6 ms·

Is Docker (or any other container platform) a facilitator to reproducible builds? Making the environment standard between builds is probably easier in a contain

Is Docker (or any other container platform) a facilitator to reproducible builds? Making the environment standard between builds is probably easier in a container.

georgyo 9y ago
Builds have been happening in single use chroots for a very long time. The problem is if code includes the current date, or generates some randomness at build time. These issues must be identified and patched.
0xcde4c3db 9y ago
Docker is part of a broader "reproducible build environment" strategy, but doesn't really help with some of the things that cause problems (timestamps, kernel version, random IDs).
- wtallis 9y ago
  Docker seeks to reproduce a functionally equivalent software environment, motivated by version management concerns. Debian is trying to reproduce bitwise identical build products, motivated by security concerns.
samueloph 9y ago
Debian builders already run on sbuild[1], which uses chroot, so it's already a contained environment. I'm not sure how the reproducible builds machines works for forcing two different build results, but i'd bet they're using sbuild too. Here's a diffoscope of one of my packages which is not reproducible right now[2]. I also highly recommend the reproducible builds talk at this year's debconf with the repro build folks[3]. [1]https://wiki.debian.org/sbuild https://wiki.debian.org/sbuild [2]https://tests.reproducible-builds.org/debian/rb-pkg/unstable/i386/diffoscope-results/aircrack-ng.html https://tests.reproducible-builds.org/debian/rb-pkg/unstable... [3]https://debconf17.debconf.org/talks/14/ https://debconf17.debconf.org/talks/14/
zdw 9y ago
Docker images built with the first-party toolchain aren't reproducible - if you run `docker build ...` on a Dockerfile, then delete the image and rerun it, you'll get a different set of image hashes. This is likely due to timestamp embedding. There are other toolsets that supposedly create byte-identical Docker images generation (Bazel, some others), but I haven't tried them.

Is Docker (or any other container platform) a facilitator to reproducible builds? Making the environment standard between builds is probably easier in a container.

georgyo 9y ago

Builds have been happening in single use chroots for a very long time. The problem is if code includes the current date, or generates some randomness at build time. These issues must be identified and patched.

0xcde4c3db 9y ago

Docker is part of a broader "reproducible build environment" strategy, but doesn't really help with some of the things that cause problems (timestamps, kernel version, random IDs).

wtallis 9y ago
Docker seeks to reproduce a functionally equivalent software environment, motivated by version management concerns. Debian is trying to reproduce bitwise identical build products, motivated by security concerns.

samueloph 9y ago

Debian builders already run on sbuild[1], which uses chroot, so it's already a contained environment. I'm not sure how the reproducible builds machines works for forcing two different build results, but i'd bet they're using sbuild too. Here's a diffoscope of one of my packages which is not reproducible right now[2]. I also highly recommend the reproducible builds talk at this year's debconf with the repro build folks[3]. [1]https://wiki.debian.org/sbuild https://wiki.debian.org/sbuild [2]https://tests.reproducible-builds.org/debian/rb-pkg/unstable/i386/diffoscope-results/aircrack-ng.html https://tests.reproducible-builds.org/debian/rb-pkg/unstable... [3]https://debconf17.debconf.org/talks/14/ https://debconf17.debconf.org/talks/14/

zdw 9y ago

Docker images built with the first-party toolchain aren't reproducible - if you run `docker build ...` on a Dockerfile, then delete the image and rerun it, you'll get a different set of image hashes. This is likely due to timestamp embedding. There are other toolsets that supposedly create byte-identical Docker images generation (Bazel, some others), but I haven't tried them.