Hacker News Reader

A larger problem is that Docker is nearly inherently unreproducible.

Downloading and installing system packages lists, etc.

For this reason, Google doesn't use Docker at all.

It writes the OCI images more or less directly. https://github.com/bazelbuild/rules_docker

well also docker's sha hash for each layer is just a random sha and not a sha of the actual content. also it includes a timestamp. thus docker is not reporducible. but google actually has kaniko and jib which correct that problem.

Your first point is incorrect. That was true of v1 docker images, but layers have been content-addressable for a while now.

Your second point is absolutely correct - we strip timestamps from everything which tends to confuse folks :)

Thou shalt be able to recognise the Unix Epoch 0

> true of v1 docker images

yeah I missed that one. but basically it was still a pain. But yeah google's tools are actually awesome. I mean I even own a "fork" (or basically a plugin) for sbt which brings jib to sbt: https://github.com/schmitch/sbt-jib It's just so much easier to build java/scala images with jib than it is with plain docker.

Reply on news.ycombinator.com