Reproducible build using Nix (nerdctl build-nix)#582
Reproducible build using Nix (nerdctl build-nix)#582AkihiroSuda wants to merge 1 commit intocontainerd:masterfrom
nerdctl build-nix)#582Conversation
AkihiroSuda
force-pushed
the
experimental-build-nix
branch
2 times, most recently
from
a7a7ac2 to
9022539
Compare
| "-v", nixutil.CacheVolumeName + ":/nix", | ||
| "-w", "/mnt", | ||
| nixImage, | ||
| "sleep", "infinity", |
There was a problem hiding this comment.
I assume that a non-null entrypoint can cause problems
There was a problem hiding this comment.
cmd.Flags().String("nix-image", defaults.NixImage, "Nix image")
nix-image can be set by the user and nothing prevents having an image with an entrypoint ["/ bin/sh /," sleep","infinity"] => /bin/sh sleep infinity sleep infinity.
not sure if this should be considered the responsibility of nerdctl user or us
See `examples/build-nix/nginx` ``` nerdctl build-nix nerdctl run -d -p 8080:80 nginx:nix ``` (WIP: still not fully reproducible) Signed-off-by: Akihiro Suda <[email protected]>
AkihiroSuda
force-pushed
the
experimental-build-nix
branch
from
9022539 to
cc4556a
Compare
| if _, err := os.Stat(file); err != nil { | ||
| return err | ||
| } | ||
| dir := filepath.Dir(file) |
There was a problem hiding this comment.
nix-build can only refer to files under filepath.Dir(file)? Should be documented somewhere maybe.
And the following doesn't work:
nerdctl build-nix -f /hello.nix
WARN[0000] This command is experimental and subject to change.
FATA[0004] failed to read link: /proc/12988/fd/3: readlink /proc/12988/fd/3: no such file or directory
nerdctl build-nix -f /tmp/ctx/hello.nix do work though.
| ``` | ||
| nerdctl build-nix | ||
| nerdctl run -d -p 8080:80 nginx:nix | ||
| ``` |
There was a problem hiding this comment.
Maybe the expected digest of the result image should be documented so that users can confirm that build-nix is reproducible.
|
Now I'm experimenting this as a Dockerfile frontend |
3 participants
See
examples/build-nix/nginxWIP: still not fully reproducible
Tar digest: sha256:0407cfb8e7195c62b58fe5f4b4f8ef92f8fbdaeb7b4b444a9d4da5496f855ec4is always reproducible, butImageIDchanges after nuking~/.local/share/containerdDue to:
Import()creates non-deterministic images containerd#6307