I know full well what OCI is. (Hint: it's a transparent attempt to be a NOT-docker and avoid infringing on whatever Docker Inc.'s latest monetization scheme is.)
Using this for what Nix is doing is absolute madness. Docker is madness in general, but dragging it into Nix's core is madness cubed.
"why yes, the open-source Apache-licensed implementation controlled by the linux foundation is just as commercial as the commercial thing! i'm so contrary and interesting!"
if you don't want docker-contributed code, here are some alternative implementations of the spec: https://github.com/opencontainers/runtime-spec/blob/main/imp... I believe nix could use one of these with some volunteer effort? Perhaps you could even be the one to purge the Docker heresy from the project!
(...in hindsight, i'm sorry for posting this, it's needlessly adversarial and picky. i was mad at something unrelated this morning and i shouldn't have taken that out on you.)
The implementation of Nix's build sandboxing is outside of the core focus of Nix. The macOS sandboxing code is famously buggy. Seems like a perfectly reasonable thing to leave to a battle-hardened, standardized, outside implementation to me.
Comments
A complete non-starter, never in a thousand years am I gonna use something that requires a Docker installation for building derivations.
Maybe once you learn what OCI is, you'll rethink that ;)
I know full well what OCI is. (Hint: it's a transparent attempt to be a NOT-docker and avoid infringing on whatever Docker Inc.'s latest monetization scheme is.)
Using this for what Nix is doing is absolute madness. Docker is madness in general, but dragging it into Nix's core is madness cubed.
Would this be the equivalent of Mock (Fedora) or sbuild (Debian) pristine chroot builders? Containers are just fancy chroots.
"why yes, the open-source Apache-licensed implementation controlled by the linux foundation is just as commercial as the commercial thing! i'm so contrary and interesting!"
if you don't want docker-contributed code, here are some alternative implementations of the spec: https://github.com/opencontainers/runtime-spec/blob/main/imp... I believe nix could use one of these with some volunteer effort? Perhaps you could even be the one to purge the Docker heresy from the project!
OCI is not an attempt for a useful, general-purpose, open containerization standard.
It is an attempt at an open-source "just good enough" Docker clone.
You understand the difference?
(...in hindsight, i'm sorry for posting this, it's needlessly adversarial and picky. i was mad at something unrelated this morning and i shouldn't have taken that out on you.)
The implementation of Nix's build sandboxing is outside of the core focus of Nix. The macOS sandboxing code is famously buggy. Seems like a perfectly reasonable thing to leave to a battle-hardened, standardized, outside implementation to me.
Podman is also an option.
No, I don't want "dollar store Docker" either.