"OpenSSL is 500K lines of code. When an important update inevitably comes out for it, what happens? Are you now updating 10+ runtimes that are 1+ GB each? Do th

"OpenSSL is 500K lines of code. When an important update inevitably comes out for it, what happens? Are you now updating 10+ runtimes that are 1+ GB each? Do they use differential compression at all?" Yes. The images are being updated via snapshot (transparent to the user). Just as RPMs can currently be updated with delta RPMs. The Poettering blog post about it that someone linked in another thread is really helpful: http://0pointer.net/blog/revisiting-how-we-put-together-linux-systems.html http://0pointer.net/blog/revisiting-how-we-put-together-linu... It's not an amateur attempt at the problem. It may not be perfect (it probably is far from it for the next several years), but it does seem to have addressed the biggest issues in a reasonable way. We definitely need a way forward beyond the current generation of package managers; Nix has a really cool solution (and I would be happy with Nix getting more traction), and Guix does, too. Docker, on the other hand, which is the currently fashionable option for solving these problems, leaves a lot to be desired, and does fall prey to some of the concerns you raise.