2 ms·
Also, any Dockerfile that downloads something that might be updated (especially package managers, but also any wget/curl/... that doesn't check against a hardco
by progval 7y ago
Also, any Dockerfile that downloads something that might be updated (especially package managers, but also any wget/curl/... that doesn't check against a hardcoded hash) isn't reproducible at all.
- 2ion 7y agoRecently somebody showed me their sophisticated Docker file that was supposed to build a Maven project "in a reproducible way". When you ran it it spent 5 minutes downloading a bazillion files from the internet…no prior information on the content of those files was on the system. If the content of version X of a dependency changed in the meantime, you'd never know.