4 ms·
Docker does neat stuff, but if it's really the future then I am going to be disappointed. Using the Docker daemon as a high-level interface to clone(2) has bee
by davexunit 11y ago
Docker does neat stuff, but if it's really the future then I am going to be disappointed. Using the Docker daemon as a high-level interface to clone(2) has been nice, but Dockerfiles are a weak format (why not use a general purpose programming language?), the pre-built binaries on DockerHub are just asking for exploitation, and unioning a bunch of disk images is a hack to deal with the imperative nature of how images are built. Projects like Nix and GNU Guix are what I want the future to be. With them I don't have to put trust into any single third party, I get nearly bit-for-bit reproducible builds, system-wide deduplication of packages, functional/declarative system configuration, atomic updates/rollback, quick setup of development environments (with or without a container), and more.
- muraiki 11y agoI would be extremely interested in an article contrasting the approaches of Docker and Nix/Guix. Is there anything like this available? A cursory search returned mostly information on using the two together...
- davexunit 11y agoI don't know of a good article about it. That would be quite useful. Maybe I should attempt to write it once Guix's container support lands in a release (I'm working on it). I use Docker by day, and hack on my own container implementation for Guix by night.
- walterbell 11y agoDoes Guix help with the building of reproducible binaries, or is it focused on reproducible build environments/config?
- davexunit 11y agoYes, it helps with that a lot. Binaries built with Guix are likely to be bit-identical. See the manual[0] for some more details about how we (and Nix) do that. [0] https://gnu.org/software/guix/manual/html_node/Invoking-guix_002ddaemon.html#index-reproducible-builds https://gnu.org/software/guix/manual/html_node/Invoking-guix...
- krick 11y agoIt's hard to compare them, because it's really 2 different things. I understand what parent means, and I think it's fair, but comparing Docker and Guix is weird, because they aren't really competing technologies. Docker is somewhat hacky solution for lightweight containers on Linux. It is something tagged by #virtualization, although it isn't really that. And, well, it comes with even more hacky solution to configure these containers. Nix/Guix is a package manager for your Linux distro. It is solution for stuff, for which you use apt-get. More generally, it is "the right one" solution for system configuration, which makes configuration reproducible. So it's hard to say, what is the difference between Docker and Nix/Guix because they serve different purposes, but if you compare configuration language, "the approach" - you don't have to think twice to decide which is better. Nix isn't hacky and Guix is even less so, as opposed to Docker.
- davexunit 11y agoI should point out that Nix has container support built-in, without Docker, using systemd-nspawn. So, you get to use the same tools to manage systems on "metal", virtual machines, and containers. Pretty cool stuff!
- michaelcampbell 11y ago> but comparing Docker and Guix is weird, because they aren't really competing technologies. I think that's his point; he doesn't want the future to be Dockery, he wants it to be Guixy. A different direction; a different future.
- lallysingh 11y agoI think a docker wrapper atop of Nix makes a lot of sense. There are going to be imperative things we do in docker images that aren't going away -- like downloading HEAD from a git repo and building it -- and using Nix for every other part makes a lot of sense.
- michaelmrose 11y agoI'm pretty sure you could do that with nix and skip the docker part