> How do you know that the docker image was created with the right set of software?
Define "the right set". If I ask someone to prepare something I might use
docker export/diff
in part of the review process.
> How do you know that there wasn't anything else added to it?
docker diff
> Copying the final image means you're just copying an opaque binary blob. You can't do the work yourself to build an image, and get the same docker image.
So what?
Why exactly do you think "copying an opaque binary blob" is bad?
Don't you ever copy files on your hard disk?
Have you ever used `dd` to copy a filesystem as a binary blob to a disk or a USB key?
Did you know "git" copies "opaque binary blobs" around? Do you really prefer RCS because the version control is stored in plain text files?
What exactly is your complaint here?
My position is simple, but apparently radical: I recommend interactive development of systems because it is better, and I define better as faster and more secure. "Reproducible" simply is not a goal.
> For me, it's not about ease of use. It's about security and trust.
You should rethink your position.
Nix packages from sources you don't trust aren't more secure than docker images (even if you use nix.useChroot=true), which, barring bugs in docker and Linux, at least get virtual memory, disk, and networking.
Nix packages built by yourself are harder to write than docker tags you build yourself.
Define "the right set". If I ask someone to prepare something I might use
in part of the review process.> How do you know that there wasn't anything else added to it?
> Copying the final image means you're just copying an opaque binary blob. You can't do the work yourself to build an image, and get the same docker image.So what?
Why exactly do you think "copying an opaque binary blob" is bad?
Don't you ever copy files on your hard disk?
Have you ever used `dd` to copy a filesystem as a binary blob to a disk or a USB key?
Did you know "git" copies "opaque binary blobs" around? Do you really prefer RCS because the version control is stored in plain text files?
What exactly is your complaint here?
My position is simple, but apparently radical: I recommend interactive development of systems because it is better, and I define better as faster and more secure. "Reproducible" simply is not a goal.
> For me, it's not about ease of use. It's about security and trust.
You should rethink your position.
Nix packages from sources you don't trust aren't more secure than docker images (even if you use nix.useChroot=true), which, barring bugs in docker and Linux, at least get virtual memory, disk, and networking.
Nix packages built by yourself are harder to write than docker tags you build yourself.