3 ms·
I disagree, somewhat. Even at the highest application level developers should be concerned about their runtime dependencies. The bigger issues, imho, is that (d
by jonhohle 6y ago
I disagree, somewhat. Even at the highest application level developers should be concerned about their runtime dependencies. The bigger issues, imho, is that (docker at least) doesn’t make it easy to separate build vs runtime dependencies in any systematic way, and makes it very difficult to build minimal runtime images while providing access to developer tools during development. Bazel and Spring both have ways to address this, but they require knowledge of + _n_ tools on top of the native build too chain.
- mfer 6y agoIf I hear what you're saying right... you're saying that someone working in node.js should be concerned with the vulnerabilities in system libraries of the OS that node.js runs in. Bringing up Bazel to deal with system dependencies is going down the road of DevOps rather than Dev. Docker is pitched as Dev. A lot of them don't care about the lower level ops. There is something to be said for separation of concerns and targeting each concern well. Our current problems are because we're doing a poor job mixing concerns or even understanding the separation.
- jonhohle 6y agoNo, I’m saying for a node.js developer all of their dependencies affect how their applications work. If they can get away with a statically linked node binary and no other libraries, great!