Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Will Nix Overtake Docker?

blog.replit.com

Post reply on HN
Print view View original

61–70 of 259 posts

Re: Will Nix Overtake Docker?

#61

Post by lvass »

exdsq wrote: post #44
lvass wrote: post #33

Earlier quoted context omitted.

I've always kept my usage of Nix language to a minimum and found it to be a joy every time. But it's no wonder you'd have trouble on something that humongous. Why did it get so large?

Nix can do everything and that's an issue - suddenly the CI servers, AWS deployments, build servers, testing, linting, dev package management, dev system environments, and more are all written in Nix packages. You need to write nix bindings. You need to add nix caching. And, as is fitting with a functional language, it can be beautifully (read: painfully) abstract. Some of the guys on the team were contributors to Ni…

Sounds like your scientists were so preoccupied with whether or not they could, they didn’t stop to think if they should. Would it be nicer if you just used Nix to build the application and a shell, in the simplest possible manner?

Re: Will Nix Overtake Docker?

#62

Post by cbrewster »

paxys wrote: post #57

The article starts and ends with "they are very different tools for different use cases". What was even the point of writing the whole thing hypothesizing whether one will replace the other?

Author here. It's titled this way because Docker seems to come up in a lot of discussions around Nix and is often compared with Nix. Partly because of their overlap in functionality but also because people may not understand the difference between the two. The goal here was to a) highlight the different use-cases between the two tools b) compare the tools in the areas that they overlap and c) show how both tools can be used together.

Re: Will Nix Overtake Docker?

#63

Post by treis »

cbrewster wrote: post #28
throwaway9870 wrote: post #15

> If you run docker build twice with the same Dockerfile you might get 2 images that behave in different ways. For example, a third-party package could silently be updated and cause breakage. Aggressively pinning dependency versions helps, but doesn't completely prevent this issue. If "aggressive" means fully, then why doesn't that fix the issue?

Author here. In our case, we had a large base Docker image called Polygott ( https://github.com/replit/polygott ) it pulls in dependencies for 50+ different languages from various repositories. We would pin things where possible, but its still very difficult to ensure reproducible builds. Additionally, docker builds have free access to the network to do anything it would like. Nix goes to great lengths to sandbox bui…

Why do you need reproducible builds for Docker? The whole point is that you build it once and then you use that container on as many servers as you want.

Re: Will Nix Overtake Docker?

#65

Post by exdsq »

lvass wrote: post #61
exdsq wrote: post #44

Earlier quoted context omitted.

Nix can do everything and that's an issue - suddenly the CI servers, AWS deployments, build servers, testing, linting, dev package management, dev system environments, and more are all written in Nix packages. You need to write nix bindings. You need to add nix caching. And, as is fitting with a functional language, it can be beautifully (read: painfully) abstract. Some of the guys on the team were contributors to Ni…

Sounds like your scientists were so preoccupied with whether or not they could, they didn’t stop to think if they should. Would it be nicer if you just used Nix to build the application and a shell, in the simplest possible manner?

This is totally fine and I like it, my worry is scope creep once it’s in. Nix repl to experiment with new languages is really cool. Reversing updates to my OS is amazing. If I could have a rule that that is the limit - personal dev environments - but with additional support for docker then I’d be very happy.

Re: Will Nix Overtake Docker?

#66

Post by cbrewster »

treis wrote: post #63
cbrewster wrote: post #28

Earlier quoted context omitted.

Author here. In our case, we had a large base Docker image called Polygott ( https://github.com/replit/polygott ) it pulls in dependencies for 50+ different languages from various repositories. We would pin things where possible, but its still very difficult to ensure reproducible builds. Additionally, docker builds have free access to the network to do anything it would like. Nix goes to great lengths to sandbox bui…

Why do you need reproducible builds for Docker? The whole point is that you build it once and then you use that container on as many servers as you want.

What happens when you need to update some dependency within that image? Now you have to do an image rebuild. If you're lucky only the top-most layers will be rebuilt and the base layers stay the same, if you're unlucky nearly the whole image is rebuilt. Usually we just want to update some subset of dependencies, but during the rebuild some other dependencies may get updated unintentionally (eg if they aren't pinned to a particular version). For most, this may not be an issue but at Replit, everyone's projects use this base Docker image. Unintended updates can cause breakage for our users.

Re: Will Nix Overtake Docker?

#68

Post by mason55 »

Volundr wrote: post #45
throwaway9870 wrote: post #40

Earlier quoted context omitted.

Not custom copies, but a locked down cache of packages. For Gentoo you can do this by locking the portage tree you use and keeping a copy of the distfiles from the first run, for Python it was a requirements.txt file with a cache of the tar files from PyPi, for go it was including 3rd party code in repo. I don't know what the team did for npm. It was really nice doing a full image rebuild and knowing the only thing t…

I'm genuinely curious about this. How are you distributing these caches so that if I do a build on my machine it'll produce the exact same image as on yours? If I'm understanding what you mean by "cache" (I'm thinking the node_modules folder for example for NPM) it'd certainly work, but it feels like a logistical nightmare to me.

We host our own Maven and PyPi. External artifacts get pulled into the cache and devs get all their artifacts form our cache. If an artifact already exists in the cache then we never update it.

Super easily honestly, one of those things that we never even think about until someone upstream does something that would have screwed us anyway, like republishing a version number

Re: Will Nix Overtake Docker?

#69

Post by doublepg23 »

abathur wrote: post #5
edude03 wrote: post #2

No, it definitely (but unfortunately) will not. Nix does everything docker does better than docker does, except most crucially, integrate with non nix tooling. Nix vs Docker is like Rust vs JavaScript - you can point out every reason js is terrible and rust is better, but for the common developer looking to get things done, they’ll often gravitate to the tool that gets them the biggest impact with the least upfront i…

I like to compare Nix to ice-nine from Cat's Cradle, in that it tends towards restructuring whatever it comes into contact with.

Funny you mention that. Guix which is a fork (of sorts) of Nix is written in Guile Scheme which uses ice-9 as it's namespace in a lot of places. https://lists.gnu.org/archive/html/guile-devel/2010-07/msg00...
Post reply on HN