{"guid":"fde36d11-94c7-5285-a3f4-8f6b61805b09","title":"A terminal for operating clouds: administering S3NS with image-based NixOS","subtitle":null,"slug":"all-systems-go-2025-357-a-terminal-for-operating-clouds-administering-s3ns-with-image-based-nixos","link":"https://cfp.all-systems-go.io/all-systems-go-2025/talk/TBDBDA/","description":"S3NS is a trusted cloud operator that self-hosts Google Cloud infrastructure in France, targeting the SecNumCloud certification, the most stringent Cloud certification framework. SecNumCloud includes strict legal and operational constraints. \n\nTo manage these systems securely and reproducibly, we’ve built a family of dedicated administration terminals based on the image based philosophy. \n\nThese terminals rely on NixOS semantics and draw from the ParticleOS ecosystem: systemd-repart, and dm-verity, ensuring atomic updates, full immutability of the Nix store, and verifiable integrity of the boot chain and runtime system (measured boot), while using remote attestations by TPM2 when connecting to production assets.\n\nWe will present the purpose of these terminals and what needs they serve along with their high level characteristics: partition layouts, provisioning and connection flow to the production assets.\n\nThis talk will show an application of many of the concepts that were presented in the NixOS ecosystem and in All Systems Go itself by the systemd community.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Ryan Lahfa","Frederic Ruget","Gautier LABADIE"],"view_count":116,"promoted":false,"date":"2025-10-01T16:00:00.000+02:00","release_date":"2025-10-01T00:00:00.000+02:00","updated_at":"2026-04-24T10:00:04.462+02:00","tags":["357","2025","asg2025","Galerie","asg2025-eng","asg2025","Day 2"],"length":2094,"duration":2094,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2025/357-fde36d11-94c7-5285-a3f4-8f6b61805b09.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2025/357-fde36d11-94c7-5285-a3f4-8f6b61805b09_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2025/357-fde36d11-94c7-5285-a3f4-8f6b61805b09.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2025/357-fde36d11-94c7-5285-a3f4-8f6b61805b09.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2025-357-a-terminal-for-operating-clouds-administering-s3ns-with-image-based-nixos","url":"https://api.media.ccc.de/public/events/fde36d11-94c7-5285-a3f4-8f6b61805b09","conference_title":"All Systems Go! 2025","conference_url":"https://api.media.ccc.de/public/conferences/asg2025","related":[],"recordings":[{"size":174,"length":2094,"mime_type":"video/webm;codecs=av01","language":"eng","filename":"asg2025-357-eng-A_terminal_for_operating_clouds_administering_S3NS_with_image-based_NixOS_av1-hd.webm","state":"new","folder":"av1-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2025-10-01T17:18:05.899+02:00","recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2025/av1-hd/asg2025-357-eng-A_terminal_for_operating_clouds_administering_S3NS_with_image-based_NixOS_av1-hd.webm","url":"https://api.media.ccc.de/public/recordings/91947","event_url":"https://api.media.ccc.de/public/events/fde36d11-94c7-5285-a3f4-8f6b61805b09","conference_url":"https://api.media.ccc.de/public/conferences/asg2025"},{"size":31,"length":2094,"mime_type":"audio/mpeg","language":"eng","filename":"asg2025-357-eng-A_terminal_for_operating_clouds_administering_S3NS_with_image-based_NixOS_mp3.mp3","state":"new","folder":"mp3","high_quality":false,"width":0,"height":0,"updated_at":"2025-10-01T17:11:20.848+02:00","recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2025/mp3/asg2025-357-eng-A_terminal_for_operating_clouds_administering_S3NS_with_image-based_NixOS_mp3.mp3","url":"https://api.media.ccc.de/public/recordings/91944","event_url":"https://api.media.ccc.de/public/events/fde36d11-94c7-5285-a3f4-8f6b61805b09","conference_url":"https://api.media.ccc.de/public/conferences/asg2025"},{"size":19,"length":2094,"mime_type":"audio/opus","language":"eng","filename":"asg2025-357-eng-A_terminal_for_operating_clouds_administering_S3NS_with_image-based_NixOS_opus.opus","state":"new","folder":"opus","high_quality":false,"width":0,"height":0,"updated_at":"2025-10-01T17:11:16.917+02:00","recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2025/opus/asg2025-357-eng-A_terminal_for_operating_clouds_administering_S3NS_with_image-based_NixOS_opus.opus","url":"https://api.media.ccc.de/public/recordings/91943","event_url":"https://api.media.ccc.de/public/events/fde36d11-94c7-5285-a3f4-8f6b61805b09","conference_url":"https://api.media.ccc.de/public/conferences/asg2025"},{"size":205,"length":2094,"mime_type":"video/webm","language":"eng","filename":"asg2025-357-eng-A_terminal_for_operating_clouds_administering_S3NS_with_image-based_NixOS_webm-hd.webm","state":"new","folder":"webm-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2025-10-01T17:36:23.151+02:00","recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2025/webm-hd/asg2025-357-eng-A_terminal_for_operating_clouds_administering_S3NS_with_image-based_NixOS_webm-hd.webm","url":"https://api.media.ccc.de/public/recordings/91953","event_url":"https://api.media.ccc.de/public/events/fde36d11-94c7-5285-a3f4-8f6b61805b09","conference_url":"https://api.media.ccc.de/public/conferences/asg2025"},{"size":77,"length":2094,"mime_type":"video/webm","language":"eng","filename":"asg2025-357-eng-A_terminal_for_operating_clouds_administering_S3NS_with_image-based_NixOS_webm-sd.webm","state":"new","folder":"webm-sd","high_quality":false,"width":720,"height":576,"updated_at":"2025-10-01T17:33:03.756+02:00","recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2025/webm-sd/asg2025-357-eng-A_terminal_for_operating_clouds_administering_S3NS_with_image-based_NixOS_webm-sd.webm","url":"https://api.media.ccc.de/public/recordings/91952","event_url":"https://api.media.ccc.de/public/events/fde36d11-94c7-5285-a3f4-8f6b61805b09","conference_url":"https://api.media.ccc.de/public/conferences/asg2025"},{"size":69,"length":2094,"mime_type":"video/mp4","language":"eng","filename":"asg2025-357-eng-A_terminal_for_operating_clouds_administering_S3NS_with_image-based_NixOS_sd.mp4","state":"new","folder":"h264-sd","high_quality":false,"width":720,"height":576,"updated_at":"2025-10-01T17:15:49.953+02:00","recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2025/h264-sd/asg2025-357-eng-A_terminal_for_operating_clouds_administering_S3NS_with_image-based_NixOS_sd.mp4","url":"https://api.media.ccc.de/public/recordings/91946","event_url":"https://api.media.ccc.de/public/events/fde36d11-94c7-5285-a3f4-8f6b61805b09","conference_url":"https://api.media.ccc.de/public/conferences/asg2025"},{"size":217,"length":2094,"mime_type":"video/mp4","language":"eng","filename":"asg2025-357-eng-A_terminal_for_operating_clouds_administering_S3NS_with_image-based_NixOS_hd.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2025-10-01T17:08:52.761+02:00","recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2025/h264-hd/asg2025-357-eng-A_terminal_for_operating_clouds_administering_S3NS_with_image-based_NixOS_hd.mp4","url":"https://api.media.ccc.de/public/recordings/91942","event_url":"https://api.media.ccc.de/public/events/fde36d11-94c7-5285-a3f4-8f6b61805b09","conference_url":"https://api.media.ccc.de/public/conferences/asg2025"}]}