3 ms·

This depends on whether the Dockerfile is available somewhere right?

by theK 3y ago

koili_ 3y ago
Not necessarily. It is certainly easier to read a dockerfile, but there are tools like https://github.com/wagoodman/dive https://github.com/wagoodman/dive (im sure there are others) that allow you to inspect images themselves in a very detailed manner.
- theK 3y ago
  I was certain there where ways to reconstruct the Dockerfile but wasn't aware that tools like this existed. Thanks for the link!
epgui 3y ago
I don't think so, and (honest question) isn't a dockerfile always available somehow from somewhere?
- evilduck 3y ago
  Yeah but it doesn't mean they're useful as non-Docker build steps for reproducing an image. For example: https://hub.docker.com/layers/library/mysql/latest/images/sha256-13e429971e970ebcb7bc611de52d71a3c444247dc67cf7475a02718f6a5ef559?context=explore https://hub.docker.com/layers/library/mysql/latest/images/sh... "ADD file:e15c235506d8dd134e69d458a7c0afefef1522e9d0cfb28e3538760ddf032785" isn't much help in installing MySQL on a bare metal server. It's also not something commonly done (I've never seen a project do it), but you can also just push around a very simple base image like a plain Debian image and then move around an image's runtime filesystem through `docker export` as .tar.gz which could have been crafted by someone who started an interactive shell session and just manually performed some install steps without recording what was being done. It's still technically a containerized system but it does obscure or omit a lot of the value proposition.
  - predictabl3 3y ago
    Not to mention accordingly to highly scientific calculations "damn near" every Dockerfile runs `apt-get update` as a first step, so the, you know, core valuation is questionable from the outset.
    - epgui 3y ago
      There is value in making things "more reproducible" even if you don't achieve "total reproducibility". Even just having a basic layer of extra isolation from the host system (even when updating everything at will without pinned versions) can be enough to motivate the tool's usage. There are varying degrees of reasonable pragmatism in different situations. Heck some people even decide not to use containers at all, and some of those even have well-motivated reasons for this choice! (And will this stuff even still run on chips 10-20 years from now anyway? Is there maybe a practical limit to reproducibility?)
      - predictabl3 3y ago
        >And will this stuff even still run on chips 10-20 years from now anyway? NixOS Con Paris had a talk running a decade+ old version of Firefox, complete with Flash.
    - evilduck 3y ago
      True, but bare metal systems also receive those updates on a regular basis, and containers need security updates too. Unless you're willing to throw it all out and use NixOS you're not going to solve that problem. And if you do, you're opting into far more work since you've just thrown out every standard package management solution and install or setup instructions you were previously relying on and you've just became a pain in the ass to your coworkers and ops teams who haven't drank that koolaid with you. Personally, I've never once ran into an issue where updating Debian packages in a Docker image impacted my daily life. I'm sure there's some anecdotes and greater than zero potential for it but it just doesn't seem like a major issue anywhere. Docker and Dockerfiles are a practical and low-friction means of getting install steps documented and it's generally a step up over what is normally done. I'm not going to let perfect be the enemy of good and will gladly deal with a Dockerfile that updates its packages first over a markdown file that does nothing.

This depends on whether the Dockerfile is available somewhere right?

by theK 3y ago

This depends on whether the Dockerfile is available somewhere right?

Not necessarily. It is certainly easier to read a dockerfile, but there are tools like https://github.com/wagoodman/dive https://github.com/wagoodman/dive (im sure there are others) that allow you to inspect images themselves in a very detailed manner.

theK 3y ago
I was certain there where ways to reconstruct the Dockerfile but wasn't aware that tools like this existed. Thanks for the link!

epgui 3y ago

I don't think so, and (honest question) isn't a dockerfile always available somehow from somewhere?

evilduck 3y ago
Yeah but it doesn't mean they're useful as non-Docker build steps for reproducing an image. For example: https://hub.docker.com/layers/library/mysql/latest/images/sha256-13e429971e970ebcb7bc611de52d71a3c444247dc67cf7475a02718f6a5ef559?context=explore https://hub.docker.com/layers/library/mysql/latest/images/sh... "ADD file:e15c235506d8dd134e69d458a7c0afefef1522e9d0cfb28e3538760ddf032785" isn't much help in installing MySQL on a bare metal server. It's also not something commonly done (I've never seen a project do it), but you can also just push around a very simple base image like a plain Debian image and then move around an image's runtime filesystem through `docker export` as .tar.gz which could have been crafted by someone who started an interactive shell session and just manually performed some install steps without recording what was being done. It's still technically a containerized system but it does obscure or omit a lot of the value proposition.
- predictabl3 3y ago
  Not to mention accordingly to highly scientific calculations "damn near" every Dockerfile runs `apt-get update` as a first step, so the, you know, core valuation is questionable from the outset.
  - epgui 3y ago
    There is value in making things "more reproducible" even if you don't achieve "total reproducibility". Even just having a basic layer of extra isolation from the host system (even when updating everything at will without pinned versions) can be enough to motivate the tool's usage. There are varying degrees of reasonable pragmatism in different situations. Heck some people even decide not to use containers at all, and some of those even have well-motivated reasons for this choice! (And will this stuff even still run on chips 10-20 years from now anyway? Is there maybe a practical limit to reproducibility?)
    - predictabl3 3y ago
      >And will this stuff even still run on chips 10-20 years from now anyway? NixOS Con Paris had a talk running a decade+ old version of Firefox, complete with Flash.
  - evilduck 3y ago
    True, but bare metal systems also receive those updates on a regular basis, and containers need security updates too. Unless you're willing to throw it all out and use NixOS you're not going to solve that problem. And if you do, you're opting into far more work since you've just thrown out every standard package management solution and install or setup instructions you were previously relying on and you've just became a pain in the ass to your coworkers and ops teams who haven't drank that koolaid with you. Personally, I've never once ran into an issue where updating Debian packages in a Docker image impacted my daily life. I'm sure there's some anecdotes and greater than zero potential for it but it just doesn't seem like a major issue anywhere. Docker and Dockerfiles are a practical and low-friction means of getting install steps documented and it's generally a step up over what is normally done. I'm not going to let perfect be the enemy of good and will gladly deal with a Dockerfile that updates its packages first over a markdown file that does nothing.