4 ms·

I know it's an anti-pattern, but what is the alternative if you need to install some software? Pulling its tagged source code, gcc and compile everything?

rowanG077 5mo ago
With a binary cache that is not so bad, see for example what nix does.
- Pay08 5mo ago
  I don't really see how that's different from a normal binary install of a reproducible package. Especially with the lacking quality of a lot of Nix packages.
  - rowanG077 5mo ago
    It's not if you can pin the package. It gives you reproducable docker containers without having to rebuild the world. Wasn't that the entire question?
    - Pay08 5mo ago
      Wasn't the question about modifying an existing image?
      - rowanG077 5mo ago
        No, it was about putting apt update in docker file and it not being reproducible.
  - bandrami 5mo ago
    If you're in a situation where you want reproducibility you're using nix to build your own packages anyways, not relying on their packages
bennofs 5mo ago
Both Debian and Ubuntu provide snapshot mirrors where you can specify a date to get the package lists as they looked at that time.
- bluGill 5mo ago
  Which is only useful for historical invesigation - the old snapshot has security holes attackers know how to exploit.
  - lloeki 5mo ago
    > the old snapshot has security holes attackers know how to exploit. So is running `docker build` and the `RUN apt update` line doing a cache hit, except the latter is silent. The problem solved by pinning to the snapshot is not to magically be secure, it's knowing what a given image is made of so you can trivially assert which ones are safe and which ones aren't. In both cases you have to rebuild an image anyway so updating the snapshot is just a step that makes it explicit in code instead of implicit.
    - bluGill 5mo ago
      where does the apt update connect to? If it is an up to date package repo you get fixes. Howerer there are lots of reasons it would not. You better know if this is your plan.
      - lloeki 5mo ago
        Yeah that's yet another annoying thing to consider Also I'm tired of doing these hacks: # increase to bust cache entry RUN true 42 && apt update Pinning to a snapshot just makes so many things easier.
      - foresto 5mo ago
        You get fixes that were current at docker build time, but I think GP is referring to fixes that appear in the apt repo after your docker container is deployed. If you've pulled in a dependency from outside the base image, there will be no new base image version to alert you to an update of that external dependency. Unless your container regularly runs something like apt update && apt list --upgradable, you will be unaware of security fixes newly available from apt.
kandros 5mo ago
Copying from another image is an under appreciated feature FROM ubuntu:24.04 COPY --from=ghcr.io/owner/image:latest /usr/local/bin/somebinary /usr/local/bin/somebinary CMD ["somebinary"] Not as simple when you need shared dependencies
liveoneggs 5mo ago
pretend you don't do it and add your extra software to the layer above
dev_l1x_be 5mo ago
base image software component image both should be version pinned for auditing
Filligree 5mo ago
Run “nix flake update”. Commit the lockfile. Build a docker image from that; the software you need is almost certainly there, and there’s a handy docker helper.
- klodolph 5mo ago
  Recently I’ve been noticing that Nix software has been falling behind. So “the software you need is almost certainly there” is less true these days. Recently = April 2026.
  - sestep 5mo ago
    Are you referring to how the nixpkgs-unstable branch hasn't been updated in the past five days? Or do you have some specific software in mind? (not arguing, just curious)
    - klodolph 5mo ago
      It’s a variety of different software that just isn’t updated very often. I don’t mind being somewhat behind, but it seems like there are a lot of packages that don’t get regular updates. It’s okay to have packages that aren’t updated, but those packages should be clearly distinguishable.
  - Pay08 5mo ago
    That's been an issue for years from my impression of the state of NixOS. There are other problems too, like a lot of open source packages doing straight binary downloads instead of actually building the software.
- PunchyHamster 5mo ago
  oh, great, adding more dependency, and one that just had serious security problem
  - hexa555 5mo ago
    as if other sandboxing software is perfect
codethief 5mo ago
Use https://github.com/reproducible-containers/repro-sources-list.sh https://github.com/reproducible-containers/repro-sources-lis...

rowanG077 5mo ago

With a binary cache that is not so bad, see for example what nix does.

