Live data from Hacker News

Will Nix Overtake Docker?

blog.replit.com

221–230 of 259 posts

Re: Will Nix Overtake Docker?

#221
post #29

Oh god I hope not. Having worked in > 100kloc nix environments I am completely turned off of the idea. I really really tried, I installed NixOS as my main OS and used Nix whenever I could to try and pick it up, but it's such a complex beast I felt it slowed everything down. Simple tasks that would take 10 minutes in Docker suddenly became DevOps tickets. I suddenly had to write bindings for tools rather than apt-get…

This mirrors my experience as a developer in an org that used Nix. If you want the dev team to have a strong dependency on the devops team for every little (often unpredictable) aspect of their workflow, Nix is the tool for the job. Don’t get me wrong, I’m completely bought in on the vision of reproducible builds but there’s a long ways to go before it’s usable in real organizations. I’ve heard that some orgs manage…

Many orgs get reproducible builds by using different build tools and abstractions. Eg Amazon gets it via their Brazil tool.

Re: Will Nix Overtake Docker?

#222

Earlier quoted context omitted.

> and if there are conflicts between dependencies of the services they can go into different containers. Getting the benefit of Nix - reproducibility - without the extra effort To be clear, are you suggesting that RUN sudo apt-get update && sudo apt-get -y install ... is somehow reproducible? I'm asking because I was surprised to see the above as being described as "reproducible" of all things. Splitting that into ma…

I am frustrated that you ignored my main argument about Docker sufficiently serving the same business function as Nix, with lower maintenance. Instead you focused on a semantic argument about one word in my post - "reproducible". You have the wrong idea about reproducibility, where you say basically everything that is not Nix or Guix is not reproducible. This ignores things like conda and techniques like package vers…

> I am frustrated that you ignored my main argument

Your main argument was that Docker "sufficiently" serves the same goal of reproducibility. I just pointed out how it doesn't come anywhere close. Addressing the core of an argument is far from a "semantic" argument.

> where you say basically everything that is not Nix or Guix is not reproducible

My definition of reproducibility is that you get identical build results every time, which should meet the definition you quoted from Wikipedia. "docker build," which runs arbitrary shell commands with network access, is the farthest thing possible from any sane definition of "reproducible."

> Also Nix provides a worse experience for pinning dependency versions

The exact opposite is true. No other system-level package managers like apt or yum truly supports pinning packages. With apt or yum, packages in a repository snapshot are tightly coupled together since they're all installed into a single shared location. It's not possible to swap out or pin a subset of packages without the risk of breakage.

Nix provides a truly working way to pin packages. Packages are installed into its own isolated location to avoid collisions and dependencies are explicitly specified. This makes it possible to mix packages from stable channels, unstable channels, and even specific git commits of those channels. This can't be done with apt or yum.

Language-level package managers are somewhat more flexible regarding pinning, but still has problems. More on that next.

> No, you need to pin the dependency versions. With Python this practice is already normalized with requirements.txt or conda yml files.

Yet CI builds constantly break because Python dependencies are a moving target. And no, the SAT solver doesn't make the builds deterministic. The fact that you even need a SAT solver just makes it clear that dependency management is getting out of hand and we need better tools.

> If you add the height of the Debian packages with Pypi and Hackage you already have Nix beat. ... If Nix were better off then people would be adapting Nix packages to other ecosystems.

I don't know why you believe Nix and only Nix has to compete with all other package managers combined. You must really dislike it if you can convince yourself that is fair comparison.

But Nix can be used along with other package managers, so I don't see the point here. The only anomaly here are Docker images, that monolith binary blob that doesn't compose well like packages in other package managers.

And speaking of fairness

> or a maintainer does it with a much smaller code review

Where did you get this idea from? Nix has a growing community and Nixpkgs is one of the most active repositories on GitHub. Other package repositories with the possible exception of Homebrew and AUR has a much higher barrier to entry, which would most definitely result in, "smaller code review."

> Nix project people commit directly to master frequently and do self-merges of PRs

Self-merges are nowhere near being unique to Nixpkgs so it's unfair to only call Nixpkgs out for it. And if you count language-specific package repositories like NPM or PyPI, you should assume there is zero code review for most packages.

