3 ms·

Then have your Dockerfile build from source. Many of the public layers that people build their containers upon do that for that exact reason. If NixOS is only

Then have your Dockerfile build from source. Many of the public layers that people build their containers upon do that for that exact reason. If NixOS is only "generally speaking" correct because of the order it runs its scripts, then put it in a Docker container, where the whole point is to perfectly reproduce the order you run your scripts in order to minimize the errors that arise from doing otherwise. Still worried? That's why layers exist, so that every step you run you now have a static binary that you know will never shift under you, and that you can keep on building on top of.

smilliken 6y ago
In practice, building Dockerfiles is unreliable and can produce errors because they inherit all of the deficiencies of aptitude, python packaging, javascript packaging, et al. In practice, building nix dependencies is reliable and reproducible because of the militant isolation of build environments, hash integrity checks on _all_ inputs, explicit dependencies, and the long tail of bug fixes related to non-determinism in unix tooling. This is my personal experience, not abstract.
- jmchuster 6y ago
  That's a great a vote of confidence. I would've thought that nix would only manage packages on the OS-level. How does it re-implement pip to be reliable? I currently have to stage a couple of `apt-gets` and `pip installs` before my `pip install requirements`, and it took a couple of tries to lock in the right sequence that worked. How does nix solve those problems?
rudolph9 6y ago
Ha! I did this but the containers end up being somewhat large since you have all the NixOS package stuff in the container too. However, building the container from a configuration.nix file gives you exactly what you need in the container and nothing more. It's like basing your container from scratch in a Dockerfile and copying only the needed compiled dependencies and nothing more into the container.

smilliken 6y ago

In practice, building Dockerfiles is unreliable and can produce errors because they inherit all of the deficiencies of aptitude, python packaging, javascript packaging, et al. In practice, building nix dependencies is reliable and reproducible because of the militant isolation of build environments, hash integrity checks on _all_ inputs, explicit dependencies, and the long tail of bug fixes related to non-determinism in unix tooling. This is my personal experience, not abstract.

jmchuster 6y ago
That's a great a vote of confidence. I would've thought that nix would only manage packages on the OS-level. How does it re-implement pip to be reliable? I currently have to stage a couple of `apt-gets` and `pip installs` before my `pip install requirements`, and it took a couple of tries to lock in the right sequence that worked. How does nix solve those problems?

rudolph9 6y ago

Ha! I did this but the containers end up being somewhat large since you have all the NixOS package stuff in the container too. However, building the container from a configuration.nix file gives you exactly what you need in the container and nothing more. It's like basing your container from scratch in a Dockerfile and copying only the needed compiled dependencies and nothing more into the container.