6 ms·

I honestly don't understand this sentiment (other than shamelessly plugging your posts, which is ok). The tradeoff in any packaging mechanism is always "pin ev

by avip 7y ago

I honestly don't understand this sentiment (other than shamelessly plugging your posts, which is ok). The tradeoff in any packaging mechanism is always "pin everything to the byte" for maximum security and minimum updateability vs. "blindly update to latest without thinking". We normally develop with the second and deploy using the first and docker is no different.

itamarst 7y ago
This isn't really about "getting the latest version", it's about "getting the latest security patches for a stable version." The presumption here is that you're running on a stable base image, Debian Stable or Ubuntu LTS or something. Updates to system packages are therefore basically focused on security fixes and severe bug fixes (data corruption in a database, say). Even if you're pinning everything very specifically (and you probably should), you still want to at some point get these (severe-bugfix-only) updates on a regular basis for security and operational reasons. Blind reliance on caching prevents this from happening.
- geezerjay 7y ago
  > This isn't really about "getting the latest version", it's about "getting the latest security patches for a stable version." Typically security patches trigger new releases with minor/patch version number bumps, which are then installed by getting the latest version of the package. That's pretty much the SOP of any linux distribution.