3 ms·

> Only put what’s necessary If this were that easy, chroot with PID isolation alone would be quite enough.

by Joker_vD 2y ago

lrvick 2y ago
It is that easy, at least on distros built for containers. Most stagex based containers are a single binary.
exe34 2y ago
nix can generate images with exactly what's needed and nothing more.
- Joker_vD 2y ago
  Even for the programs that do something like dlopen("libcrypt.so.3")? Allow me to doubt that.
  - exe34 2y ago
    in nix, you have to be explicit about bringing in something, like libcrypt. otherwise it'll just never be found. so if you can get it to work outside of docker, it's pretty simple to put it in docker with all the things that are needed but nothing else: https://nix.dev/tutorials/nixos/building-and-running-docker-images.html https://nix.dev/tutorials/nixos/building-and-running-docker-... https://www.bnikolic.co.uk/blog/python/nix/2023/03/23/nixpydocker.html https://www.bnikolic.co.uk/blog/python/nix/2023/03/23/nixpyd...
    - Joker_vD 2y ago
      Okay, but how do you find out that this program may dynamically load libcrypt which it doesn't mention in its PT_DYNAMIC for some silly reason or another? Because if you already know that, then you just put "RUN apt install -y openssl" in your Dockerfile which is easy. It's finding out that you need to do that that's hard.
      - exe34 2y ago
        does that mean apt lives in your image? or is it just on the Dev side? nix lives on the Dev side, and your image is not polluted. the issue of people not documenting their dependencies is not addressed by nix, other than the fact that undocumented dependencies also won't "works on my machine", until it's resolved.
  - poorlyknit 2y ago
    Well no, obviously. Nix has not solved the rice theorem. But you'll have this problem whether you're using BuildKit or Nix. Difference is with Nix the final image only contains your explicitly stated dependencies. I.e. no apt, no Python, no Perl, no cacerts unless you explicitly include them.

> Only put what’s necessary If this were that easy, chroot with PID isolation alone would be quite enough.

lrvick 2y ago

It is that easy, at least on distros built for containers. Most stagex based containers are a single binary.

exe34 2y ago

nix can generate images with exactly what's needed and nothing more.

Joker_vD 2y ago
Even for the programs that do something like dlopen("libcrypt.so.3")? Allow me to doubt that.
- exe34 2y ago
  in nix, you have to be explicit about bringing in something, like libcrypt. otherwise it'll just never be found. so if you can get it to work outside of docker, it's pretty simple to put it in docker with all the things that are needed but nothing else: https://nix.dev/tutorials/nixos/building-and-running-docker-images.html https://nix.dev/tutorials/nixos/building-and-running-docker-... https://www.bnikolic.co.uk/blog/python/nix/2023/03/23/nixpydocker.html https://www.bnikolic.co.uk/blog/python/nix/2023/03/23/nixpyd...
  - Joker_vD 2y ago
    Okay, but how do you find out that this program may dynamically load libcrypt which it doesn't mention in its PT_DYNAMIC for some silly reason or another? Because if you already know that, then you just put "RUN apt install -y openssl" in your Dockerfile which is easy. It's finding out that you need to do that that's hard.
    - exe34 2y ago
      does that mean apt lives in your image? or is it just on the Dev side? nix lives on the Dev side, and your image is not polluted. the issue of people not documenting their dependencies is not addressed by nix, other than the fact that undocumented dependencies also won't "works on my machine", until it's resolved.
- poorlyknit 2y ago
  Well no, obviously. Nix has not solved the rice theorem. But you'll have this problem whether you're using BuildKit or Nix. Difference is with Nix the final image only contains your explicitly stated dependencies. I.e. no apt, no Python, no Perl, no cacerts unless you explicitly include them.