Bazel plus nix.

This feels like the way, but comes with the huge caveat that it doesn't work with bazel remote execution (unless you can rig up something to sync your nix store to every remote builder).

I haven't used it personally, but the Nix manual mentions support for dealing with Nix stores in distributed builds https://nixos.org/manual/nix/unstable/advanced-topics/distri...

You have to remember that it was the very first system to even attempt hermetic & deterministic builds.

Combine that with the fact that C++ toolchains at least make assumptions all over the place about being spewed over `/usr`... I think they just bowed out to practicality at that point.

You're definitely right it should use hermetic toolchains. I'm curious which other Bazel-like build system does that by default?

I wouldn't call it a bazel-like, per-se, but Nix seems to have tamed C++.

I don't think it was easy, though.

As I understand it Nix can do hermeticity on a project level, but not on a build step level like you would need for actual development. So it's good for building OSes. Not for building software products.

I agree they target slightly different use cases, but I don't think that's a good excuse for why bazel can't be more hermetic out of the box.

> You have to remember that it was the very first system to even attempt hermetic & deterministic builds.

Given its Google-internal predecessors, it’s not clear how priority should be established (the general guideline in science is that non-public is not science, but that might not be what we care about here). The public Bazel, though, is from 2015, while the first releases of Nix date back all the way to 2004[1] and the thesis is from 2006.

Now Nix is not really at its best if used as a general-purpose build system, but it certainly has and uses hermetic toolchains.

[1] https://releases.nixos.org/nix/nix-0.5/manual/manual.html

Yeah it can be done but it's painful. In general the Bazel rules are lower quality than Bazel itself - and rules_python is one of the better ones!

I agree this is one of the biggest weak points of Bazel. It lacks a distribution that provides all these goodies out of the box, with maintained and documented workflows. Setting up hermetic builds and remote caches, builds & execution requires a whole team of experts right now.