4 ms·

I'm not a Haskell developer nor Nix user, but I find Docker is surprisingly convenient, if only for its immutable layers file & build system: as I test differe

I'm not a Haskell developer nor Nix user, but I find Docker is surprisingly convenient, if only for its immutable layers file & build system: as I test different packages, I only pay for what's changed or removed, not the full setup. For example, for a C library, you might start with RUN apt install -y build-essential RUN apt install -y libopenssl-dev RUN cd src && ./configure but if libopenssl-dev is the wrong package, change that line, and rebuild, and the build-essential installation isn't redone, only what's change and subsequent lines. Any sort of snapshotting at file system level (e.g. ZFS) would do the job as well, but Docker puts it together in a convenient way. I guess Nix is better by using a DAG, but it's probably more complicated and harder the reason about (at least for those of us lacking in headspace).

willtim 9y ago
Those docker commands will install whatever binaries happen to be in the repository at the time they were run. Nix offers deterministic reproducible builds. A non-deterministic build is much harder to reason about.
bennofs 9y ago
Docker is a nice runtime, but you cannot reproduce the build of a docker container. What if you want to make a small change to the image? You need to rebuild it, but if it's years later, the versions of packages in the ubuntu repository may have changed and a lot of other things (if you're not careful, tarballs downloaded during the building of the image may have disappeared/changed/...). While you can try to avoid these through careful scripting and pinning things, this is what Nix makes really easy: just pin your nixpkgs version, and you can almost guarrante that you'll get the exact same build years later and you can still change parts of it if you need to.
- jrs95 9y ago
  Could reproducible Docker builds be achieved through adding Nix, then? Maybe that really ought to be the best practice for people doing this on a large scale.
  - willtim 9y ago
    Absolutely! From my point-of-view, Nix is complementary to Docker. Nix is a deterministic replacement for the apt-get commands used in the parent post.
  - Filligree 9y ago
    It already has all the needed infrastructure, in fact. See for example http://lethalman.blogspot.ie/2016/04/cheap-docker-images-with-nix_15.html http://lethalman.blogspot.ie/2016/04/cheap-docker-images-wit...
- notmymain 9y ago
  > Docker is a nice runtime, but you cannot reproduce the build of a docker container This is a common misconception but there's plenty of info out there if you want to find out how to do it. https://duckduckgo.com/?q=reproducible+builds+in+docker&atb=v88-6_g&ia=web https://duckduckgo.com/?q=reproducible+builds+in+docker&atb=... In essence, you can make reproducible builds in docker by controlling the build environment and then specifying particlar versions when installing dependencies. It's a bit more work but it's eminently doable. You control the build environment by building your reproducible docker containers within an environment (eg a reproducible docker container) that is itself reproducible (ie with specified versions of everything). This seems like a bootstrapping problem, but actually it works. So: 1. Make a "Build container" with a specified base image version and specified versions of the transitive deps of everything it needs to build your thing 2. Use this container to build your actual container, specifiying a version of the base image and all dependencies. Pretty sure you don't need more than these two layers of the onion to make bitwise-identical builds as long as your package build recipe is itself reproducible (eg the toolchain supports it and you don't do anything like embedding timestamps etc in the binaries). Package managers provide mechanisms to get the version list in force so generally the way to do this is to start with your preferred base image, install all the packages you want/need, use the package manager to give you the version list, then change the Dockerfile to install specifically those versions.
  - willtim 9y ago
    > In essence, you can make reproducible builds in docker by controlling the build environment and then specifying particular versions when installing dependencies. Nix would be an excellent way to achieve this.
    - Filligree 9y ago
      Nixpkgs has a function for creating Docker images as derivations, in fact.
- Filligree 9y ago
  > Just pin your nixpkgs version, and you can almost guarrante that you'll get the exact same build years later and you can still change parts of it if you need to. In theory. In practice, anything that doesn't hit the NixOS cache server will likely have been removed; it doesn't cache the build inputs, and links break all the time. On smaller timescales it's brilliant, though.
ris 9y ago
> but it's probably more complicated and harder the reason about Absolutely not. It's made far easier to reason about through the fact that all of its features are exposed through a pure-functional language, giving the reader the ability to reason about each expression inside each level of brackets individually. It's extremely freeing reasoning about code once you realize you can rule out side effects.

willtim 9y ago

Those docker commands will install whatever binaries happen to be in the repository at the time they were run. Nix offers deterministic reproducible builds. A non-deterministic build is much harder to reason about.

bennofs 9y ago

Docker is a nice runtime, but you cannot reproduce the build of a docker container. What if you want to make a small change to the image? You need to rebuild it, but if it's years later, the versions of packages in the ubuntu repository may have changed and a lot of other things (if you're not careful, tarballs downloaded during the building of the image may have disappeared/changed/...). While you can try to avoid these through careful scripting and pinning things, this is what Nix makes really easy: just pin your nixpkgs version, and you can almost guarrante that you'll get the exact same build years later and you can still change parts of it if you need to.

jrs95 9y ago
Could reproducible Docker builds be achieved through adding Nix, then? Maybe that really ought to be the best practice for people doing this on a large scale.
- willtim 9y ago
  Absolutely! From my point-of-view, Nix is complementary to Docker. Nix is a deterministic replacement for the apt-get commands used in the parent post.
- Filligree 9y ago
  It already has all the needed infrastructure, in fact. See for example http://lethalman.blogspot.ie/2016/04/cheap-docker-images-with-nix_15.html http://lethalman.blogspot.ie/2016/04/cheap-docker-images-wit...
notmymain 9y ago
> Docker is a nice runtime, but you cannot reproduce the build of a docker container This is a common misconception but there's plenty of info out there if you want to find out how to do it. https://duckduckgo.com/?q=reproducible+builds+in+docker&atb=v88-6_g&ia=web https://duckduckgo.com/?q=reproducible+builds+in+docker&atb=... In essence, you can make reproducible builds in docker by controlling the build environment and then specifying particlar versions when installing dependencies. It's a bit more work but it's eminently doable. You control the build environment by building your reproducible docker containers within an environment (eg a reproducible docker container) that is itself reproducible (ie with specified versions of everything). This seems like a bootstrapping problem, but actually it works. So: 1. Make a "Build container" with a specified base image version and specified versions of the transitive deps of everything it needs to build your thing 2. Use this container to build your actual container, specifiying a version of the base image and all dependencies. Pretty sure you don't need more than these two layers of the onion to make bitwise-identical builds as long as your package build recipe is itself reproducible (eg the toolchain supports it and you don't do anything like embedding timestamps etc in the binaries). Package managers provide mechanisms to get the version list in force so generally the way to do this is to start with your preferred base image, install all the packages you want/need, use the package manager to give you the version list, then change the Dockerfile to install specifically those versions.
- willtim 9y ago
  > In essence, you can make reproducible builds in docker by controlling the build environment and then specifying particular versions when installing dependencies. Nix would be an excellent way to achieve this.
  - Filligree 9y ago
    Nixpkgs has a function for creating Docker images as derivations, in fact.
Filligree 9y ago
> Just pin your nixpkgs version, and you can almost guarrante that you'll get the exact same build years later and you can still change parts of it if you need to. In theory. In practice, anything that doesn't hit the NixOS cache server will likely have been removed; it doesn't cache the build inputs, and links break all the time. On smaller timescales it's brilliant, though.

ris 9y ago

> but it's probably more complicated and harder the reason about Absolutely not. It's made far easier to reason about through the fact that all of its features are exposed through a pure-functional language, giving the reader the ability to reason about each expression inside each level of brackets individually. It's extremely freeing reasoning about code once you realize you can rule out side effects.