4 ms·

Indeed. Also, scripts (especially Dockerfiles) which run `apt-get install foo bar baz`; usually mixed in with a bunch of other commands, and file copying/editin

Indeed. Also, scripts (especially Dockerfiles) which run `apt-get install foo bar baz`; usually mixed in with a bunch of other commands, and file copying/editing. That's literally what package formats like .deb, .rpm, etc. are for! For example: - Write your dependencies in a `my-package/DEBIAN/control` file - If you want any extra files, put those in your `my-package/` folder too (e.g. `my-package/etc/some_config_file`, `my-package/usr/bin/some_executable`, etc.) - If you want to run other commands, you can write a `my-package/DEBIAN/preinst` and/or `my-package/DEBIAN/postinst` script - Run `dpkg-deb --build` to make your .deb file Voila! Using a declarative format gives us an uninstaller "for free", lets us query which version is installed, and the installation will notify us of any conflicting files. Packages also tend to be more robust across different machines/environments, and don't drag in a whole extra OS plus VM/container-manager/etc. More features are unlocked with a little extra specification, e.g. package conflicts (to avoid known-bad setups); dependency alternatives (e.g. prefer Caddy, accept Nginx, fall back to Apache); etc. I'm sure there are more quick-wins too, e.g. Googling gives me https://www.internalpointers.com/post/build-binary-deb-package-practical-guide https://www.internalpointers.com/post/build-binary-deb-packa... Disclaimer: Whilst I used to use Debian heavily (even on my phone!) I switched to Nix/NixOS about a decade ago, which I find even better. It's just infuriating to see the industry ignoring well crafted solutions, which have been around for decades, in favour of half-baked anti-patterns like Dockerfiles. Especially when the latter is often just a layer of crap on top of the former (like running `apt-get` in a script; rather than what it's designed for!)

noirscape 4y ago
The main issue when it comes to using Debian or most conventional package managers (nix really deserves its own mention there) is that you also pretty much distro lock your software, which may not be always beneficial. Another problem comes now in the form of distribution; packaging is one thing, distributing is another. Debian isn't too bad about this but depending on your choice of packager[0], you could suddenly need to spend another couple days trying to figure out how to even host the thing unless you want to spend time running wget on your production machines to pull in deb/RPM/makepkg output/pick your poison files. Nix deserves its own mention because while it pretty much singlehandedly tries to solve all major issues with dependency management, it also... does so by abandoning almost every assumption most people have about how the OS is supposed to work (not to mention that writing nix files is basically learning a whole new language which is... doable but not exactly accessible). It's definitely the stronger solution compared to dockerfiles, but you can translate any program for any distro into a dockerfile as long as it runs on your kernel (alongside the fact that a dockerfile is a really good way to deal with the "documentation abandoned 5 years ago, but it runs on Dave's machine if you follow the README and change about 50 different small settings in your OS" projects which are done a dozen with FOSS projects). Docker is a mess technically but when it comes to software you want to use/deploy but don't want to understand all the fine details of the source code, it is often a lot easier to work with compared to Nix, which if you have something not in nixpkgs, can result in you needing to start making upstream patches to genericize build directories and generally change peoples CI flows in ways maintainers don't necessarily appreciate. tldr; nix is good, docker is easy. [0] It's been a few years but the worst package distribution system I've had the displeasure to use are Ubuntu PPAs. It's a system close to the Debian specification but it requires a whole set of separate commands and weird signing steps before you can upload anything, none of which is properly documented because they expect people that want to use PPAs to shove it in a makefile, which isn't useful if you don't use a language that relies on Makefiles, but I digress.
- chriswarbo 4y ago
  I agree with most of what you're saying, although we're describing slightly different use cases. For example, using a .deb file is just as "distro locked" as the sort of "apt-get scripting" I was complaining about. It's pretty much a Pareto improvement to change a Dockerfile from `RUN apt-get install ...` to `RUN apt install ./my-package.deb` (we can construct the .deb wherever we like; outside the container, inside the container, in a separate container, etc.) As for Docker being "easy"... I suppose that's subjective. Personally, it's given me nothing but pain; from trying to get the damn thing installed, to trying to understand it (lots of documentation turns out to be obsolete, and lots more assumes you're already familiar with its bizarro-world of not-invented-here concoctions). I gave up trying to understand Docker itself. I learned much more by following the OCI specs, and building container images directly using `tar` and `sha256`. AWS ECS seems to run them just fine :)

noirscape 4y ago

The main issue when it comes to using Debian or most conventional package managers (nix really deserves its own mention there) is that you also pretty much distro lock your software, which may not be always beneficial. Another problem comes now in the form of distribution; packaging is one thing, distributing is another. Debian isn't too bad about this but depending on your choice of packager[0], you could suddenly need to spend another couple days trying to figure out how to even host the thing unless you want to spend time running wget on your production machines to pull in deb/RPM/makepkg output/pick your poison files. Nix deserves its own mention because while it pretty much singlehandedly tries to solve all major issues with dependency management, it also... does so by abandoning almost every assumption most people have about how the OS is supposed to work (not to mention that writing nix files is basically learning a whole new language which is... doable but not exactly accessible). It's definitely the stronger solution compared to dockerfiles, but you can translate any program for any distro into a dockerfile as long as it runs on your kernel (alongside the fact that a dockerfile is a really good way to deal with the "documentation abandoned 5 years ago, but it runs on Dave's machine if you follow the README and change about 50 different small settings in your OS" projects which are done a dozen with FOSS projects). Docker is a mess technically but when it comes to software you want to use/deploy but don't want to understand all the fine details of the source code, it is often a lot easier to work with compared to Nix, which if you have something not in nixpkgs, can result in you needing to start making upstream patches to genericize build directories and generally change peoples CI flows in ways maintainers don't necessarily appreciate. tldr; nix is good, docker is easy. [0] It's been a few years but the worst package distribution system I've had the displeasure to use are Ubuntu PPAs. It's a system close to the Debian specification but it requires a whole set of separate commands and weird signing steps before you can upload anything, none of which is properly documented because they expect people that want to use PPAs to shove it in a makefile, which isn't useful if you don't use a language that relies on Makefiles, but I digress.

chriswarbo 4y ago
I agree with most of what you're saying, although we're describing slightly different use cases. For example, using a .deb file is just as "distro locked" as the sort of "apt-get scripting" I was complaining about. It's pretty much a Pareto improvement to change a Dockerfile from `RUN apt-get install ...` to `RUN apt install ./my-package.deb` (we can construct the .deb wherever we like; outside the container, inside the container, in a separate container, etc.) As for Docker being "easy"... I suppose that's subjective. Personally, it's given me nothing but pain; from trying to get the damn thing installed, to trying to understand it (lots of documentation turns out to be obsolete, and lots more assumes you're already familiar with its bizarro-world of not-invented-here concoctions). I gave up trying to understand Docker itself. I learned much more by following the OCI specs, and building container images directly using `tar` and `sha256`. AWS ECS seems to run them just fine :)