Reproducibility, Pants, Nix

[jorgegomezcq]

Hi Pants Build System developers,

With projects like the Nix package manager and related tooling/systems existing, how does pants see itself addressing the issue/solution to reproducibility in a software project?

Could Pants consider integrating with Nix at some point in the future?

Has this not been considered before?

Does pants have an alternative answer to handling reproducibility in a software project?

Is this out of scope for the Pants project?

[kaos]

ping @pantsbuild/maintainers

[jriddy]

So I really only know the broad strokes of how Nix works. From everything I can tell, Nix and Pants have similar goals, but Pants focuses mainly on existing language-level ecosystems and works to create reproducible builds largely within those. Unlike Nix, really aims to be full-suite development tool, supporting not only reproducible builds, but also hermetic, reproducible tests, linting, formatting, etc. Most of its DX/UX efforts are focused around that. But we do take reproducibility quite seriously.

I don't see any reason why we couldn't support publishing Nix derivations via plugins. "Publish" in Pants world means to produce some kinda artifact, so adding that on should just be a plugin like any other. I don't think any current maintainers have any plans to do this, but there's nothing stopping you from contributing. See the docs on plugins for how to implement one, or ask questions in #plugins on our Slack.

On the other hand, consuming Nix packages and using them as part of Pants would be a much larger undertaking. Pants' backends (which are the bits of plugins that implement logic for particular ecosystems) are coupled tightly to the tools and ecosystems typical of the languages they support; e.g., the Python backend makes heavy use of Pip and Pex, the Go backend uses the standard Go tools, etc. So if you're aiming at a deeper integration, that would be entail a much longer discussion.

[jsirois]

If the integration is via nix-shell, I'm sure it's still an undertaking, but a bit less so: https://nixos.org/manual/nix/stable/command-ref/nix-shell

That is my only interaction with Nix, using the shell to support Nix package maintainers that discovered an issue with Pex when they were packaging it.

It's pretty slick and you need not know much about Nix to use it on your non-Nix OS. Presumably not needing to know much translates to easier integration than might otherwise be.

[jgarte]

Hi,

Here are two blog posts from Tweag on using Bazel with Nix:

https://www.tweag.io/blog/2022-12-15-bazel-nix-migration-experience/
https://www.tweag.io/blog/2018-03-15-bazel-nix/

Just substitute Bazel with Pants? 😸

[benjyw]

Interesting. So is this something we can use environments for? There seems to be some overlap. A nix environment could be an alternative to a docker one, or something?

[jgarte]

A nix environment could be an alternative to a docker one ... ?

I can confidently say yes to this question. Anyone feel free to add more detail to my response if you wish.

[jgarte]

As I understand it, nix wraps the pip package manager and calls pip to create a software environment. I'm glossing over details here.

Another TLDR, nix can create environments with all the dependencies (e.g. Python, Rust, C, etc.) in a way that is highly reproducible.

The user is able to, for example, connect numpy with the particular version of gcc that was used to compile the version of CPython that is in a particular software environment's dependency graph starting from numpy. A transitive ditto for all the other dependencies in the software environment.

Stated differently, the entire software dependency graph down to the particular C compiler commit hash is accounted for and entirely reproducible.

Docker doesn't ensure that level of detail/insight/reproducibility regarding the software environment's dependency story.

[jgarte]

@benjyw

Interesting. So is this something we can use environments for? There seems to be some overlap. A nix environment could be an alternative to a docker one, or something?

On a cursory read, I could see nix being added as an "environment target" alongside local_environment, docker_environment, and remote_environment.

I'll try to play with pants environments to get a better understanding of them.

[benjyw]

Yeah, after doing more reading on nix, it seems like an environment-like thing. Or at least it fulfills a similar role.

[jskrzypek]

Piggybacking on @jgarte's answer, I have experience from a previous org maintaining a custom, nix-based, python package management and build system that did a lot of the same stuff that pants promises. While I have relatively limited exposure to pants so far, it sounds a lot like nix could be used to good effect as a build environment.

I also want to add that nix even provides the ability to add reproducible & shareable patches on top of 3rd party python sources that allow you to solve thorny gaps and inconsistencies in dependency graphs. This might sound potentially dangerous, but nix defaults to also running the tests included with any source prior to caching a build. This means that on the one hand, builds can take longer to run the first time unless you skip running the tests. On the other hand, if you do need to patch something, you get to reuse the suite of tests written by the authors to have high confidence that the package continues to do what it promises. Specifically, lets say you are using numpy and pandas, and you want to try to build with a pre-release version of numpy, if pandas doesn't have a pre-release version that allows for that version of numpy, you normally couldn't do so. Nix lets you override pandas's source with a patch that modifies its pyproject.toml to bump the pinned version of numpy. It even is compatible with the GitHub raw patch links for PRs (i.e. stick .patch on the end of a PR's URL like: https://github.com/<org>/<repo>/pull/<PR number>.patch). This lets you submit a PR to the project and start consuming it in your code even before it is accepted/merged.

[jgarte]

@benjyw

Here's a good TLDR workflow showcase with FastAPI showing how Python developers are using nix for developing software:

https://www.corletti.xyz/blog/nix-devlog-000