Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wolfi: A community Linux OS designed for the container and cloud-native era

github.com

Post reply on HN
Print view View original

51–60 of 89 posts

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#51

Post by Rucadi »

dlor wrote: post #25
kristianpaul wrote: post #24

Distroless or not, maintainers are required… but for me running docker pull debian still does the job. Whats wrong with current distros vuln assesment and security reporting to have another one?

Debian does a great job! But here's one example where their packaging system makes container workloads hard. Debian, like many other distros has a strict "one version of every package" rule, meaning that Debian only ships one version of common things like programming languages or webservers. If you "apt-get install nodejs", you can only have Node.js v18, in the very very recently released Debian bookworm. If your dev…

Wouldn't then using nix be better? Or at least base the distro on nix?

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#52

Post by xnyanta »

I've attended a local CNCF meetup where the chainguard folks presented Wolfi and their related tools to create container images and SBOMs.

I was already skeptical of the product, having heard of it before. Unfortunately, attending that talk confirmed to me that they've just re-invented a severely limited version of Nix powered by yaml files that can output SBOMs in a standard format.

Their software repository only has around 500 packages vs the 80k+ in nixpkgs. When I read "Alpine Linux", I was immediately reminded of its use of the musl libc which has endless DNS resolution issues[1][2] in and outside of Kubernetes, however, thankfully, it seems like they realized bundling musl was a bad idea and ship glibc instead.

I'll stick to Nix and nixpkgs to build my reproducible container images with full dependency graphs back to the source code.

1: https://martinheinz.dev/blog/92

2: https://news.ycombinator.com/item?id=35058094

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#53

Post by dlor »

xnyanta wrote: post #52

I've attended a local CNCF meetup where the chainguard folks presented Wolfi and their related tools to create container images and SBOMs. I was already skeptical of the product, having heard of it before. Unfortunately, attending that talk confirmed to me that they've just re-invented a severely limited version of Nix powered by yaml files that can output SBOMs in a standard format. Their software repository only ha…

We're rapidly approaching 10k packages, here's today's count:

/ # apk update fetch https://packages.wolfi.dev/os/aarch64/APKINDEX.tar.gz [https://packages.wolfi.dev/os] OK: 9494 distinct packages available

We're definitely coming at this from a different angle from Nix, but the approaches are pretty complementary. I'm a big fan of all the work they do.

musl vs. glibc is one of the big departures we make from Alpine though, we use glibc everywhere because of those issues you pointed out.

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#54

Post by JeremyNT »

To save some people a click, the headline made me assume this was something like CoreOS, but this is in fact the opposite.

It's not a traditional Linux distro you can actually run standalone, it's just another base for building OCI containers.

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#56

Post by xnyanta »

dlor wrote: post #53
xnyanta wrote: post #52

I've attended a local CNCF meetup where the chainguard folks presented Wolfi and their related tools to create container images and SBOMs. I was already skeptical of the product, having heard of it before. Unfortunately, attending that talk confirmed to me that they've just re-invented a severely limited version of Nix powered by yaml files that can output SBOMs in a standard format. Their software repository only ha…

We're rapidly approaching 10k packages, here's today's count: / # apk update fetch https://packages.wolfi.dev/os/aarch64/APKINDEX.tar.gz [ https://packages.wolfi.dev/os ] OK: 9494 distinct packages available We're definitely coming at this from a different angle from Nix, but the approaches are pretty complementary. I'm a big fan of all the work they do. musl vs. glibc is one of the big departures we make from Alpine…

> OK: 9494 distinct packages available

I opened that apkindex file and it had duplicate entries for a ton of packages with different versions, taking a look at https://github.com/wolfi-dev/os I only see about 840 yaml files which I assume define the packages. I don't think claiming to have 10k packages when only 10% of them are actually different pieces of software is a good claim to make. Nixpkgs would have millions of packages if we added up every single unique package from every revision.

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#57

Post by p4bl0 »

Before reading the linked page, I thought this was about a Linux distribution optimized to run both local but containerized applications and remote/cloud web applications, kind of a ChromeOS like distribution with the same focus on simplicity and security, but with an addition local execution approach based on containers, and less tied to Google.

So, this is not at all this, but now I wonder if a distribution like the one I imagined exists?

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#58

Post by amouat »

JeremyNT wrote: post #54

To save some people a click, the headline made me assume this was something like CoreOS, but this is in fact the opposite. It's not a traditional Linux distro you can actually run standalone, it's just another base for building OCI containers.

Yeah, it's definitely not a platform for running containers. Apologies for any confusion there.

But regarding being a full linux distro, we're really just missing the kernel and I could see that happening at some point in the future.

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#59

Post by dlor »

xnyanta wrote: post #56
dlor wrote: post #53

Earlier quoted context omitted.

We're rapidly approaching 10k packages, here's today's count: / # apk update fetch https://packages.wolfi.dev/os/aarch64/APKINDEX.tar.gz [ https://packages.wolfi.dev/os ] OK: 9494 distinct packages available We're definitely coming at this from a different angle from Nix, but the approaches are pretty complementary. I'm a big fan of all the work they do. musl vs. glibc is one of the big departures we make from Alpine…

> OK: 9494 distinct packages available I opened that apkindex file and it had duplicate entries for a ton of packages with different versions, taking a look at https://github.com/wolfi-dev/os I only see about 840 yaml files which I assume define the packages. I don't think claiming to have 10k packages when only 10% of them are actually different pieces of software is a good claim to make. Nixpkgs would have millions…

The real number is probably somewhere in the middle - one yaml file can define many packages - see the gcc or clang or argocd ones for examples of that.

glibc explodes into a few dozen, for example.

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#60

Post by amouat »

xnyanta wrote: post #56
dlor wrote: post #53

Earlier quoted context omitted.

We're rapidly approaching 10k packages, here's today's count: / # apk update fetch https://packages.wolfi.dev/os/aarch64/APKINDEX.tar.gz [ https://packages.wolfi.dev/os ] OK: 9494 distinct packages available We're definitely coming at this from a different angle from Nix, but the approaches are pretty complementary. I'm a big fan of all the work they do. musl vs. glibc is one of the big departures we make from Alpine…

> OK: 9494 distinct packages available I opened that apkindex file and it had duplicate entries for a ton of packages with different versions, taking a look at https://github.com/wolfi-dev/os I only see about 840 yaml files which I assume define the packages. I don't think claiming to have 10k packages when only 10% of them are actually different pieces of software is a good claim to make. Nixpkgs would have millions…

I think it's more subpackages such as -dev, -lib and -doc variants. These are defined as part of the parent package but count as distinct packages.
Post reply on HN