Makes

Rationale

We use Makes to easily create reproducible tasks for any programming language and system architecture. Makes allows the following:

Build environments for all our products (Python, TypeScript, Terraform, Go, Cue, Kotlin, etc.)
Build CI/CD flows (build, test, deploy, etc.)
Run such environments/flows locally for development experience
Ensure such environments/flow are reproducible by using cryptography (SHA256)
Build composable systems, where bigger components can reuse logic from smaller ones

Alternatives

Makes was initially built to provide a Nix-based tool for easily distributing software. We could not find anything similar at the time, so we decided to build it ourselves. Years later, several similar solutions have appeared. Below are the ones we have reviewed, ordered from most to least interesting based on our specific needs.

Nix + Flakes

Nix + Flakes allows creating modular and reproducible packages or environments for any programming language and system architecture.
It does not do anything else besides providing building blocks for fulfilling the above purpose.
It provides standard interfaces for declaring inputs and outputs for a given piece of software.
It embraces pure Nix, meaning that modularity and overall flexibility are greater, but learning curve is also higher.
It has first-class-level support implementations for all our current programming languages.
It supports declarative configurations for language-specific package managers like uv and npm.
It does not provide out-of-the-box declarative support for external services.
It supports fully cryptographically-signed environments for security and reproducibility.
It can be easily integrated into Cachix for performance.
It provides garbage collection support for easily cleaning up disk space.
It supports automatic shell activation via nix-direnv for development experience.
Being pure Nix, it has the biggest community and excellent support.

Flakes + Nix was last reviewed on Mar 31, 2025.

devenv

devenv provides a Nix wrapper for creating reproducible environments for any programming language and system architecture.
It only provides development environments, meaning that reproducibility and modularity are highly affected.
It does not provide standard interfaces for declaring inputs and outputs for a given piece of software.
Its interfaces are similar to Makes's, considerably decreasing its learning curve for us.
It has out-of-the-box declarative support for all our current programming languages.
It supports declarative configurations for language-specific package managers like Poetry and npm.
It provides out-of-the-box declarative support for a considerable list of services like DynamoDB, OpenSearch, Nginx, among others.
It supports fully cryptographically-signed environments for security and reproducibility.
It has Cachix support for performance.
It provides garbage collection support for easily cleaning up disk space.
It supports automatic shell activation for development experience.
Being a Nix wrapper, its community is smaller and support not as good.

devenv was last reviewed on Jan 27, 2025.

Devbox

Devbox provides a Nix wrapper for creating reproducible tasks for any programming language and system architecture.
It does not do anything else besides providing building blocks for fulfilling the above purpose. It is less flexible compared to Nix + Flakes, Makes, and devenv.
It does not provide standard interfaces for declaring inputs and outputs for a given piece of software.
Its interfaces try to fully abstract Nix with JSON, making it less flexible but also making it way simpler.
It has out-of-the-box declarative support for all our current programming languages.
It supports declarative configurations for language-specific package managers like Poetry and npm.
It provides out-of-the-box declarative support for a small list of services, although most of them are currently not relevant to our needs.
It supports fully cryptographically-signed environments for security and reproducibility.
It provides its own cache for performance. This would increase the learning curve for us, as we already know Cachix.
It does not provide any information regarding garbage collection.
It supports automatic shell activation for development experience.
Being a Nix wrapper, its community is smaller and support not as good.

Devbox was last reviewed on Jan 27, 2025.

Flox

Flox provides a Nix wrapper for creating reproducible tasks for any programming language and system architecture.
It does not do anything else besides providing building blocks for fulfilling the above purpose. It is less flexible compared to Nix + Flakes, Makes, and devenv.
It does not provide standard interfaces for declaring inputs and outputs for a given piece of software.
Its interfaces try to fully abstract Nix with a self-made approach, making it less flexible and increasing its learning curve for us.
It does not have support for any programming language, forcing users to approach configurations in a procedural way.
It does not support any language-specific package managers, forcing users to approach configurations in a procedural way.
It does not provide support for any services, forcing users to approach configurations in a procedural way.
It does not seem to provide a way for pinning environments, making them unstable.
It does not support Cachix but instead uses FloxHub, increasing the learning curve for us.
It does not provide any information regarding garbage collection.
It does not provide any information regarding automatic shell activation.
Being a Nix wrapper, its community is smaller and support not as good.

Flox was last reviewed on Jan 27, 2025.

Usage

We use Makes for serving all of Fluid Attacks' software.

Guidelines

Please refer to the official Makes documentation.

Installing Makes

Make sure that Nix is installed on your system.
Follow the steps at the official Makes documentation.

Using Makes

You can build and run the components of your choice, for example:

m gitlab:fluidattacks/universe@trunk /forces --help

m gitlab:fluidattacks/universe@trunk /melts --help

m gitlab:fluidattacks/universe@trunk /reviews --help

m gitlab:fluidattacks/universe@trunk /skims --help

Updates

You can update Makes by installing it again, but from a higher version.

In order to update the components installed with Makes no action is required on your part, updates are automatically rolled out to your machine with a delay of at most one day. However, if you want to force an update right away, just run rm -rf ~/.cache/makes, or reference an specific commit instead of @trunk.

Troubleshooting

General considerations

A stable internet connection is required
A stable DNS resolver is required. Please consider using the following:
- IPv4: 1.1.1.1, 8.8.8.8, 8.8.4.4
- IPv6: 2001:4860:4860::8888, 2001:4860:4860::8844

Checklist

If the installation failed while installing Nix,
1. checkout the Nix manual for more detailed installation instructions, and
2. if the problem persists, please let us know at help@fluidattacks.com.
If the installation failed while installing Makes, please let us know at help@fluidattacks.com.
If the process failed while using m gitlab:xxx /yyy,
1. repeat the installation of Makes and try again,
2. refresh the cache with rm -rf ~/.cache/makes and try again, and
3. if the problem persists, please let us know at help@fluidattacks.com.

Free trial

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.

Makes | Stack | Fluid Attacks Help