While regrettably there are self-merges in Nixpkgs, it is definitely in the minority and a lot of those changes are especially trivial stuff. Since Nixpkgs has a vibrant community, things like this tend to get attention and some community members are keeping an eye on it and is quick to bring these instances up. It's also worth noting that the Nix community is especially invested in automated testing compared to other package managers and these are run on PRs that ends up being self-merged.

> With Nix, you are forced to make new packages based on existing packages.

That is 100% FUD.

> "if the existing packages doesn't fit your needs", compiling from source is not a big deal since Docker caches output artifacts.

It is a big deal that you can't reuse code with non-Nix package managers. Docker caching isn't relevant and does nothing to deal with maintainability or reproducibility issues. Our company maintains custom OpenSSL RPMs, and it has been a constant source of pain due to RPM's lack of code reusability. Now we also have to maintain our own version of every single package that relies on our build of OpenSSL, which is a nightmare. This wouldn't have been a problem with Nix.

Re: Will Nix Overtake Docker?

#223
post #91

As TFA itself answers, "no". But I can give a different reason: nix is too much of a barrier of entry, relative to Docker. Docker might not be simple ; there's a lot of moving parts to manage, some hidden gotchas, and networks are a mess. But it's comparatively easy , and once you bake an image, it's pretty simple . Dockerfiles are basically just sh. Package managers are the usual suspects. Images are easy to distrib…

I agree, there’s a reason no one uses Nix. It has terrible DX

Well "no one" is a bit absolute. But colloquially, I know what you mean. Relative to Docker, it's way less popular. But it has 5.2k stars on https://github.com/NixOS/nix .

But yeah. The DX "needs work". which is a nice way of saying, I find it downright painful to use.

Re: Will Nix Overtake Docker?

#224
post #192

Earlier quoted context omitted.

> It's just as easy to make a mistake with git today as it was however many years ago; Pro tip from an actual pro : git became significantly easier for me once I decided 1. to just use a good comfortable gui (at least one tui also look good) for anything beyond commit and push. (maybe not everything can be done from your gui of choice but at least you get a good overview of the situation before you dive in with the c…

Which git GUI do you recommend? The one in VSCode I find even more confusing than the CLI. I do agree with you that some workflows are just easier with a GUI, since I used to use TortoiseSVN and it was much nicer for diffing two commits than the CLI is. But I haven't really dug into git GUIs.

I recommend finding one or more that you like, my preferences doesn't always match everyone elses ;-)

At times I have used ungit or git extensions (which, despite its name contains a full desktop application.

Today I use VS Code with a combination of Git Branch for visualization and Git Lens for the rest. Git Lens might need some configuration (I rarely use all the panes, but I use the interactive rebase tool from it as well as some annotationn features. For the visual rebase tool to work I had to configure VS Code as my git editor, but that is how I like it anyway.)

Again: try a few, find one that makes sense for you.

Jetbrains tools for example are generally good, liked by many and well though I understand, but still the git visualization (and a couple of other things) consistently manages to confuse me.

Re: Will Nix Overtake Docker?

#225

Earlier quoted context omitted.

The Nix syntax being complex is something that is taken for a given in online circles, but it's actually one of the most simple languages that I've learned. The Nix syntax is in essence just JSON with functions which consists of the following building blocks: * Primitive values (strings, numbers, paths, booleans, null) * Lists and sets * Variables * Functions * Conditionals * Assertions * Arithmetic operators And tha…

It is not necessary what it can do the problem, but how it does it. Looking at the page you link for example: https://nixos.org/manual/nix/stable/expressions/expression-s... > > Strange, but let's say ok. But then, in the example, where does the function end? Then, > Looking at that, I say whaaaattt? "derivation" does not mean anything obvious to anyone used to build packages. And then, as the subtitle said, did they…

The section you linked to was not specifically about syntax, but a high level overview that is explained in detail later on. For syntax, you should look at https://nixos.org/manual/nix/stable/expressions/expression-l.... It should explain things like where how you write functions.

> Looking at that, I say whaaaattt? "derivation" does not mean anything obvious to anyone used to build packages. And then, as the subtitle said, did they decide to use a weird name just to confuse everyone for the pleasure?

