Hacker News Reader

Comment by karterk | Hacker News Reader

Maybe this is the norm in big enterprises, but I have not actually come across any company which hosts a local package repository for commonly available packages.

View on HN

In big enterprises, core production infrastructure frequently has NO access to internet, ever.

Most places I've ever worked in will have local repositories, procedures and timelines for anything from Microsoft and OS updates, to development stacks and libraries.

Neither workstations nor servers get updated directly from external/vendor/open repositories - it is all managed in-house.

Slower, yes; more work, yes; but that's exactly the type of issue it's meant to prevent :)

Really? We certainly do here. Linux packages are mirrored. Programming dependencies are mirrored via tools like Nexus or Artifactory.

Like tsuresh said - stuff happens. What if you internet connection went down for a long period of time. You couldn't continue working. It takes very little to setup, gives you fall over but also makes installing dependencies sooo much faster.

You don't need a seamless, robust process for dealing with the occasional remote failure (especially when there are mirrors), but you can for example save snapshots of dependencies.

You should be able to do something in an emergency, even if it requires manual intervention. If you can only shrug and wait, that's bad.

> If you can only shrug and wait, that's bad.

Welcome to cloud computing!

At work, we've got our prereqs stored in a combination of Artifactory and Perforce. Even for my own personal projects, I'll fetch packages from the Internet when I'm setting up my dev environment, but actually doing a build only uses packages that I've got locally.

It's a little mind-boggling to me that anyone would rely on the constant availability of a free external service that's integral to putting their product together. I handle timestamps for codesigning through free public sites, but I've also got a list of 8 different timestamp servers to use, and switch between them if there's a failure.

You don't see well written, solidly thought out code to be the norm, either, for pretty much the same reason. It takes experience and guided thought to get to this point, and seasoned sysadmins (who have this worked out) aren't exactly the crowd considered to be sexy nowadays.

Infrastructure that works has very little drama. Without drama, you're not in anyone's sphere of attention, and being outside that, there's no reason to be sexy.

I agree. I'm a sysadmin myself, and the best congratulations I've ever had was after heavy rewrite of a firewall script (old one was a mix of three different styles, unmanagable mess after several years of work), when my colleague asked me when I'm going to deploy the new firewall, two or three weeks after it actually went into production. It was so smooth that nobody noticed.

Everywhere I've worked, mostly very small companies for the past decade, has kept local mirrors of critical infrastructure we depend on, specifically distro repositories, CPAN, etc. It's just a sane best practice. It really doesn't take all that much work to run apt-mirror or reprepro.

My somewhat small company does this for Debian packages, maven artifacts, etc. We use Artifactory for all of it.

They do it where I work, because our ops and dev teams like it when deploys don't randomly break.

Devops here for a startup: We run our own repo for critical packages specifically to ensure AMI baking and deploys do not break when a package isn't available for whatever reason (and we pin to the package version).

Reply on news.ycombinator.com