4 ms·

You're not wrong, but Docker comes at it from a different angle; Docker expects you to be handing around tagged images, to solve a similar set (but not the same

by girvo 10y ago

You're not wrong, but Docker comes at it from a different angle; Docker expects you to be handing around tagged images, to solve a similar set (but not the same set!) of problems that reproducible builds solve. Ideally, I want _both_ of them: tagged Docker images being sent between environments (with `docker run -e SOME_ENV=testing imagename` for changing the internal config), but reproducible builds in my Dockerfile. I wonder if Nix can be used to achieve that last part?

ramblenode 10y ago
Yes, you can do this. There is a utility "nix-docker" that will convert a Nix configuration file into a BusyBox Docker image (see e.g. http://zef.me/blog/6049/nix-docker http://zef.me/blog/6049/nix-docker)
- girvo 10y ago
  Oh brilliant! Thanks for that, definitely going to give that a shot :)
- mateuszf 10y ago
  Unfortunately the repo says: > DISCLAIMER: This project is no longer actively maintained and probably broken
- rokgarbas 10y ago
  with nix you can now build docker images ... docs are in the manual http://nixos.org/nixpkgs/manual/#sec-pkgs-dockerTools http://nixos.org/nixpkgs/manual/#sec-pkgs-dockerTools and it is actually rather cool since you don't rely on any docker command :)
xyzzy_plugh 10y ago
The problem is tagged images are fundamentally broken. If I can't reproduce, bit-for-bit, what is in the tag, how can I vouch for the tag? Images are nothing but a caching technique for the results of deterministic builds. If you're using them for any other reason, you have a flawed process that is going to come back to bite you some day.
- ecnahc515 10y ago
  You solve it by signing the image. Sometimes you just won't be able to get a completely reproducible build processes that's fully deterministic, so Nix cannot fix this problem entirely. Additionally, sometimes you just don't have time, or experience to take another program/tool you didn't write and package it up such that it never downloads things from the internet. It's a hard problem to solve, and Nix helps a lot, but it's not going to fix all the problems, which is why we should care more about trusting the packager to package something relatively reproducible and sign it so that we it can be vouched for.

by girvo 10y ago

ramblenode 10y ago

Yes, you can do this. There is a utility "nix-docker" that will convert a Nix configuration file into a BusyBox Docker image (see e.g. http://zef.me/blog/6049/nix-docker http://zef.me/blog/6049/nix-docker)

girvo 10y ago
Oh brilliant! Thanks for that, definitely going to give that a shot :)
mateuszf 10y ago
Unfortunately the repo says: > DISCLAIMER: This project is no longer actively maintained and probably broken
rokgarbas 10y ago
with nix you can now build docker images ... docs are in the manual http://nixos.org/nixpkgs/manual/#sec-pkgs-dockerTools http://nixos.org/nixpkgs/manual/#sec-pkgs-dockerTools and it is actually rather cool since you don't rely on any docker command :)

xyzzy_plugh 10y ago

The problem is tagged images are fundamentally broken. If I can't reproduce, bit-for-bit, what is in the tag, how can I vouch for the tag? Images are nothing but a caching technique for the results of deterministic builds. If you're using them for any other reason, you have a flawed process that is going to come back to bite you some day.

ecnahc515 10y ago
You solve it by signing the image. Sometimes you just won't be able to get a completely reproducible build processes that's fully deterministic, so Nix cannot fix this problem entirely. Additionally, sometimes you just don't have time, or experience to take another program/tool you didn't write and package it up such that it never downloads things from the internet. It's a hard problem to solve, and Nix helps a lot, but it's not going to fix all the problems, which is why we should care more about trusting the packager to package something relatively reproducible and sign it so that we it can be vouched for.