> You do not need to repeat the steps to produce the first machine to produce the second machine. You can simply clone the first machine, and Docker makes this very easy to do.
That's nice for cloning, it's not reproducability.
How do you know that the docker image was created with the right set of software? How do you know that there wasn't anything else added to it?
Copying the final image means you're just copying an opaque binary blob. You can't do the work yourself to build an image, and get the same docker image.
Something like "nix" makes that simple. Everyone can agree on the steps required to get from A to Z. Everyone can independently agree that each step looks the same for everyone.
For me, it's not about ease of use. It's about security and trust.
> How do you know that the docker image was created with the right set of software?
Define "the right set". If I ask someone to prepare something I might use
docker export/diff
in part of the review process.
> How do you know that there wasn't anything else added to it?
docker diff
> Copying the final image means you're just copying an opaque binary blob. You can't do the work yourself to build an image, and get the same docker image.
So what?
Why exactly do you think "copying an opaque binary blob" is bad?
Don't you ever copy files on your hard disk?
Have you ever used `dd` to copy a filesystem as a binary blob to a disk or a USB key?
Did you know "git" copies "opaque binary blobs" around? Do you really prefer RCS because the version control is stored in plain text files?
What exactly is your complaint here?
My position is simple, but apparently radical: I recommend interactive development of systems because it is better, and I define better as faster and more secure. "Reproducible" simply is not a goal.
> For me, it's not about ease of use. It's about security and trust.
You should rethink your position.
Nix packages from sources you don't trust aren't more secure than docker images (even if you use nix.useChroot=true), which, barring bugs in docker and Linux, at least get virtual memory, disk, and networking.
Nix packages built by yourself are harder to write than docker tags you build yourself.
That's nice for cloning, it's not reproducability.
How do you know that the docker image was created with the right set of software? How do you know that there wasn't anything else added to it?
Copying the final image means you're just copying an opaque binary blob. You can't do the work yourself to build an image, and get the same docker image.
Something like "nix" makes that simple. Everyone can agree on the steps required to get from A to Z. Everyone can independently agree that each step looks the same for everyone.
For me, it's not about ease of use. It's about security and trust.