Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Host minimal profile #41

Closed
wants to merge 2 commits into from
Closed

Host minimal profile #41

wants to merge 2 commits into from

Conversation

vilvo
Copy link
Contributor

@vilvo vilvo commented Jan 11, 2023

  • imported and tested minimal profile on host for NVIDIA Orin AGX
  • documented the ADR proposal for the minimal host

* Use NixOS minimal profile on host instead of default
  to match the design target of minimal trusted computing
  base (TCB).
* Metrics on nvidia-jetson-orin:
  * reduces the image size and root-partition used size
    with 500M from 4.2G to 3.5G and 2.6G to 2.1G respectively
  * Number of pkgs in /nix/store from 707 t0 526
* Numbers not seen on x86 VM target as the nix-store of the
  host is mounted to the VM. Not imported on x86 QEMU target.

Signed-off-by: Ville Ilvonen <ville.ilvonen@unikie.com>
* documented the proposal for minimal host based on
  the design target for host with minimal TCB

Signed-off-by: Ville Ilvonen <ville.ilvonen@unikie.com>
Copy link
Collaborator

@brianmcgillion brianmcgillion left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this really the minimal we want? This is minimal for a generic headless device, I envisaged us creating minimal-minimal.nix, or barely-enough-to-boot.nix profiles, which we could contribute back.

@vilvo
Copy link
Contributor Author

vilvo commented Jan 12, 2023

Is this really the minimal we want? This is minimal for a generic headless device, I envisaged us creating minimal-minimal.nix, or barely-enough-to-boot.nix profiles, which we could contribute back.

This is only an iteration towards that target most_minimal+hardened with testing of the profile import on NVIDIA Orin AGX target. There's hardened profile already in Nix but I did not dare to propose that yet as I'm expecting hardened-profile to break more.

Not sure if you noticed the other commit message on details of reducing the image size and # packages. That would give already some benefits for early development from this iteration.

* Use NixOS minimal profile on host instead of default
  to match the design target of minimal trusted computing
  base (TCB).
* Metrics on nvidia-jetson-orin:
  * reduces the image size and root-partition used size
    with 500M from 4.2G to 3.5G and 2.6G to 2.1G respectively
  * Number of pkgs in /nix/store from 707 t0 526
* Numbers not seen on x86 VM target as the nix-store of the
  host is mounted to the VM. Not imported on x86 QEMU target.

Given this is only a minimal iteration towards the target we have options of:

  • taking this into use early (merge) and enable other profiles for other development needs with additional build targets
  • postpone this PR, continue analysis of extra content in minimal profile and based on that continue development of the most_minimal+hardened-profile we could contribute back.

@vilvo vilvo mentioned this pull request Jan 13, 2023
@vilvo vilvo closed this Jan 13, 2023
@vilvo vilvo deleted the host_minimal_profile branch January 13, 2023 11:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants