Hacker News Reader

Comment by nextos | Hacker News Reader

Very interesting. I'm curious, have you considered nixos?

Yes, very much so. In fact, our goal is to have NixOS based containers. Right now, we're using Debian as the base image, and there's /no/ guarantee that the versions of software installed are consistent (since Docker caches based on the line in a Dockerfile, rather than what's actually installed).

With Nix, we can have version guarantees in all of our Docker images--including the cached images.

I blogged about this the other day and would love to hear about your experience!

http://gregoryszorc.com/blog/2014/10/13/deterministic-and-mi...

This is spot-on what I'd like to do, and I have the exact same concerns. Thanks for sharing!

Well sure there can be a guarantee.

`RUN apt-get install some_package=<version>` If you want a newer version, update the Dockerfile with the version you want.

That package could install some other dependencies, and those dependencies aren't pinned down.

That depends on how the package is specified doesn't it? You can snapshot the full chain of versions with dpkg and explicitly specify them all. It should be too hard to wrap this into something like Gemfile.lock

Great. I have a major complaint about Nix. Their packages are built with all sorts of dependencies included. So you install mutt and you end up getting python. Or you install git and you also get subversion.

I understand all their philosophy, but they should allow for flexible runtime dependencies without the need for rebuilding packages. Perhaps with a second hash or something, to sign dependencies.

Reply on news.ycombinator.com