<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>paulddraper</author><text>A larger problem is that Docker is nearly inherently unreproducible.&lt;p&gt;Downloading and installing system packages lists, etc.&lt;p&gt;For this reason, Google doesn&amp;#x27;t use Docker at all.&lt;p&gt;It writes the OCI images more or less directly. &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;bazelbuild&amp;#x2F;rules_docker&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;bazelbuild&amp;#x2F;rules_docker&lt;/a&gt;</text><parent_chain><item><author>oconnor663</author><text>&amp;gt; The first version is to lock down every dependency as tightly as you can to avoid accidentally breaking something...The second version is upgrade early, upgrade often...Google is an excellent example of a company that does this.&lt;p&gt;This is misleading. My understanding of Google&amp;#x27;s internal build systems is that they &lt;i&gt;ruthlessly&lt;/i&gt; lock down the version of every single dependency, up to and including the compiler binary itself. They then provide tooling on top of that to make it easier to upgrade those locked down versions regularly.&lt;p&gt;The core problem is that when your codebase gets to the kind of scale that Google&amp;#x27;s has, if you can&amp;#x27;t reproduce the entire universe of your dependencies, there is no way any historical commit of anything will ever build. That makes it difficult to do basic things like maintain release branches or bisect bugs.&lt;p&gt;&amp;gt; if you want to lock down version numbers for a specific release, have an automated tool supply the right ones for you. And make it trivial to upgrade early, and upgrade often.&lt;p&gt;This part sounds like a more accurate description of what Google and others do, yes.</text></item><item><author>btilly</author><text>I have a mixed opinion about his first point.&lt;p&gt;There are two basic approaches to take with dependency management.&lt;p&gt;The first version is to lock down every dependency as tightly as you can to avoid accidentally breaking something.  Which inevitably leads down the road to everything being locked to something archaic that can&amp;#x27;t be upgraded easily, and is incompatible with everything else.  But with no idea what will break, or how to upgrade.  I currently work at a company that went down that path and is now suffering for it.&lt;p&gt;The second version is upgrade early, upgrade often.  This will occasionally lead to problems, but they tend to be temporary and easily fixed.  And in the long run, your system will age better.  Google is an excellent example of a company that does this.&lt;p&gt;The post assumes that the first version should be your model.  But having seen both up close and personal, my sympathies actually lie with the second.&lt;p&gt;This is not to say that I&amp;#x27;m against reproducible builds.  I&amp;#x27;m not.  But if you want to lock down version numbers for a specific release, have an automated tool supply the right ones for you.  And make it trivial to upgrade early, and upgrade often.</text></item></parent_chain></comment><story><title>Simple Dockerfile examples are often broken by default</title><url>https://pythonspeed.com/articles/dockerizing-python-is-hard/</url></story>
<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>dalore</author><text>Yes they have a huge mono repository and tooling to update projects in it to specific versions. You don&amp;#x27;t get a choice really. You can go home one night with your project on say Java 7 and then wake up and find someone has migrated it to Java 8 because they&amp;#x27;ve decided it&amp;#x27;s Java 8 now.</text><parent_chain><item><author>oconnor663</author><text>&amp;gt; The first version is to lock down every dependency as tightly as you can to avoid accidentally breaking something...The second version is upgrade early, upgrade often...Google is an excellent example of a company that does this.&lt;p&gt;This is misleading. My understanding of Google&amp;#x27;s internal build systems is that they &lt;i&gt;ruthlessly&lt;/i&gt; lock down the version of every single dependency, up to and including the compiler binary itself. They then provide tooling on top of that to make it easier to upgrade those locked down versions regularly.&lt;p&gt;The core problem is that when your codebase gets to the kind of scale that Google&amp;#x27;s has, if you can&amp;#x27;t reproduce the entire universe of your dependencies, there is no way any historical commit of anything will ever build. That makes it difficult to do basic things like maintain release branches or bisect bugs.&lt;p&gt;&amp;gt; if you want to lock down version numbers for a specific release, have an automated tool supply the right ones for you. And make it trivial to upgrade early, and upgrade often.&lt;p&gt;This part sounds like a more accurate description of what Google and others do, yes.</text></item><item><author>btilly</author><text>I have a mixed opinion about his first point.&lt;p&gt;There are two basic approaches to take with dependency management.&lt;p&gt;The first version is to lock down every dependency as tightly as you can to avoid accidentally breaking something.  Which inevitably leads down the road to everything being locked to something archaic that can&amp;#x27;t be upgraded easily, and is incompatible with everything else.  But with no idea what will break, or how to upgrade.  I currently work at a company that went down that path and is now suffering for it.&lt;p&gt;The second version is upgrade early, upgrade often.  This will occasionally lead to problems, but they tend to be temporary and easily fixed.  And in the long run, your system will age better.  Google is an excellent example of a company that does this.&lt;p&gt;The post assumes that the first version should be your model.  But having seen both up close and personal, my sympathies actually lie with the second.&lt;p&gt;This is not to say that I&amp;#x27;m against reproducible builds.  I&amp;#x27;m not.  But if you want to lock down version numbers for a specific release, have an automated tool supply the right ones for you.  And make it trivial to upgrade early, and upgrade often.</text></item></parent_chain></comment><story><title>Simple Dockerfile examples are often broken by default</title><url>https://pythonspeed.com/articles/dockerizing-python-is-hard/</url></story>