The same kind of reaction can be made to any programming concept introduced in an introductory material. I don't think it's fair to ridicule Nix for defining its own technical terms, especially when the writing you referred to explains what it is. It is somewhat light on details, but you can't possibly expect an introductory section to explain it all at once. It should be enough to keep you going.

But to answer your question, a derivation is the low-level build instruction that Nix's package builder can parse and build packages out of. You use the Nix language to convert high level package definitions to Nix derivations before feeding it to the package builders.

Re: Will Nix Overtake Docker?

#226
post #36

Somewhat not related and likely dumb question but I figure folks looking at this article can help steer me in the right direction: if I want containers to act like Linux VMs what's the best option? Like Docker minus the assumption that I only want a few specific directories to persist or the idea I'm interested in layering containers in a way that lets me reproduce building them. Like if I just want another separate…

You might want to have a look at systemd-nspawn [1], which is basically containerized chroot based on linux namespaces. [1] https://www.freedesktop.org/software/systemd/man/systemd-nsp...

This is exactly what I needed! Thank you!

Re: Will Nix Overtake Docker?

#227
post #218
post #185

Earlier quoted context omitted.

Unless auth is concerned. There are loads of tools I run that I want to just be me. Not whatever user is configured in the image. And learning how to manage that mapping was a heck of a time sink.

How you going to run those tools on CI? Or by your colleagues? These are all questions that need answering anyway, regardless of your usage of Docker.

I already authed as me on my machine. Annoying to also have to auth as me in the container.

Or have we reached the stage where folks have secrets management for containers fully orchestrated at a personal user level?

Re: Will Nix Overtake Docker?

#228
post #182

Earlier quoted context omitted.

It's well documented that Docker and especially docker hub had a terrible impact on security. Once you factor in the efforts required in the long term to mitigate a decade of bundling gigabytes of applications and libraries it's a huge "dev adventure"

Just build your own images like you would otherwise install the software on bare metal. Base those images on official images, not community images.

> Just build your own images

This is like saying "just wear a mask": it's not enough.

You rely on what other people are doing now and what they've done in the past.

This is an ecosystem problem, not an an individual problem.

Re: Will Nix Overtake Docker?

#229
post #147

Guix supports exporting to Docker containers. A guix.scm file then becomes a reproducible alternative to a Dockerfile. However, Guix has its own container implementation. And this is significantly lighter than Docker (instead of layers, links to /gnu/store) and is root-less. If Guix containers had a runc-compatability layer and better docs/tutorials, it would be hard to go back to Docker/podman.

I have been using Guix-generated reproducible Docker images for years. I'll never go back to using Docker directly. Could you please elaborate what you mean by "runc-compatability layer"? And what about the docs requires clarification? (I wrote the original Docker export backend for "guix pack", so I have an interest in improving this feature where necessary.)

I am referring to a hypothetical dockerless OCI compatability layer built on top of `guix shell --container` or `guix system container`.

I sort of got this idea from runj [0], an attempt to create an OCI compatible runtime for FreeBSD jails.

The main advantage is to use certain OCI-compatible tools (e.g. k8s) with Guix without needing to use Docker.

[0] https://samuel.karp.dev/blog/2021/03/runj-a-new-oci-runtime-...

Re: Will Nix Overtake Docker?

#230
post #192

Earlier quoted context omitted.

> It's just as easy to make a mistake with git today as it was however many years ago; Pro tip from an actual pro : git became significantly easier for me once I decided 1. to just use a good comfortable gui (at least one tui also look good) for anything beyond commit and push. (maybe not everything can be done from your gui of choice but at least you get a good overview of the situation before you dive in with the c…

Which git GUI do you recommend? The one in VSCode I find even more confusing than the CLI. I do agree with you that some workflows are just easier with a GUI, since I used to use TortoiseSVN and it was much nicer for diffing two commits than the CLI is. But I haven't really dug into git GUIs.

https://www.syntevo.com/smartgit/ It's the most similar I've found to TortoiseHg which is the standard, and excellent, Mercurial GUI. (TortoiseGit does not live up to the family name)
Post reply on HN