On 03/15/2018 07:52 PM, Martín Ferrari wrote: > On 15/03/18 09:22, Arnaud Rebillout wrote: > >> So I made a beginner mistake, but I'm learning, and hopefully I'm on the >> right track ! > Don't worry, we've all been there.. the go ecosystem is a mess.
From what I understand, Go is just not ready for shared libraries yet, but there's plan to improve that, so let's be patient ! > >> I don't know what's the best way to deal with this situation, so if >> anyone from the team can provide some advice, that would be super welcome ! > I sometimes have kept small dependencies vendored in for convenience.. > But keeping the whole containerd seems wrong to me. Specially > considering that it is something that can have security implications. > Vendoring means nobody knows that version is there, so no audits; and > the problem of patching separate copies, with different versions, when > there is some patch to urgently apply.. > > In an ideal world, we should try to convince the docker people to use > stable APIs (that means using only released non-alpha versions!), or at > least to fix the incompatibilities with 1.0.2. I think it is at least > worth a try. > > The other way, which we have done many times, is to patch the software > ourselves. I have no idea why docker does not build with that version, > but sometimes it is not that difficult to fix. At a first glance I thought some bits of the containerd API were missing in the latest version, compared to the alpha. But I was wrong, after a closer look I see that it's just been moved, so I will try to patch swarmkit to build against the latest containerd. If it works I will submit my patch upstream and see how it goes. Thanks for all the explanation ! Arnaud _______________________________________________ Pkg-go-maintainers mailing list [email protected] http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-go-maintainers
