← Back to context

Comment by ktosobcy

1 year ago

I don't have any experience with Nix but regarding stable builds of Docker: we provide Java application, have all dependencies as fixed versions so when doing a release, if someone is not doing anything fishy (re-releasing particular version, which is bad-bad-bad) you will get exactly same binaries on top of the same image (again, considering you are not using `:latest` or somesuch)...

6 comments

ktosobcy

Reply
janjongboom  1 year ago

Until someone overwrites or deletes the Docker base image (regularly happens), or when you depend on some packages installed through apt - as you'll get the latest version (impossible to pin those).

  • theamk  1 year ago

    I am convinced that any sort of free public service is fundamentally incomapatible with long term reproducible builds. It is simply unfair to expect free service to maintain archives forever and never clean them up, rename itself, or go out of business.

    If you want reproducibility, the first step is to copy everything to a storage you control. Luckily, this is pretty cheap nowdays

  • ktosobcy  1 year ago

    > Until someone overwrites or deletes the Docker base image (regularly happens)

    Any source of that claim?

    > or when you depend on some packages installed through apt - as you'll get the latest version (impossible to pin those).

    Well... please re-read my previous comment - we do Java thing so we use any JDK base image and then we slap our distribution on top of it (which are mostly fixed-version jars).

    Of course if you are after perfection and require additional packages then you can install it via dpgk or somesuch but... do you really need that? What about security implications?