Re:The sad state of sysadmin in the age of containers (2015)
by adrianN on Monday December 09, 2019 @05:59AM
(#21741691)
It's pretty hard to do truly declarative/immutable things with docker because the typical dockerfile starts with "apt-get update && apt-get install ...". For that use case I think nix is much better.
Re:The sad state of sysadmin in the age of containers (2015)
by doliveira on Monday December 09, 2019 @06:14AM
(#21741750)
Linters complain when you don't pin the version, though
Re:The sad state of sysadmin in the age of containers (2015)
by adrianN on Monday December 09, 2019 @06:37AM
(#21741843)
That's what I tried doing. The result was that the docker container didn't build anymore because at least one of the packages we used had a a patch release every other day and apt only serves the most up to date version.
Re:The sad state of sysadmin in the age of containers (2015)
by onion2k on Monday December 09, 2019 @05:51AM
(#21741672)
Except if you mean every time there's a security update, you rebuild your containers?
That's exactly what you should be doing, at least if you're relatively small scale. Google probably takes a different approach but most of us aren't working at that scale.
Re:The sad state of sysadmin in the age of containers (2015)
by pram on Monday December 09, 2019 @05:52AM
(#21741675)
First: No one installs Hadoop from scratch, and Hadoop isn't built with Docker. Companies use Ambari or other distros like EMR.
Second: Yes, generally you can use a build system like Jenkins, and a registry like Artifactory to automate the process. The docker image is updated, and then you can push it out with your orchestration in whatever method you choose. It's not an obscure or difficult thing to manage..
The fact that they can get away with a build system like this is very much due to docker (and curl | sudo bash) allow people to not feel the pain this mess causes, at least not right away.
> Yes, I have! In fact you can maintain patch compliance in a container pretty much the same way you'd maintain a VM or bare metal Linux installation!
But then you lose the declarative/immutable nature of docker, no? Except if you mean every time there's a security update, you rebuild your containers?