mikepurvis

You actually can sort of do this just inside a modern docker file, with COPY --link

That version of copy overlays the copied content without any knowledge of its underlay, so if the underlay changes, the hash of the layer created by COPY remains identical.

Obviously there are lots of situations this doesn't work for, but say you have a pool of Ubuntu packages (the system layer) and then you separately copy a CMake installspace or built uv project from a build stage, that project layer can be identical in hash if it's copied onto an updated system layer.

In practice, it's hard to get this to work because it's very easy in docker to accidentally trigger a rebuild for some random reason, but all the pieces are there.

It's first-principles thinking. You have to have some sense of how you would do it in order to reasonably engage with a machine's idea of how to do it. Otherwise you're just nodding along, like yeah sure bro uhhhh lgtm.

I think the number one thing that bites a lot of container workflows is when you have a separate "base image" build that depends on external, mutable package sources using tools that don't support locking, such as apt.

This gets worse for each additional such layer, for example if you start from ubuntu:whatever and have a system deps layer, then an application deps layer, then static assets, then your app's code. Unless you think about it upfront when designing the pipeline, it can be challenging to trace all that state backwards and figure out how to safely re-build thing-from-x-weeks ago but with a single unsafe package bumped forward.

Every shop with competent devops people present should be set up for this, but it usually doesn't come for free.

That sounds like a scary investment to make on behalf of what's effectively a single customer. Without some kind of contractual commitment that locks in volume and price, they would really have you over a barrel.

Should it also predate Docker by a decade? That would be crazy.

Isn't that the world that Docker gives us, basically?

On some level, yes, though when I choose a saas product, what I'm really choosing is not a basket of features, but rather someone else to be worrying about scaling, monitoring, security patches, uptime, etc.

Like in theory your agents can build all that too, but all the ancillary bits benefit a lot from being spread across a pool of users with different time zones, release cycles, whatever.

I bet we'll see more KVM-for-X type products appearing, basically multiplexers for various storage devices and peripherals, as ways of giving agents control over them.

I think this tool is meant to be something you impose on your colleagues who treat all code like the second bucket.

That's horrifying to hear. I also went on a multi day dive trip at gbr and the coral sea in 2007 and it was spectacular; I can't imagine going back and seeing it degraded.

I guess? I was on a date with someone and we took an uber back to her place after a concert, and she mentioned off-hand afterward that had I not been there she would have just walked... even though it would have been over an hour on foot, it just wasn't worth the risk after multiple bad/creepy experiences taking carshares home late at night.

Maybe it's a bit like cops: they're not all bad, but the system is kind of set up so that bad ones thrive and good ones burn out. It's going to be a particularly kind of person who is willing to spend their late Friday night driving drunk people home from the club, and honestly if you're a vulnerable person, maybe the guy most willing to do that job is the one you least want as your particular driver.

I'm not sure if I buy this, it seems like it's a bit of a turtles-all-the-way-down discussion. Like a vulnerable person ordering a taxi also has a phone, which is the ultimate surveillance endpoint, and opens them up to potential abusive behaviour from employees of their phone maker, their telco, and every app they have on there, including the rideshare ones which by necessity have precise location and other permissions.

At the end of the day, a man driving them home and knowing their home address while right there is a much more immediate and specific point of threat than "I'm being surveilled while I travel in a Google-controlled robotaxi".

Also, like it or hate it, but Google actually has a pretty decent track record with protecting their customers from their own employees. Gmail and gsuite content stays private, and there are enough protections in place to satisfy insurance companies, medical institutions, banks, and even governments. If a Waymo kidnapped or killed someone under the control of an overseas remote operator, it would be national news and congressional hearings; a person getting assaulted by a cab driver is nowhere near that level.

I just don't think "but Google/Waymo bad too" is a reason to poo poo someone feeling more comfortable sitting alone in a robotaxi than sitting alone in a cab or an uber.