3 ms·

You can avoid that unpredictability if you don't use the latest tag, or, better, create images or start containers from SHA256 digests. Those are guaranteed to

by nunez 3y ago

You can avoid that unpredictability if you don't use the latest tag, or, better, create images or start containers from SHA256 digests. Those are guaranteed to be immutable. I.e instead of: Docker run --rm debian:trixie You'd do Docker run --rm debian:trixie@sha256:0ee9224bb31d3622e84d15260cf759bf37f08d652cc0411ca7b1f785f87ac19c The only disadvantage of the digest approach is that you would need to manually resolve the digest that's correct for your processor arch. Using bare tags like "debian:trixie" can resolve to manifest lists (if so configured) that has Docker automatically find the right digest for your arch.

kreetx 3y ago
What if the environment needs more packages installed via apt, do you save those hashes somewhere, too?
- codethief 3y ago
  Debian & Ubuntu provide daily snapshots of their repositories, see snapshot.debian.org and https://ubuntu.com/blog/ubuntu-snapshots-on-azure-ensuring-predictability-and-consistency-in-cloud-deployments https://ubuntu.com/blog/ubuntu-snapshots-on-azure-ensuring-p... See e.g. https://github.com/reproducible-containers/repro-sources-list.sh https://github.com/reproducible-containers/repro-sources-lis... for how to use them. Also, at least for Debian there are official images available that use snapshot.debian.org as package repository from the get-go – unfortunately those images are not published on a daily basis yet. It seems the overall topic if reproducibility is on the Docker team's to do list, though, see https://github.com/docker-library/official-images/issues/16044 https://github.com/docker-library/official-images/issues/160...
  - kreetx 3y ago
    But if you read those links, you'll see that it's not quite there yet. Docker in general can't solve reproducibility - it's the package manager within any container that does that.
    - codethief 3y ago
      > But if you read those links, you'll see that it's not quite there yet. Anything you're referring to specifically? I think I made it pretty clear that Docker images based on package repo snapshots are not fully "there" yet. > Docker in general can't solve reproducibility - it's the package manager within any container that does that. No doubt, but right now the issue is that the package managers have done their part and the Docker images need to catch up.
- nunez 3y ago
  Then you would create a Dockerfile that uses the digest SHA you want as a parent image, add your packages, build a new image from that Dockerfile with an updated tag, and push the image into the registry. a digest will be created for it once uploaded into its registry. If you are not uploading images into registries (why?), you can use "docker save" to turn that image into a tarball and then checksum the tarball.
  - kreetx 3y ago
    With nix, you wouldn't need to back up the images - you can start from source every time.

by nunez 3y ago

kreetx 3y ago

What if the environment needs more packages installed via apt, do you save those hashes somewhere, too?

codethief 3y ago
Debian & Ubuntu provide daily snapshots of their repositories, see snapshot.debian.org and https://ubuntu.com/blog/ubuntu-snapshots-on-azure-ensuring-predictability-and-consistency-in-cloud-deployments https://ubuntu.com/blog/ubuntu-snapshots-on-azure-ensuring-p... See e.g. https://github.com/reproducible-containers/repro-sources-list.sh https://github.com/reproducible-containers/repro-sources-lis... for how to use them. Also, at least for Debian there are official images available that use snapshot.debian.org as package repository from the get-go – unfortunately those images are not published on a daily basis yet. It seems the overall topic if reproducibility is on the Docker team's to do list, though, see https://github.com/docker-library/official-images/issues/16044 https://github.com/docker-library/official-images/issues/160...
- kreetx 3y ago
  But if you read those links, you'll see that it's not quite there yet. Docker in general can't solve reproducibility - it's the package manager within any container that does that.
  - codethief 3y ago
    > But if you read those links, you'll see that it's not quite there yet. Anything you're referring to specifically? I think I made it pretty clear that Docker images based on package repo snapshots are not fully "there" yet. > Docker in general can't solve reproducibility - it's the package manager within any container that does that. No doubt, but right now the issue is that the package managers have done their part and the Docker images need to catch up.
nunez 3y ago
Then you would create a Dockerfile that uses the digest SHA you want as a parent image, add your packages, build a new image from that Dockerfile with an updated tag, and push the image into the registry. a digest will be created for it once uploaded into its registry. If you are not uploading images into registries (why?), you can use "docker save" to turn that image into a tarball and then checksum the tarball.
- kreetx 3y ago
  With nix, you wouldn't need to back up the images - you can start from source every time.