8 ms·
Arch Linux Now Has a Bit-for-Bit Reproducible Docker Image
- kippinsula 6mo agoreproducible images are one of those features where the payoff is mostly emotional until the day it isn't. we had an incident where two supposedly identical images on two machines had a three byte delta in a timestamp and it cost us an afternoon to bisect from the wrong end. boring win, but a real one.
- loloquwowndueo 6mo agoHow did a differing timestamp cause an incident in the first place? Curious.
- bluGill 6mo agoMy guess is it was the only obvious evidence of an attack.
- red-iron-pine 6mo agoGill probaby already knows this but for the uninitiated: something logged in, did a thing to potentially every container, and then deleted any sign of it doing the thing. all that's left is a single timestamp of a log or something getting deleted
- bobbiechen 6mo agoIt's an interesting concept but unfortunately I think the comment is actually AI slop so there's no real story behind it. Check the account history.
- aa-jv 6mo agoThis is a really interesting accomplishment - I am also working heavily on reproducible builds for my firmware projects, and .. lo and behold .. the package manager key administrivia is the final bone to be broken. I wonder if Arch leading the way on this will prompt other distro's to attempt the same feat. Reproducible builds are important for certification, security and safety-critical applications .. it'd be great to see Linux distros become more conformant to this method.
- dev_l1x_be 6mo agoAll docker containers should have been like that. apt-get update in a docker build step is an anti pattern.
- DuncanCoffee 6mo agoI know it's an anti-pattern, but what is the alternative if you need to install some software? Pulling its tagged source code, gcc and compile everything?
- rowanG077 6mo agoWith a binary cache that is not so bad, see for example what nix does.
- Pay08 6mo agoI don't really see how that's different from a normal binary install of a reproducible package. Especially with the lacking quality of a lot of Nix packages.
- rowanG077 6mo agoIt's not if you can pin the package. It gives you reproducable docker containers without having to rebuild the world. Wasn't that the entire question?
- 6mo ago
- fragmede 6mo agoand they said compilers are deterministic... This is a huge accomplishment! But it wouldn't be so huge if compilers were trivially deterministic. It took 5 decades of development for compilers to get here. I'm sure ChatGPT in 2073 is going to be more deterministic than it was in 2023.
- azangru 6mo agoA totally unrelated comment; but — there is an animation on that page that moves practically everything on the page about 20 pixels down over the course of 1 second. I thought that would completely trash the Cumulative Layout Shift core web vital. Because, hey! the layout is shifting in front of my very eyes. But no, the CLS on the page is 0. Is CLS a misleading metric then?
- epolanski 6mo agoThe layout isn't shifting, so it's not a layout shift. And it's not unexpected, because it comes from a css transition.
- azangru 6mo agoSure. It's just that the spirit of Google's core web vitals has been to measure the properties of a web page that have the most impact on users. How quickly content appears on a page, how visually stable the content is, and how long it takes the page to respond to an interaction. In the case of this page, I don't think it can be considered visually stable at all in the first second after it's loaded. And yet, core web vitals cannot demonstrate this.
- chrisweekly 6mo agoIt's happening as a result of a deliberate animation. The CLS metric relates to initial render. So yes, there is layout shift, but it's not CLS per se.
- azangru 6mo ago> The CLS metric relates to initial render. The CLS measures the total sum of layout shifts over the entire lifespan of a page, not just during initial render.
- nickjj 6mo agoIt is nice to have this confidence. I ran Arch Linux for almost a year in WSL 2, it was really good. Then I ran Arch natively for ~5 months, it's really good. Now I still run Arch natively, but I also use the Arch Docker image to test my dotfiles[0] with a fresh file system. Also, for when I want to run end to end tests for my dotfiles that set up a complete desktop environment I run Arch in a VM. I have 99 problems but running Arch isn't one of them. [0]: https://github.com/nickjj/dotfiles https://github.com/nickjj/dotfiles
- MuffinFlavored 6mo agoHave you tried NixOS/flakes? What was your reaction?
- srik 6mo agoI have never been more stress-free than when I was running nixos as a daily driver. Had to return to macos as primary unfortunately but still use nix as much as possible.
- luz666 6mo agoI am even so stress-free, that I once rebuilt my kernel (including simple patches) under the hood of my daily production/home pc. edit: Using nixos ofc, otherwise I would never do this.
- nickjj 6mo agoI haven't tried it first hand. I've written over ~10k lines of Ansible playbooks and roles to fully automate setting up servers to deploy Docker based web apps, so I do like the concept of declaring the state of a system in configuration and then having that become a reality. I know NixOS is not directly comparable to Ansible but in general I think IaC is a good idea. It was important to me that my dotfiles work on a number of systems so I avoided NixOS. For example, the command line version works on Arch, Debian and Ubuntu based distros along with WSL 2 support and macOS too. The desktop version works on Arch and Arch based distros. Beyond that, I also use my dotfiles on 2 different Linux systems so I wanted a way to differentiate certain configs for certain things. I also have a company issued laptop running macOS where I want everything to work, but it's a managed device so I can't go hog wild with full system level management. Beyond that, since I make video courses I wanted to make it easy for anyone to replicate my set up if they wanted but also make it super easy for them to personalize any part of the set up without forking my repo (but they can still fork it if they want). All of the above was achievable with shell scripts and symlinks. I might be wrong since I didn't research it in depth but I'm not sure NixOS can handle all of the above use cases in an easy to configure manner.
- cmxch 6mo ago[flagged]
- pabs3 6mo agoMore info about Reproducible Builds here: https://reproducible-builds.org/ https://reproducible-builds.org/ Closely related is the Boostrappable Builds community: https://bootstrappable.org/ https://bootstrappable.org/
- vbezhenar 6mo agoNitpick, but I'd suggest to use "OCI Image" terminology. It runs with podman just fine.
- crumpled 6mo agoI'm a bit out of my depth in this comment section (not an arch user, am a novice docker admin). But, to me, this comment is eye-opening.
- red-iron-pine 6mo agoPresumably there is something you can plug into the CI/CD pipeline that informs everyone one you use Arch (and, also presumably, that you do Crossfit, etc.)
- kid64 6mo agoI've been long fascinated by the rolling release model. But aren't you guys worried about supply chain attacks? Seems those on the bleeding edge serve as canaries in the coalmine for the rest of us.
- StableAlkyne 6mo agoThat's the purpose of reproducible build initiatives like TFA. The idea is to ensure that identical source produces bit-for-bit identical builds on multiple machines when the packages are built. Sure, if the source itself gets got, then it does nothing. But it at least puts up one more barrier against tampering with the artifacts. They have a tracker for what percent of the distro is reproducible: https://reproducible.archlinux.org/ https://reproducible.archlinux.org/
- conorbergin 6mo agoI wonder if well designed "mutable" operating systems like Arch and Alpine that are going to beat NixOS etc. in the long run. An install script is strictly more powerful that a declarative config language, and typically less verbose.
- Pay08 6mo agoMight as well use Guix then. You still have the declarative config language, but also a turing-complete (and convenient) programming language.
- joshmoody24 6mo agoWhat do you mean by strictly more powerful?
- conorbergin 6mo agoScripts are typically turing complete, config files are typically not.
- bastawhiz 6mo agoHuge respect to the people who made this happen. The amount of time and effort that goes into a headline like this is unreal.
- henrydark 6mo agoI read the piece, looks cool, but it merges Dockerfile with docker image? If instead of using Dockerfile they would have a direct build of the image tar file with something like nix then it would have been easier, though admittedly mildly esoteric
- esbranson 6mo agoWhere are Fedora and Debian/Ubuntu on this?