4 ms·

If you consider the effort required for this, I always wonder how reproducible the things in Docker or NixOS really are.

by qznc 11y ago

bbrazil 11y ago
There's practically reproducible and completely reproducible. Let's say you had a bug, and are trying to see when it was introduced. Something like the compilation time printed in a log at startup you don't really care about, the versions of each part of your build chain and all dependencies are where your focus will be. This is easier to achieve.
- ubernostrum 11y ago
  Something like the compilation time printed in a log at startup you don't really care about Unless the compilation time is the source of the bug :)
davexunit 11y ago
Docker does nothing to improve reproducibility in the way that the Debian (and other) folks are using the term, which means "bit-identical builds". Nix, and likewise GNU Guix, already provide a great framework for enabling reproducible builds. In the Guix manual, we say that the builds are nearly reproducible because as Debian shows, there is still plenty of work to be done, but we do eliminate a lot of sources of nondeterminism already.
rlpb 11y ago
Docker is the opposite of reproducible. The idea is that you (as a user) have a known tested good image you can re-use it easily without having to worry about reproducibility (which is the responsibility of the other side - whoever is producing the images). If you could reproduce that environment easily and instantly, you wouldn't need Docker since you'd just reproduce it every time.
chriswarbo 11y ago
Debian wasn't built with reproducibility in mind, whilst NixOS was. "Backporting" features to existing systems is monotonically harder than building a new system with that feature, since we have more constraints. Even if, hypothetically, it were trivial for NixOS to obtain perfect reproducibility, that doesn't necessarily help with making Debian reproducible in a backwards-compatible way.
- zdw 11y ago
  Both kinds of work are useful, and cross pollination is likely possible - the issue list here is enlightening: https://reproducible.debian.net/index_issues.html https://reproducible.debian.net/index_issues.html Almost none of those things are debian specific - they're things like "the timestamp of when this was built is put in the documentation" or "the kernel version is put in the binary". Issues of those types would affect any OS and build system, and are would impact any system, even one with source purity goals like NixOS and similar.
- EmanueleAina 11y ago
  Honest question: is NixOS really doing reproducible builds, where you get byte-identical binaries when rebuilding from source? I only found this issue on the Tor tracker, and apparently NixOS does not produce reproducible builds in the same way as intended by Debian: https://trac.torproject.org/projects/tor/ticket/12520 https://trac.torproject.org/projects/tor/ticket/12520
  - chriswarbo 11y ago
    The aim is to have such reproducible builds, for example builds are always performed with the system clock set to 1 second after the Unix epoch. The reality varies from package to package; reproducibility problems are counted as bugs, but as always there's a cost/benefit decisions about fixing them.
dkubb 11y ago
For NixOS it looks like there was some work on reproducible builds, but it seems to have stalled: https://github.com/NixOS/nixpkgs/pull/2281 https://github.com/NixOS/nixpkgs/pull/2281

If you consider the effort required for this, I always wonder how reproducible the things in Docker or NixOS really are.

by qznc 11y ago

If you consider the effort required for this, I always wonder how reproducible the things in Docker or NixOS really are.

bbrazil 11y ago

There's practically reproducible and completely reproducible. Let's say you had a bug, and are trying to see when it was introduced. Something like the compilation time printed in a log at startup you don't really care about, the versions of each part of your build chain and all dependencies are where your focus will be. This is easier to achieve.

ubernostrum 11y ago
Something like the compilation time printed in a log at startup you don't really care about Unless the compilation time is the source of the bug :)

davexunit 11y ago

Docker does nothing to improve reproducibility in the way that the Debian (and other) folks are using the term, which means "bit-identical builds". Nix, and likewise GNU Guix, already provide a great framework for enabling reproducible builds. In the Guix manual, we say that the builds are nearly reproducible because as Debian shows, there is still plenty of work to be done, but we do eliminate a lot of sources of nondeterminism already.

rlpb 11y ago

Docker is the opposite of reproducible. The idea is that you (as a user) have a known tested good image you can re-use it easily without having to worry about reproducibility (which is the responsibility of the other side - whoever is producing the images). If you could reproduce that environment easily and instantly, you wouldn't need Docker since you'd just reproduce it every time.

chriswarbo 11y ago

Debian wasn't built with reproducibility in mind, whilst NixOS was. "Backporting" features to existing systems is monotonically harder than building a new system with that feature, since we have more constraints. Even if, hypothetically, it were trivial for NixOS to obtain perfect reproducibility, that doesn't necessarily help with making Debian reproducible in a backwards-compatible way.

zdw 11y ago
Both kinds of work are useful, and cross pollination is likely possible - the issue list here is enlightening: https://reproducible.debian.net/index_issues.html https://reproducible.debian.net/index_issues.html Almost none of those things are debian specific - they're things like "the timestamp of when this was built is put in the documentation" or "the kernel version is put in the binary". Issues of those types would affect any OS and build system, and are would impact any system, even one with source purity goals like NixOS and similar.
EmanueleAina 11y ago
Honest question: is NixOS really doing reproducible builds, where you get byte-identical binaries when rebuilding from source? I only found this issue on the Tor tracker, and apparently NixOS does not produce reproducible builds in the same way as intended by Debian: https://trac.torproject.org/projects/tor/ticket/12520 https://trac.torproject.org/projects/tor/ticket/12520
- chriswarbo 11y ago
  The aim is to have such reproducible builds, for example builds are always performed with the system clock set to 1 second after the Unix epoch. The reality varies from package to package; reproducibility problems are counted as bugs, but as always there's a cost/benefit decisions about fixing them.

dkubb 11y ago

For NixOS it looks like there was some work on reproducible builds, but it seems to have stalled: https://github.com/NixOS/nixpkgs/pull/2281 https://github.com/NixOS/nixpkgs/pull/2281