Hacker News Reader

Comment by 8organicbits | Hacker News Reader

> grab a drop-in binary

This is a cool approach on Docker as well.

    FROM some:thing AS bins
    FROM debian:latest
    COPY --from=bins /bin/foo /bin/

View on HN

Agreed, if the binary is statically linked. If you run `file` on the output from that and it shows 'dynamically linked' then you're playing games with porting over libraries, changing the library loading path, or just going full chroot like linux from scratch does with the bootstrapping part of the install. I find static binaries simplest to work with in that context but agreed I use that pattern too with docker and generally build ad-hoc tools within containers like that. If only these devices could run docker but I'm left to my own tooling to figure out per device.

Agreed, dynamically linked binaries don't drop in well.

In a way, that's what Nix sets out to do, isolating even dynamically linked libraries: if two derivations depend on the same shared lib derivation then it's reused, if not then they don't conflict. Each leaf derivation can be handled completely independently of the others, and independently of the original system†.

And then when Nix† is not an option at runtime, dockerTools†† can build a Docker image to do the minimisation+isolation.

That said, Nix might also be completely overkill in some scenarios where static linking would be just fine and very practical. The practical simplicity of a single binary should not be overlooked.

† nixpkgs is sufficient, a full nixos is not needed

†† https://nixos.org/manual/nixpkgs/stable/#sec-pkgs-dockerTool...

So Nix keeps track of different versions of shared libraries?

Yeah, each package/lib is stored in a unified directory by it's hash https://zero-to-nix.com/concepts/nix-store. Different variation different hash.

You've missed nix-bundle and pkgsStatic, which are much closer to the above idea re: copying to another machine.

Reply on news.ycombinator.com