31–40 of 293 posts
For end user devices, I much prefer Nix/NixOS [1] for this kind of thing. With Flakes [2] (experimental feature), you get full reproducibility. The documentation is spotty and there is a considerable learning curve, but I've switched to NixOS on my laptop and desktop early this year and am mostly very happy with it. That doesn't cover sandboxing though. I would actually agree that sandboxing / restricting application…
Docker for every application? If you create and maintain the Docker image or Dockerfile for every applucation yourself, you must have plenty of time. If you rely on public images from Docker Hub, you must have plenty of trust in the creators of those images.
Perhaps Nix might help here, but I've never used it, so can't say for sure.
Just some counter arguments to @jbergknoff's well put together page! Docker is the best medium for distributing - A static file is far easier to share / distribute. Cross-platform - You need an arguably complex and unstable Linux interface to run Docker images, cgroups et al Sandboxed - security claims about Docker have always been controversial. Simple Unix/BSD constructs like chroot/jails are far simpler and they a…
But if none of those are a requirement for your use case (or you have workarounds), I agree that statically linked binaries can be a nicer solution than Docker.
I'm in the same situation: until I figure (if ever) how to use NixOS and control version my OS, I tend to use Docker for any application with lots of dependencies, specially Python related ones
Reach out to me if you want to learn Nix I'm always happy to help people climb the steep learning curve
I've been using debian for a long time and would prefer not to have to switch OSs but the idea of using nix for having full control over my package graph is very tempting.
I've been somewhat procrastinating on trying nix as I've heard GNU Guix has a similar feature set and haven't been able to decide on which one to dive into...
My ideal setup would be to just be able to run a single shell script that configures a new machine to the exact state of all my other dev machines. I have a shell script that somewhat does this but it's not completely unattended and still requires a lot of manual config for certain steps.
Aside from that my main use case is being able to easily share a dev/build environment with others for ensuring that they can compile a certain project exactly as I do. For now I just use docker but it's frustrating not having explicit control over the layer cache and being able to tell it what to cache and what not to.
> If you’re using Docker on a Mac and you’ve never tried it on Linux, you owe it to yourself to try it on Linux. So ultimately the recommendation is to install Linux and use it as my daily driver. But Linux does not run on my machine yet.
And MacOS does? Is this some Apple Silicon humble brag? Cuz that's "Apple doesn't allow developers and enthusiasts to do their thing on their own computer that they purchased" not "Linux doesn't run on my machine".
Jessie also has a blog post about this [1] from back in 2015. If you prefer video format, Jessie also has a talk at DockerCon SF 2015 [2].
[0] https://github.com/jessfraz/dockerfiles
[1] https://blog.jessfraz.com/post/docker-containers-on-the-desk...
Docker for every application? If you create and maintain the Docker image or Dockerfile for every applucation yourself, you must have plenty of time. If you rely on public images from Docker Hub, you must have plenty of trust in the creators of those images.
Hmmm... what alternative does not either take time or trust?
I run most of my apps in containers on my developer workstation as well. Once containers became popular and I noticed that a few of my apps were available as container images on DockerHub, it just made sense from a resource and security point of view. This is the first post I've seen advocating it, but I think it is sage advice for anyone.
> On a Mac, there is a major performance hit whenever you do disk IO in a bind mount (i.e. voluming a directory of the host system into the container). Working without bind mounts is extremely limiting. [..] If you’re using Docker on a Mac and you’ve never tried it on Linux, you owe it to yourself to try it on Linux. Or use named volumes. I'm running a dockerized WordPress dev environment on my MacBook with average T…
There was a very in-depth thread on the docker forums where the devs explained why there was such a huge performance penalty. IIRC it was due to all the extra bookkeeping that had to be done to ensure strong consistency and correct propagation of file system events between the virtualized docker for mac environment and the host file system.
The test suite would run integration tests that performed a lot of npm/yarn operations which meant lots of disk IO.