5 ms·

Absolutely. Most Dockerfiles I come across are very much not written in a robustly reproducible way. The stacking filesystems model is really not very flexible

by ris 6y ago

Absolutely. Most Dockerfiles I come across are very much not written in a robustly reproducible way. The stacking filesystems model is really not very flexible (if you want to compose two docker images with dissimilar bases to be used together you have to resort to manually specifying which files to copy across from each base). Use of OS features to achieve its ends means the docker daemon itself requires far more privileges than I'm comfortable with and makes weirdness like docker-in-docker necessary...

mikepurvis 6y ago
Yeah, any Docker file that starts with `apt update; apt dist-upgrade` is an instant fail. You might be interested in this fascinating exploration of attempting to bend Docker into better caching and composition by injecting blocks of Nix packages as individual layers: https://grahamc.com/blog/nix-and-layered-docker-images https://grahamc.com/blog/nix-and-layered-docker-images
- jrockway 6y ago
  I think the base images that are commonly used are just as bad; likely some random snapshot of upstream repositories at arbitrary times. You can refer to the sha256 of base images to avoid things changing, but I've never seen anyone do that. (The advice is "never use 'latest' because that could change out from under you", but other tags are just as mutable, and so that isn't real advice. You can follow the advice and have something just as bad happen.) The thing the upstream Linux distributions are missing are a lockfile with the hashes of installed packages. Programming languages figured this out (go.sum, package-lock.json, etc.) but distributions have not. Thus, people are often running "whatever" in production, because they simply don't have the ability to lock dependencies properly. I assume Nix solves this problem, and people should pay attention to how important it actually is.
  - eptcyka 6y ago
    In production, the companies I work with certainly do rely on SHA256 checksums to specify the base images.
    - jrockway 6y ago
      Do they just build their own images for open source things? I have never seen a dockerfile that does that.
      - eptcyka 6y ago
        Yep.
akhilcacharya 6y ago
Honestly given how little reproducibility there is in like 80% of the Dockerfiles I've seen in the wild it astounds me how this became a solution for packaging at all. Are solutions like source2image, jib, or the nix dockerTools.buildImage method gaining steam?

by ris 6y ago

mikepurvis 6y ago

Yeah, any Docker file that starts with `apt update; apt dist-upgrade` is an instant fail. You might be interested in this fascinating exploration of attempting to bend Docker into better caching and composition by injecting blocks of Nix packages as individual layers: https://grahamc.com/blog/nix-and-layered-docker-images https://grahamc.com/blog/nix-and-layered-docker-images

jrockway 6y ago
I think the base images that are commonly used are just as bad; likely some random snapshot of upstream repositories at arbitrary times. You can refer to the sha256 of base images to avoid things changing, but I've never seen anyone do that. (The advice is "never use 'latest' because that could change out from under you", but other tags are just as mutable, and so that isn't real advice. You can follow the advice and have something just as bad happen.) The thing the upstream Linux distributions are missing are a lockfile with the hashes of installed packages. Programming languages figured this out (go.sum, package-lock.json, etc.) but distributions have not. Thus, people are often running "whatever" in production, because they simply don't have the ability to lock dependencies properly. I assume Nix solves this problem, and people should pay attention to how important it actually is.
- eptcyka 6y ago
  In production, the companies I work with certainly do rely on SHA256 checksums to specify the base images.
  - jrockway 6y ago
    Do they just build their own images for open source things? I have never seen a dockerfile that does that.
    - eptcyka 6y ago
      Yep.

akhilcacharya 6y ago

Honestly given how little reproducibility there is in like 80% of the Dockerfiles I've seen in the wild it astounds me how this became a solution for packaging at all. Are solutions like source2image, jib, or the nix dockerTools.buildImage method gaining steam?