3 ms·

It appears the Bazel community is getting closer to inventing containers.

by shykes 1y ago

jeffbee 1y ago
Bazel comes with ironclad sandboxing features, but people don't use them because build correctness is such a chore.
- deleted 1y ago
  [deleted]
paulddraper 1y ago
Bazel has number of strategies, including containers. But that’s only a minority of what it does.
klodolph 1y ago
I don’t think there’s any real insights there. Containers tend to be coarse-grained. For example, maybe you are writing a program, so you put the entire build environment in a container. If you have lots of programs with different dependencies, do you need lots of containers? Do you need to rebuild lots of containers when dependencies change? Bazel is much more fine-grained, and in Bazel, each individual build action gets its own build environment. By default, that build environment includes the host (build system) glibc, compiler, system headers, system libraries, etc. If you want repeatable builds, you turn that off, and give Bazel the exact glibc, compiler, libraries, etc. to use for building your program. You get the isolation of containers, but much faster builds and better caching.
josephg 1y ago
You don’t need containers. Just hermetic builds. Ideally every byte read during the compilation process comes from a file under your control, that you version and you test. That includes the compiler, glibc, and all of your dependencies. Ambient, implicit dependencies are the devil’s playthings.
- shykes 1y ago
  Right. But you need tooling to manage those dependencies, and an ecosystem of content to avoid reinventing the wheel. That's what containers provide. Since Bazel predates the modern container ecosystem, it had to invent its own tooling. The user experience is very rough, and the ecosystem tiny. As a result most Bazel users do not run their builds in a controlled environment - see the parent blog post. Adopting containers would solve this, but it seems to be a major blind spot for the Bazel community. My theory is that for them to adopt container technology, they will have to reinvent it themselves, hence my tongue-in-cheek comment.

It appears the Bazel community is getting closer to inventing containers.

by shykes 1y ago

It appears the Bazel community is getting closer to inventing containers.

jeffbee 1y ago

Bazel comes with ironclad sandboxing features, but people don't use them because build correctness is such a chore.

deleted 1y ago
[deleted]

paulddraper 1y ago

Bazel has number of strategies, including containers. But that’s only a minority of what it does.

klodolph 1y ago

I don’t think there’s any real insights there. Containers tend to be coarse-grained. For example, maybe you are writing a program, so you put the entire build environment in a container. If you have lots of programs with different dependencies, do you need lots of containers? Do you need to rebuild lots of containers when dependencies change? Bazel is much more fine-grained, and in Bazel, each individual build action gets its own build environment. By default, that build environment includes the host (build system) glibc, compiler, system headers, system libraries, etc. If you want repeatable builds, you turn that off, and give Bazel the exact glibc, compiler, libraries, etc. to use for building your program. You get the isolation of containers, but much faster builds and better caching.

josephg 1y ago

You don’t need containers. Just hermetic builds. Ideally every byte read during the compilation process comes from a file under your control, that you version and you test. That includes the compiler, glibc, and all of your dependencies. Ambient, implicit dependencies are the devil’s playthings.

shykes 1y ago
Right. But you need tooling to manage those dependencies, and an ecosystem of content to avoid reinventing the wheel. That's what containers provide. Since Bazel predates the modern container ecosystem, it had to invent its own tooling. The user experience is very rough, and the ecosystem tiny. As a result most Bazel users do not run their builds in a controlled environment - see the parent blog post. Adopting containers would solve this, but it seems to be a major blind spot for the Bazel community. My theory is that for them to adopt container technology, they will have to reinvent it themselves, hence my tongue-in-cheek comment.