Finally someone understands what really annoys me when I say that docker isn't 100% reproducible if you aren't using version pinning or something similar.
If you have 2 developers, and one of them does a build the next day, you could have them with two different versions of a package when the version went up.
That should scare people.
NixOS on the other hand, builds everything in sandboxes that only expose the requested dependencies. Builds are almost 100% deterministic. The cherry on top is that your system installation is simply a package consisting of all other packages and configuration symlinked together, and you replace your entire system in one go (atomically, by writing a symlink).
If the build fails at any point along the chain, you get an error and your system remains unchanged. You can totally switch from one major release to the next (and back) without hassle.
I worked at a place where they'd spin up a new gentoo box for a dev with stock "emerge foo" and let everything run up.
Then 3 weeks later, they'd do it again for the next dev, and they'd have many diff versions.
I know they weren't "doing it right", but they were doing it the default way they learned, and it caused a lot of problems.
Thanks for the info/clarification though.
Ideally, I want _both_ of them: tagged Docker images being sent between environments (with `docker run -e SOME_ENV=testing imagename` for changing the internal config), but reproducible builds in my Dockerfile. I wonder if Nix can be used to achieve that last part?
Images are nothing but a caching technique for the results of deterministic builds.
If you're using them for any other reason, you have a flawed process that is going to come back to bite you some day.
It's a hard problem to solve, and Nix helps a lot, but it's not going to fix all the problems, which is why we should care more about trusting the packager to package something relatively reproducible and sign it so that we it can be vouched for.
and it is actually rather cool since you don't rely on any docker command :)
> DISCLAIMER: This project is no longer actively maintained and probably broken