4 ms·

Reading this I felt that instead of “nix develop -c” we could use “docker run”. Has anyone compared these two approaches?

smilliken 4y ago
Once you build a docker image, you can distribute that artifact reliably. But building docker images is highly error prone, at the mercy of non-determinism, various failure modes of package managers, and mutable state from web servers you don't control. In practice, you can't depend on it working without active maintenance and disciplined usage. With Nix, if it built once, it will build again, consistently and deterministically. It reduces fear of changing things because it just works. You don't have to cross your fingers and hope the build succeeds this time.
- pharmakom 4y ago
  Doesn’t seem to be an issue if you only use prebuilt Docker images though?
  - rowanG077 4y ago
    You will very quickly hit a wall with that. Speaking from experience.
    - pharmakom 4y ago
      Interesting! Does nix develop work inside nix develop ?
      - rowanG077 4y ago
        If you mean whether `nix develop` shells stack then yes.
pmarreck 4y ago
What smilliken said. Essentially, with a single flake.lock file, you get build determinism, which is huge. Docker cannot guarantee that... which is, in fact, why distributing Docker images is a thing, instead of just distributing and composing Dockerfiles. If Dockerfiles were guaranteed to succeed, and Docker hosted a cache of hashed binaries instead of a cache of Docker images (the former is far more efficient than the latter, btw), then all you'd need are Dockerfiles. Enter Nix (and its flake.nix/flake.lock files). Nix essentially solves a problem that Docker can't by treating a build as an immutable function with binary-hashed inputs and binary-hashed dependencies and completely controlled environment variables (with a few exceptions and special cases)
peterbecich 4y ago
On Mac where Docker runs in a VM, "nix develop -c" I think would be faster.
- peterbecich 4y ago
  There is a one-time cost of building (or downloading) the Nix derivation's binaries. But then it is a native binary. With Docker on Mac, the cost continues.
rkangel 4y ago
Using nix develop (without -c) to get a development shell has some advantages over docker. It layers over your existing environment (unless you don't want it to) so you can still access things like git from the same shell. With docker you either add it to your build deps or do some stuff inside docker and some stuff outside. It also builds your environment on demand rather than having to manage the two step thing of building the image and then making sure you're using the right one. I've found this much more flexible and convenient than anything with docker.

smilliken 4y ago

Once you build a docker image, you can distribute that artifact reliably. But building docker images is highly error prone, at the mercy of non-determinism, various failure modes of package managers, and mutable state from web servers you don't control. In practice, you can't depend on it working without active maintenance and disciplined usage. With Nix, if it built once, it will build again, consistently and deterministically. It reduces fear of changing things because it just works. You don't have to cross your fingers and hope the build succeeds this time.

pharmakom 4y ago
Doesn’t seem to be an issue if you only use prebuilt Docker images though?
- rowanG077 4y ago
  You will very quickly hit a wall with that. Speaking from experience.
  - pharmakom 4y ago
    Interesting! Does nix develop work inside nix develop ?
    - rowanG077 4y ago
      If you mean whether `nix develop` shells stack then yes.

pmarreck 4y ago

What smilliken said. Essentially, with a single flake.lock file, you get build determinism, which is huge. Docker cannot guarantee that... which is, in fact, why distributing Docker images is a thing, instead of just distributing and composing Dockerfiles. If Dockerfiles were guaranteed to succeed, and Docker hosted a cache of hashed binaries instead of a cache of Docker images (the former is far more efficient than the latter, btw), then all you'd need are Dockerfiles. Enter Nix (and its flake.nix/flake.lock files). Nix essentially solves a problem that Docker can't by treating a build as an immutable function with binary-hashed inputs and binary-hashed dependencies and completely controlled environment variables (with a few exceptions and special cases)

peterbecich 4y ago

On Mac where Docker runs in a VM, "nix develop -c" I think would be faster.

peterbecich 4y ago
There is a one-time cost of building (or downloading) the Nix derivation's binaries. But then it is a native binary. With Docker on Mac, the cost continues.

rkangel 4y ago

Using nix develop (without -c) to get a development shell has some advantages over docker. It layers over your existing environment (unless you don't want it to) so you can still access things like git from the same shell. With docker you either add it to your build deps or do some stuff inside docker and some stuff outside. It also builds your environment on demand rather than having to manage the two step thing of building the image and then making sure you're using the right one. I've found this much more flexible and convenient than anything with docker.