[pkg-go] [Docker-maint] Guidance for packaging Docker for Debian

[Arnaud Rebillout]

On 03/15/2018 07:52 PM, Martín Ferrari wrote:
> On 15/03/18 09:22, Arnaud Rebillout wrote:
>
>> So I made a beginner mistake, but I'm learning, and hopefully I'm on the
>> right track !
> Don't worry, we've all been there.. the go ecosystem is a mess.

>From what I understand, Go is just not ready for shared libraries yet,
but there's plan to improve that, so let's be patient !

>
>> I don't know what's the best way to deal with this situation, so if
>> anyone from the team can provide some advice, that would be super welcome !
> I sometimes have kept small dependencies vendored in for convenience..
> But keeping the whole containerd seems wrong to me. Specially
> considering that it is something that can have security implications.
> Vendoring means nobody knows that version is there, so no audits; and
> the problem of patching separate copies, with different versions, when
> there is some patch to urgently apply..
>
> In an ideal world, we should try to convince the docker people to use
> stable APIs (that means using only released non-alpha versions!), or at
> least to fix the incompatibilities with 1.0.2. I think it is at least
> worth a try.
>
> The other way, which we have done many times, is to patch the software
> ourselves. I have no idea why docker does not build with that version,
> but sometimes it is not that difficult to fix.

At a first glance I thought some bits of the containerd API were missing
in the latest version, compared to the alpha. But I was wrong, after a
closer look I see that it's just been moved, so I will try to patch
swarmkit to build against the latest containerd. If it works I will
submit my patch upstream and see how it goes.

Thanks for all the explanation !

   Arnaud