6 ms·

Until someone overwrites or deletes the Docker base image (regularly happens), or when you depend on some packages installed through apt - as you'll get the lat

Until someone overwrites or deletes the Docker base image (regularly happens), or when you depend on some packages installed through apt - as you'll get the latest version (impossible to pin those).

ktosobcy 3y ago
> Until someone overwrites or deletes the Docker base image (regularly happens) Any source of that claim? > or when you depend on some packages installed through apt - as you'll get the latest version (impossible to pin those). Well... please re-read my previous comment - we do Java thing so we use any JDK base image and then we slap our distribution on top of it (which are mostly fixed-version jars). Of course if you are after perfection and require additional packages then you can install it via dpgk or somesuch but... do you really need that? What about security implications?
- janjongboom 3y ago
  > Any source of that claim? Any tag like ubuntu:20.04 -> this tag gets overwritten every time there's a new release (which is very often) https://hub.docker.com/r/nvidia/cuda https://hub.docker.com/r/nvidia/cuda -> these get removed (see e.g. https://stackoverflow.com/questions/73513439/on-what-condition-is-docker-images-tag-deleted-from-dockerhub https://stackoverflow.com/questions/73513439/on-what-conditi...)
  - lolinder 3y ago
    Do you have an example that isn't Nvidia? They're infamous for terrible Linux support, so an egregious disregard for tag etiquette is entirely unsurprising.
  - ktosobcy 3y ago
    You gave example of nvidia and not ubuntu itself. What's more, you are referring to devel(opment) version, i.e. "1.0-devel-ubuntu20.04" which seems like a nightly so it's expected to be overriden (akin to "-SNAPSHOT" for java/maven)? Besides, if you really need utmost stability you can use image digest instead of tag and you will always get exactly the same image...
theamk 3y ago
I am convinced that any sort of free public service is fundamentally incomapatible with long term reproducible builds. It is simply unfair to expect free service to maintain archives forever and never clean them up, rename itself, or go out of business. If you want reproducibility, the first step is to copy everything to a storage you control. Luckily, this is pretty cheap nowdays

Until someone overwrites or deletes the Docker base image (regularly happens), or when you depend on some packages installed through apt - as you'll get the latest version (impossible to pin those).

ktosobcy 3y ago

> Until someone overwrites or deletes the Docker base image (regularly happens) Any source of that claim? > or when you depend on some packages installed through apt - as you'll get the latest version (impossible to pin those). Well... please re-read my previous comment - we do Java thing so we use any JDK base image and then we slap our distribution on top of it (which are mostly fixed-version jars). Of course if you are after perfection and require additional packages then you can install it via dpgk or somesuch but... do you really need that? What about security implications?

janjongboom 3y ago
> Any source of that claim? Any tag like ubuntu:20.04 -> this tag gets overwritten every time there's a new release (which is very often) https://hub.docker.com/r/nvidia/cuda https://hub.docker.com/r/nvidia/cuda -> these get removed (see e.g. https://stackoverflow.com/questions/73513439/on-what-condition-is-docker-images-tag-deleted-from-dockerhub https://stackoverflow.com/questions/73513439/on-what-conditi...)
- lolinder 3y ago
  Do you have an example that isn't Nvidia? They're infamous for terrible Linux support, so an egregious disregard for tag etiquette is entirely unsurprising.
- ktosobcy 3y ago
  You gave example of nvidia and not ubuntu itself. What's more, you are referring to devel(opment) version, i.e. "1.0-devel-ubuntu20.04" which seems like a nightly so it's expected to be overriden (akin to "-SNAPSHOT" for java/maven)? Besides, if you really need utmost stability you can use image digest instead of tag and you will always get exactly the same image...

theamk 3y ago

I am convinced that any sort of free public service is fundamentally incomapatible with long term reproducible builds. It is simply unfair to expect free service to maintain archives forever and never clean them up, rename itself, or go out of business. If you want reproducibility, the first step is to copy everything to a storage you control. Luckily, this is pretty cheap nowdays