3 ms·

>Getting repeatable docker images But there's no real need for repeatable build docker images. You copy the image and run it where ever you need to. The enti

by treis 5y ago

>Getting repeatable docker images But there's no real need for repeatable build docker images. You copy the image and run it where ever you need to. The entire point of Docker is to not have to repeat the build.

hinkley 5y ago
If you could explain that to the Docker team you would be performing a great humanitarian service. They for many years close issues and reject PRs based on the assertion that Dockerfile output needs to be repeatable (specifically, that the requested feature or PR makes it not repeatable). It’s not, it can’t be without a time machine, and if it was I believe you’d find that ace icing traction would have been more difficult, even impossible.
- treis 5y ago
  Do you have an example?
spion 5y ago
Until there is a critical vulnerability in one of the components present on that image (system packages or application packages).
- kronin 5y ago
  This is why I haven't adopted the practice of "Build your artifact along with the docker image that packages it". Instead, build your artifact and publish it to an artifact repository, just like we used to. _then_ wrap that artifact in a Docker image. Vulnerability found in the docker image? No problem. Build a new image with the same artifact.
  - barbazoo 5y ago
    I'm curious why you're being downvoted for this. Whoever disagrees, please share some context. What you said about "wrapping" I interpret as: based on an image for instance with OS level dependencies you create another image with application level artifacts, e.g. a python application. When your app changes, you don't build the base image again, you only build the app image. This makes sense to me.
- treis 5y ago
  At that point you're not repeating a build. You're building a new image.
  - spion 5y ago
    From that point on, the build may become "fully unrepeatable" because previous steps may have reused cached stuff that can no longer be reproduced. You could break the build simply by cleaning some things from the cache, without changing the Dockerfile, even thought that Dockerfile "succeeded to build"
convolvatron 5y ago
what happens when you need to create a new one with a small incremental change?

by treis 5y ago

hinkley 5y ago

If you could explain that to the Docker team you would be performing a great humanitarian service. They for many years close issues and reject PRs based on the assertion that Dockerfile output needs to be repeatable (specifically, that the requested feature or PR makes it not repeatable). It’s not, it can’t be without a time machine, and if it was I believe you’d find that ace icing traction would have been more difficult, even impossible.

treis 5y ago
Do you have an example?

spion 5y ago

Until there is a critical vulnerability in one of the components present on that image (system packages or application packages).

kronin 5y ago
This is why I haven't adopted the practice of "Build your artifact along with the docker image that packages it". Instead, build your artifact and publish it to an artifact repository, just like we used to. _then_ wrap that artifact in a Docker image. Vulnerability found in the docker image? No problem. Build a new image with the same artifact.
- barbazoo 5y ago
  I'm curious why you're being downvoted for this. Whoever disagrees, please share some context. What you said about "wrapping" I interpret as: based on an image for instance with OS level dependencies you create another image with application level artifacts, e.g. a python application. When your app changes, you don't build the base image again, you only build the app image. This makes sense to me.
treis 5y ago
At that point you're not repeating a build. You're building a new image.
- spion 5y ago
  From that point on, the build may become "fully unrepeatable" because previous steps may have reused cached stuff that can no longer be reproduced. You could break the build simply by cleaning some things from the cache, without changing the Dockerfile, even thought that Dockerfile "succeeded to build"

convolvatron 5y ago

what happens when you need to create a new one with a small incremental change?