3 ms·
1. Use a hash for the base images. 2. The meaning of “latest” is dependent on what base images you are using. Using UBI images for example means your versions a
by akdev1l 2y ago
1. Use a hash for the base images.
2. The meaning of “latest” is dependent on what base images you are using. Using UBI images for example means your versions are not going to change because redhat versions don’t really change.
But really containerizing the build environment is not related to deterministic builds as there’s a lot more work needed to guarantee that. Including possible changes in the application itself.
Lastly you don’t need to use docker or dockerfiles to build containers. You can use whatever tooling you want to create a rootfs and then create an image out of that. A nifty way of actually guaranteeing reproducibility is to use nix to build a container image.
- akoboldfrying 2y ago>But really containerizing the build environment is not related to deterministic builds What would you say the goal of containerising builds is, if not reproducibility?
- carlmr 2y agoThey didn't say reproducibility, they said determinism. If you use a container with the same apt-get commands and the same OS, you already separate out almost all the reproducibility issues. What you get will be a very similar environment. But it's not deterministic as you point out, that takes a lot more effort.