4 ms·

Nix is not content addressable though, the hashes is based off on the derivation files which are equal to the lock files you would find in other package manager

Nix is not content addressable though, the hashes is based off on the derivation files which are equal to the lock files you would find in other package managers. > The thing it provides is the toolchain of dependencies that are reproducible. [...] If the inputs change then so does the output. If the output itself is not reproducible (like, say an artifact with a build-time embedded in it) then you have something that is inherently not reproducible and two people trying to build the same exact nix package will have different results. There are no guarantees they are reproducible. The only guarantees Nix gives you is that the build environment is the same which allows you to make some claims about the system behaving the same way. But they are certainly no guarantees about artifacts being bit-by-bit identical.

cpuguy83 3y ago
It's content addressable, just what are you addressing? The content address of a docker image is a json blob (referencing other objects). The content address of a Dockerfile "RUN" command is the content address of what came before it and the command being run.
- Foxboron 3y ago
  >It's content addressable, just what are you addressing? In the case of Nix it's addressed by the input. Not the content of the build. It's an important distinction and one Nix also makes. https://nixos.org/manual/nix/stable/command-ref/new-cli/nix3-store-make-content-addressed https://nixos.org/manual/nix/stable/command-ref/new-cli/nix3... But doing this is going to give you a slight headace as most of the package repository in Nix is not checked for reproducible builds and there are no way to guarantee the hashes are actually static.
  - cpuguy83 3y ago
    Right, all builds are dependent on their inputs. Your inputs determine your outputs. If your input(s) change, then so does your output. We are saying the same thing here, I'm just trying to point out this is exactly how docker build works, but rather it is more about what you are willing to put into your docker build.
    - Foxboron 3y ago
      I think we are talking past each other. I'm just trying to clear up a misconception on how nix works, not anything about the docker portion of what you have written.

cpuguy83 3y ago

It's content addressable, just what are you addressing? The content address of a docker image is a json blob (referencing other objects). The content address of a Dockerfile "RUN" command is the content address of what came before it and the command being run.

Foxboron 3y ago
>It's content addressable, just what are you addressing? In the case of Nix it's addressed by the input. Not the content of the build. It's an important distinction and one Nix also makes. https://nixos.org/manual/nix/stable/command-ref/new-cli/nix3-store-make-content-addressed https://nixos.org/manual/nix/stable/command-ref/new-cli/nix3... But doing this is going to give you a slight headace as most of the package repository in Nix is not checked for reproducible builds and there are no way to guarantee the hashes are actually static.
- cpuguy83 3y ago
  Right, all builds are dependent on their inputs. Your inputs determine your outputs. If your input(s) change, then so does your output. We are saying the same thing here, I'm just trying to point out this is exactly how docker build works, but rather it is more about what you are willing to put into your docker build.
  - Foxboron 3y ago
    I think we are talking past each other. I'm just trying to clear up a misconception on how nix works, not anything about the docker portion of what you have written.