4 ms·

I get the comparison to nix and all, but docker does a heck of a lot more than reproducible builds and dependency management. It’s also a way to formalize netwo

by lukevp 6y ago

I get the comparison to nix and all, but docker does a heck of a lot more than reproducible builds and dependency management. It’s also a way to formalize network and other resource access, Perform local dns, automatically control the lifecycle of apps, control logging, etc. the dependencies is just one part. I appreciate the design goals of the developer as presented here, since simpler programs also tend to perform better and have fewer bugs. The whole dependency management issue is fascinating to read about. I just run everything in docker on Linux and use yum or apt for native bootstrapping of the device (os level firewall, docker, git, Fail2ban, and a couple others). Do people who mostly use containers thru docker or kubernetes find themselves in need of more sophisticated package managers than those built in to the OS?

sneak 6y ago
In my experience, most Docker builds are not reproducible, for the generally accepted definition of “produces a build artifact with the same hash”.
- lukevp 6y ago
  That’s a valid point and I’ll consider this terminology more carefully in the future. I think a better description might be “transportable?” By that I mean that a specific commit to master builds a container one time with a corresponding tag in our registry, so that exact artifact is versioned and stored, and can then be run and rerun forever more, just as it was built. That’s how we promote releases through qa, staging and to prod and ensure we know what we’re releasing. But it doesn’t have much to do with reproducible builds.
- solarkraft 6y ago
  Right, they're not exactly reproducible (and real reproducibility is much cooler), but images solve the main use case (having a clearly defined state) almost as well, at a generally much lower cost.
maxmcd 6y ago
Yes. Docker builds are not reproduceable. Build steps that define final image layers and also cache layers means that every dockerfile is a compromise towards either goal. Build inputs are "whatever happens to be on the filesystem" and "whatever happens to come down from the network". You can put process around this, but dockerfiles are working against you. Docker builds are a great tool, a great improvement, and what portability! But I personally think you'll look back on docker builds in 4 years and see them as extremely limited.
andrewchambers 6y ago
I generally have a dislike of the way docker ships binary artifacts you can't build yourself. That being said, I think hermes could be used to build docker containers and they can work well together.

by lukevp 6y ago

sneak 6y ago

In my experience, most Docker builds are not reproducible, for the generally accepted definition of “produces a build artifact with the same hash”.

lukevp 6y ago
That’s a valid point and I’ll consider this terminology more carefully in the future. I think a better description might be “transportable?” By that I mean that a specific commit to master builds a container one time with a corresponding tag in our registry, so that exact artifact is versioned and stored, and can then be run and rerun forever more, just as it was built. That’s how we promote releases through qa, staging and to prod and ensure we know what we’re releasing. But it doesn’t have much to do with reproducible builds.
solarkraft 6y ago
Right, they're not exactly reproducible (and real reproducibility is much cooler), but images solve the main use case (having a clearly defined state) almost as well, at a generally much lower cost.

maxmcd 6y ago

Yes. Docker builds are not reproduceable. Build steps that define final image layers and also cache layers means that every dockerfile is a compromise towards either goal. Build inputs are "whatever happens to be on the filesystem" and "whatever happens to come down from the network". You can put process around this, but dockerfiles are working against you. Docker builds are a great tool, a great improvement, and what portability! But I personally think you'll look back on docker builds in 4 years and see them as extremely limited.

andrewchambers 6y ago

I generally have a dislike of the way docker ships binary artifacts you can't build yourself. That being said, I think hermes could be used to build docker containers and they can work well together.