Nixery – Docker images on the fly with Nix
1–10 of 90 posts
Re: Nixery – Docker images on the fly with Nix
#2This is amazing because it takes the promise of "caching Docker layers", which doesn't usually work out well in practice, and actually delivers on it.
Re: Nixery – Docker images on the fly with Nix
#3This looks really nice, it saves making the Dockerfile yourself. And just sometimes you want an image but with a bit of extra in it for debugging. If normally you pull that image directly with this you don’t need to setup a build to build and push the custom image only to scuttle it again later.
What is interesting though is that nix is all about reproducible builds but I don’t see a way to specific packaged versions here.
Re: Nixery – Docker images on the fly with Nix
#4Oh great! More indirection. Now when I want to deploy my web app I can check my private nixery.dev deployment is properly configured in Nix to build my Docker images so I can deploy my containers to the cloud so someone can access me Rest API. And the cost of guaranteeing builds will probably work? Running your own nixery service, learning Nix, and learning Docker. I would love someone to do a cost-benefit analysis of these sorts of tools against the time of using (and sometimes debugging) Make and/or Bash. I’m so cynical of Nix lol - no disrespect to the OP/Author, I just want to work on problems but most of my time is spent on building and deploying stuff.
Re: Nixery – Docker images on the fly with Nix
#5This looks really nice, it saves making the Dockerfile yourself. And just sometimes you want an image but with a bit of extra in it for debugging. If normally you pull that image directly with this you don’t need to setup a build to build and push the custom image only to scuttle it again later. What is interesting though is that nix is all about reproducible builds but I don’t see a way to specific packaged versions…
I belive that if you host your own nixery instance, you can pass a nixpkgs commit hash as a docker tag
Re: Nixery – Docker images on the fly with Nix
#6Is there a clean way to do reuse this for multistage builds?
```
FROM nixery.dev/shell/git/node14/python3.8 as debug_extras
FROM our/production:1.2.3
COPY --from=debug_extras /nixstuff /ubuntu/stuff
RUN python -c "print('nice!')"
```
Re: Nixery – Docker images on the fly with Nix
#7Oh great! More indirection. Now when I want to deploy my web app I can check my private nixery.dev deployment is properly configured in Nix to build my Docker images so I can deploy my containers to the cloud so someone can access me Rest API. And the cost of guaranteeing builds will probably work? Running your own nixery service, learning Nix, and learning Docker. I would love someone to do a cost-benefit analysis o…
Do you actually use nix and have an experience to share?
Re: Nixery – Docker images on the fly with Nix
#8Is there a clean way to do reuse this for multistage builds? ``` FROM nixery.dev/shell/git/node14/python3.8 as debug_extras FROM our/production:1.2.3 COPY --from=debug_extras /nixstuff /ubuntu/stuff RUN python -c "print('nice!')" ```
You could copy over the nix store, though your path wouldn’t be set up correctly to find the programs you want.
Re: Nixery – Docker images on the fly with Nix
#9This is really cool, but I don’t know if I see the appeal for actual nix users — if you are a nix user and have it set up in CI, you can easily build docker images yourself using buildLayeredImage.
And then if you aren’t a nix user, why would you use this? Installing packages with, say, apt, is decidedly not where my pains with docker have arose.
Re: Nixery – Docker images on the fly with Nix
#10Oh great! More indirection. Now when I want to deploy my web app I can check my private nixery.dev deployment is properly configured in Nix to build my Docker images so I can deploy my containers to the cloud so someone can access me Rest API. And the cost of guaranteeing builds will probably work? Running your own nixery service, learning Nix, and learning Docker. I would love someone to do a cost-benefit analysis o…
This really isn't too different than what is already done, but it does as you say add more layers of indirection.
Consider: Prior to Docker, you'd typically go to AWS or a virtual host provider, spin up your OS of choice, install any relevant system dependencies, language runtimes, set up a CI/CD pipeline, and finally deploy.
The only real difference between what I just described and Docker / Nix / additional layers is that we (as an industry/profession) have not yet built sufficiently ergonomic tooling to make this trivial.
AWS and similar cloud providers did away with much of the server and network setup. Docker has done away with some of the application environment setup.
All that said, Nix does seem to be trying to replace something we already have a workable answer to (host/app config). Whether or not the additional overhead is worthwhile even after ergonomics have caught up will probably depend on your own use-cases.
I can see it being useful for high-trust environments (finance, medicine, anything else regulated). It could also do a lot to improve the general security of the OSS ecosystem by giving projects a path forward to truly reproducible binaries. Outside of those contexts, you probably don't care until tooling gets to the point where you can opt-in and get those guarantees "for free".