docker-library-redis

eing reproducible either. As a result, when you 'docker build' that over time, it's very unlikely you'll get a bit-for-bit identical redis binary at the other end. Even a minor gcc version change will likely result in a different binary. As a contrast to this, let's look at a reproducible build of redis using nix. In nixpkgs, it looks like so [1]. If I want a reproducible shell environment, I simply have to pin down its dependencies, which can be done by the following: let pkgs = import (builtins.fetchTarball { url = "https://github.com/NixOS/nixpkgs/archive/48dfc9fa97d762bce28cc8372a2dd3805d14c633.…"; sha256 = "0mqq9hchd8mi1qpd23lwnwa88s67ac257k60hsv795446y7dlld2"; }) {}; in pkgs.mkShell { buildInputs = [ pkgs.redis]; } If I distribute that nix expression, and say "I ran it with nix version 2.3", that is sufficient for anyone to get a bit-for-bit identical redis binary. Even if the binary cache (which lets me not compile it) were to go away, that nixpkgs revision expresses the build instructions, including the exact version of gcc. Sure, if the binary cache were deleted, it would take multiple hours for everything to compile, but I'd still end up with a bit-for-bit identical copy of redis. This is true of the majority of nix packages. All commands are run in a sandbox with no access to most of the filesystem or network, encouraging reproducibility. Network access is mediated by special functions (like fetchTarball and fetchGit) which require including a sha256. All network access going through those specially denoted means of network IO means it's very easy to back up all dependencies (i.e. the redis source code referenced in [1]), and the sha256 means it's easy to use mirrors without having to trust them to be unmodified. It's possible to make an unreproducible nix package, but it requires going out of your way to do so, and rarely happens in practice. Conversely, it's possible to make a reproducible dockerfile, but it requires going out of your way to do so, and rarely happens in practice. Oh, and for bonus points, you can build reproduible docker images using nix. This post has a good intro to how to play with that [2]. [0]: https://github.com/docker-library/redis/blob/bfd904a808cf68d... [1]: https://github.com/NixOS/nixpkgs/blob/a7832c42da266857e98516... [2]: https://christine.website/blog/i-was-wrong-about-nix-2020-02...