Show HN: Docker-based immutable workstation
@lifeisstillgood - in the spirit of mutual embarrassment...<p><a href="https:&#x2F;&#x2F;github.com&#x2F;ramses0&#x2F;docker-devenv" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;ramses0&#x2F;docker-devenv</a><p><a href="https:&#x2F;&#x2F;github.com&#x2F;ramses0&#x2F;docker-devenv&#x2F;blob&#x2F;master&#x2F;Dockerfile" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;ramses0&#x2F;docker-devenv&#x2F;blob&#x2F;master&#x2F;Dockerf...</a><p>I found it useful to separate OS configuration out from installing non-OS software (third-party)... it&#x27;s basically a cue&#x2F;cost that makes me prefer OS-level installations over &quot;manual&quot; installs.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;ramses0&#x2F;dotfiles" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;ramses0&#x2F;dotfiles</a><p><a href="https:&#x2F;&#x2F;github.com&#x2F;ramses0&#x2F;dotfiles&#x2F;blob&#x2F;master&#x2F;bash&#x2F;profile" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;ramses0&#x2F;dotfiles&#x2F;blob&#x2F;master&#x2F;bash&#x2F;profile</a><p>...lots of hardcoded and ugly stuff in there, but I like the idea of it a lot.<p>My experience has been mixed, but good overall:<p>1) docker mounts local host&#x27;s *.ssh info, and mounts &quot;~&#x2F;host&quot; dir and &quot;~&#x2F;Git&quot; dir (promotes some of the host FS to top-level directories) ... this is primarily around me coding &#x2F; working with Git, so it&#x27;s the right choice for me.  It&#x27;s nice for the auth story to mostly properly follow me around as I move from computer to computer (primary auth is on local host, this image expects my local auth is properly set up).<p>2) docker FS isolation is interesting... you can &quot;apt install $foo&quot; in different windows&#x2F;instances and system level changes are effectively isolated and disposable.  It allows near instantaneous install of certain packages (ie: &quot;apt install ffmpeg&quot;) and the command will be gone after that particular session (unless I decide it&#x27;s something I use often enough to be added to the docker recipe).  Contrast this the cruft on a 5-year old home linux box which has 1000&#x27;s of packages installed from running random tutorials from the net.<p>3) startup time is quick and roughly equivalent to booting an old x86 PC.  No matter how much I screw up the (inside the docker) operating system, it&#x27;s just a quick &quot;reboot&quot; to fix it back to the last known-good state<p>4) VNC&#x2F;X11 is &quot;meh&quot; and more of a parlor trick.  However, there&#x27;s interesting use cases to making an &quot;appliance docker image&quot; ... Firefox works OK, and is maybe a good idea for carrying around a &quot;paranoid browser&quot;, but it definitely feels a bit uncomfortable.<p>5) I know the non-OS install stuff (ie: heroku, rustc, etc) can likely be done in the initial Dockerfile step, it forces me to make sure the system stays in a consistent state.  When something isn&#x27;t pulled directly from Debian, it&#x27;s likely that there&#x27;s a more compelling story to make sure the software stays installable and up to date (ie: vim plugins, etc).  I guess it feels a bit like a local version of homebrew recipes?<p>6) As a hack, I cobbled together a &quot;build&#x2F;bake&quot; concept which locks down a particular set of the non-OS stuff as well.  When &quot;baked&quot; the image doesn&#x27;t really auto-update (tough to automate version control against certain random sources&#x2F;installs), but I have some scripts which try to keep the base OS up-to-date, encouraging you to go through the &quot;build-bake&quot; cycle as time goes on, keeping the box &quot;evergreen&quot;.<p>An example victory is when on a windows box, I can get &quot;real&quot; vim, bash, etc. and operate on windows files from within linux (something that WSL can&#x27;t officially do).<p>On the mac-side, I can get &quot;sort -R&#x2F;--random-sort&quot; when processing random data, as well as the ability to quickly pulldown ffmpeg, or imagemagick... again in a &quot;disposable&quot; environment, without seriously jeopardizing my OSX install and building up cruft.