Re:Nix as OS X Package Manager
by xyzzy_plugh on Wednesday May 25, 2016 @08:54PM
(#11774407)
The problem is tagged images are fundamentally broken. If I can't reproduce, bit-for-bit, what is in the tag, how can I vouch for the tag?
Images are nothing but a caching technique for the results of deterministic builds.
If you're using them for any other reason, you have a flawed process that is going to come back to bite you some day.
You solve it by signing the image. Sometimes you just won't be able to get a completely reproducible build processes that's fully deterministic, so Nix cannot fix this problem entirely. Additionally, sometimes you just don't have time, or experience to take another program/tool you didn't write and package it up such that it never downloads things from the internet.
It's a hard problem to solve, and Nix helps a lot, but it's not going to fix all the problems, which is why we should care more about trusting the packager to package something relatively reproducible and sign it so that we it can be vouched for.
Re:Nix as OS X Package Manager
by ramblenode on Wednesday May 25, 2016 @08:52PM
(#11774393)
Yes, you can do this. There is a utility "nix-docker" that will convert a Nix configuration file into a BusyBox Docker image (see e.g. http://zef.me/blog/6049/nix-docker)
with nix you can now build docker images ... docs are in the manual http://nixos.org/nixpkgs/manual/#sec-pkgs-dockerTools
and it is actually rather cool since you don't rely on any docker command :)
Unfortunately the repo says:
> DISCLAIMER: This project is no longer actively maintained and probably broken
Ideally, I want _both_ of them: tagged Docker images being sent between environments (with `docker run -e SOME_ENV=testing imagename` for changing the internal config), but reproducible builds in my Dockerfile. I wonder if Nix can be used to achieve that last part?