Pay08 5mo ago
I don't really see how that's different from a normal binary install of a reproducible package. Especially with the lacking quality of a lot of Nix packages.
- rowanG077 5mo ago
  It's not if you can pin the package. It gives you reproducable docker containers without having to rebuild the world. Wasn't that the entire question?
  - Pay08 5mo ago
    Wasn't the question about modifying an existing image?
    - rowanG077 5mo ago
      No, it was about putting apt update in docker file and it not being reproducible.
- bandrami 5mo ago
  If you're in a situation where you want reproducibility you're using nix to build your own packages anyways, not relying on their packages

bennofs 5mo ago

Both Debian and Ubuntu provide snapshot mirrors where you can specify a date to get the package lists as they looked at that time.

bluGill 5mo ago
Which is only useful for historical invesigation - the old snapshot has security holes attackers know how to exploit.
- lloeki 5mo ago
  > the old snapshot has security holes attackers know how to exploit. So is running `docker build` and the `RUN apt update` line doing a cache hit, except the latter is silent. The problem solved by pinning to the snapshot is not to magically be secure, it's knowing what a given image is made of so you can trivially assert which ones are safe and which ones aren't. In both cases you have to rebuild an image anyway so updating the snapshot is just a step that makes it explicit in code instead of implicit.
  - bluGill 5mo ago
    where does the apt update connect to? If it is an up to date package repo you get fixes. Howerer there are lots of reasons it would not. You better know if this is your plan.
    - lloeki 5mo ago
      Yeah that's yet another annoying thing to consider Also I'm tired of doing these hacks: # increase to bust cache entry RUN true 42 && apt update Pinning to a snapshot just makes so many things easier.
    - foresto 5mo ago
      You get fixes that were current at docker build time, but I think GP is referring to fixes that appear in the apt repo after your docker container is deployed. If you've pulled in a dependency from outside the base image, there will be no new base image version to alert you to an update of that external dependency. Unless your container regularly runs something like apt update && apt list --upgradable, you will be unaware of security fixes newly available from apt.

kandros 5mo ago

Copying from another image is an under appreciated feature FROM ubuntu:24.04 COPY --from=ghcr.io/owner/image:latest /usr/local/bin/somebinary /usr/local/bin/somebinary CMD ["somebinary"] Not as simple when you need shared dependencies

liveoneggs 5mo ago

pretend you don't do it and add your extra software to the layer above

dev_l1x_be 5mo ago

base image software component image both should be version pinned for auditing

Filligree 5mo ago

Run “nix flake update”. Commit the lockfile. Build a docker image from that; the software you need is almost certainly there, and there’s a handy docker helper.

klodolph 5mo ago
Recently I’ve been noticing that Nix software has been falling behind. So “the software you need is almost certainly there” is less true these days. Recently = April 2026.
- sestep 5mo ago
  Are you referring to how the nixpkgs-unstable branch hasn't been updated in the past five days? Or do you have some specific software in mind? (not arguing, just curious)
  - klodolph 5mo ago
    It’s a variety of different software that just isn’t updated very often. I don’t mind being somewhat behind, but it seems like there are a lot of packages that don’t get regular updates. It’s okay to have packages that aren’t updated, but those packages should be clearly distinguishable.
- Pay08 5mo ago
  That's been an issue for years from my impression of the state of NixOS. There are other problems too, like a lot of open source packages doing straight binary downloads instead of actually building the software.
PunchyHamster 5mo ago
oh, great, adding more dependency, and one that just had serious security problem
- hexa555 5mo ago
  as if other sandboxing software is perfect

codethief 5mo ago

Use https://github.com/reproducible-containers/repro-sources-list.sh https://github.com/reproducible-containers/repro-sources-lis...