3 ms·

Hopefully etc/password is a bad example? Security issues aside, I feel like reading files that are configuration in nature are best done "at runtime" not compil

Hopefully etc/password is a bad example? Security issues aside, I feel like reading files that are configuration in nature are best done "at runtime" not compile time. Can you imagine the code that loads a configuration file directly into the code and the ops team unable to reconfigure things? That would be the epitome of "well it worked in MY build".

TheDong 8y ago
Note that `/etc/passwd` contains no passwords or other security sensitive stuff. You might be thinking of `/etc/shadow`. That is an example of something you might not actually want to do, though embedding a file from the code repository (e.g. as https://doc.rust-lang.org/std/macro.include_str.html https://doc.rust-lang.org/std/macro.include_str.html does in rust) is a reasonable and common thing to want to do at build time.
TheDong 8y ago
I'd also like to reply to the other half of your comment: > Can you imagine the code that loads a configuration file directly into the code and the ops team unable to reconfigure things? Yes! That's what code is, actually! Code is stuff you put in a file which can't be configured easily, but is thus consistent between all deployments of the software. It often actually makes it easier for a problem to be found and reproduced if configuration is baked into the binary vs varying based on the environment the code is run in. In a way, docker images are a means of statically compiling a bunch of random stuff (like /etc/passwd) into your application at build time to remove more environmental variables. Really, loading a configuration file into the binary statically at build time isn't much different from having `const SOME_VARIABLE = "some value"` in your source code... the only difference is how you, the programmer, chose to represent that constant. The line between "configuration" and "code constants" is very thin, so I don't think what you say is a sensible criticism.

TheDong 8y ago

Note that `/etc/passwd` contains no passwords or other security sensitive stuff. You might be thinking of `/etc/shadow`. That is an example of something you might not actually want to do, though embedding a file from the code repository (e.g. as https://doc.rust-lang.org/std/macro.include_str.html https://doc.rust-lang.org/std/macro.include_str.html does in rust) is a reasonable and common thing to want to do at build time.

TheDong 8y ago

I'd also like to reply to the other half of your comment: > Can you imagine the code that loads a configuration file directly into the code and the ops team unable to reconfigure things? Yes! That's what code is, actually! Code is stuff you put in a file which can't be configured easily, but is thus consistent between all deployments of the software. It often actually makes it easier for a problem to be found and reproduced if configuration is baked into the binary vs varying based on the environment the code is run in. In a way, docker images are a means of statically compiling a bunch of random stuff (like /etc/passwd) into your application at build time to remove more environmental variables. Really, loading a configuration file into the binary statically at build time isn't much different from having `const SOME_VARIABLE = "some value"` in your source code... the only difference is how you, the programmer, chose to represent that constant. The line between "configuration" and "code constants" is very thin, so I don't think what you say is a sensible criticism.