] 2 points 1 year ago* (last edited 1 year ago)

Have an lxc config that enables glx on x11 in the container, spin one up and throw stuff in there, temp zfs volume.

Lxc-rm when done.

[–] [email protected] 2 points 1 year ago

Give a look at distrobox

[–] [email protected] 2 points 1 year ago

@j4k3 https://github.com/89luca89/distrobox/blob/main/docs/useful_tips.md#create-a-distrobox-with-a-custom-home-directory

[–] [email protected] 2 points 1 year ago

Haven't tried it (and don't use docker), so a wild shot: https://github.com/jupyterhub/repo2docker

'repo2docker fetches a repository (from GitHub, GitLab, Zenodo, Figshare, Dataverse installations, a Git repository or a local directory) and builds a container image in which the code can be executed. The image build process is based on the configuration files found in the repository.'

That way you can perhaps just delete the docker image and everything is gone. Doesn't seem to depend on jupyter..

[–] [email protected] 2 points 1 year ago (1 children)

You can't completely remove distrobox image and contents later?

[–] [email protected] 1 points 1 year ago (1 children)

By default it is just the packages and dependencies that are removed. Your /home/user/ directory is still mounted just the same. This puts all of your config and dot files in all the normal places. If you install another distro like Arch on a Fedora base, it also installs all of the extra root package locations for arch and these get left on the host system after removing the distrobox instance. So yeah it still makes a big mess.

[–] [email protected] 6 points 1 year ago (1 children)

You can mount any directory you want as the “home” directory of a given container with distrobox, it just defaults to using your home directory.

[–] [email protected] 1 points 1 year ago

Do you happen to know what distrobox options there are for extra root directories associated with other distro containers, if there is an effective option to separate these, or if this is part of the remote "home" mount setting? I tried installing an Arch container on a fedora base system. Distrobox automatically built various Arch root directories even though the container should have been rootless.

[–] [email protected] 1 points 1 year ago

Chroot would be fine for this and not overly complicated

[–] [email protected] 1 points 1 year ago

There’s a method using systemd-sysext that would work well for this on any distro without dealing with poking holes in containers. One of the gnome folks blogged about it recently here: https://blogs.gnome.org/alatiera/2023/08/04/developing-gnome-os-systemd-sysext/

[–] [email protected] 1 points 1 year ago* (last edited 1 year ago)

export LDFLAGS="-Wl,-rpath=/sw/app/version/lib"
./configure --prefix=/sw/app/version
make
sudo make install
unset LDFLAGS