3 ms·
Docker does not give you a reproducible builds - it 100% depends on a host platform.
by notyourday 7y ago
Docker does not give you a reproducible builds - it 100% depends on a host platform.
- progval 7y agoAlso, any Dockerfile that downloads something that might be updated (especially package managers, but also any wget/curl/... that doesn't check against a hardcoded hash) isn't reproducible at all.
- 2ion 7y agoRecently somebody showed me their sophisticated Docker file that was supposed to build a Maven project "in a reproducible way". When you ran it it spent 5 minutes downloading a bazillion files from the internet…no prior information on the content of those files was on the system. If the content of version X of a dependency changed in the meantime, you'd never know.