<story><title>Using Landlock to Sandbox GNU Make</title><url>https://justine.lol/make/</url></story><parent_chain><item><author>jart</author><text>One of the nice things about Bazel that the article didn&amp;#x27;t get a chance to go into is it uses SHA hashes of files, rather than file timestamps, to determine when an artifact has changed and therefore needs to be updated. It&amp;#x27;s slightly more costly to compute hashes, but it&amp;#x27;s necessary if you want to have something like a global cache of build artifacts, since synchronizing time across machines is hard.&lt;p&gt;What I&amp;#x27;d recommend for anyone really, is to just do what Google did. For the first six years of Google&amp;#x27;s lifecycle, they got along just fine with GNU Make. Then they switched to the huge scalable thing once they actually reached that inflection point. I&amp;#x27;m obviously not there since I&amp;#x27;m just a scrappy open source coder. So for me I&amp;#x27;m quite happy to be working with GNU Make and I can foresee myself getting many additional years of use out of it.</text></item><item><author>gray_-_wolf</author><text>This is definitely interesting and cool, however:&lt;p&gt;&amp;gt; Landlock Make can build code five times faster than Bazel, while offering the same advantages in terms of safety. In other words, you get all the benefits of a big corporation build system, in a tiny lightweight binary that any indie developer can love.&lt;p&gt;In terms of safety, maybe almost (bazel can check if the source files changed
during the build, this (afaict) can not). But bazel also provides a lot more
(caching, remote builds, ...). So, while cool, read more on it and evaluate it
in depth before deciding to replace bazel with this.</text></item></parent_chain><comment><author>chubot</author><text>&lt;i&gt;For the first decade and a half of Google&amp;#x27;s company lifecycle, they got along just fine with GNU Make&lt;/i&gt;&lt;p&gt;???   Google was started in 1998, and Bazel was created ~2006 as a replacement for Python + GNU Make (&amp;quot;gconfig&amp;quot;).  I was on that team, though I only worked on Blaze a tiny bit.  The &amp;quot;google3&amp;quot; build migration was sometime around 2003 or 2004.&lt;p&gt;So at most there were 6 years of using Make only, i.e. &amp;quot;google2&amp;quot;.&lt;p&gt;Importantly, pre-Blaze google3 wasn&amp;#x27;t just GNU make -- Python was a huge part of it, which is why the Bazel build language Starlark looks like Python.  It used to literally be Python, and now it&amp;#x27;s a Python-like language with parallel evaluation.&lt;p&gt;---&lt;p&gt;If you want to do what &amp;quot;scrappy Google&amp;quot; did these days, then you should use Python + Ninja.  Ninja is meant to be generated, just like GNU Make was generated by Python.  (A big difference is that GNU make has a big database of built-in rules that basically do nothing but slow down incremental rebuilds.)&lt;p&gt;I described that strategy a bit a few days ago: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=32307188&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=32307188&lt;/a&gt;&lt;p&gt;---&lt;p&gt;This work with Landlock looks very cool, and it would make a lot of sense for Ninja to have optional support for it.  Some of the caveats are a bit scary but hopefully that can be worked out over time.&lt;p&gt;The way I was thinking of doing it was just to have a .&amp;#x2F;NINJA_config.py --slow-sandbox mode.  So you can use any sandbox to warn you about missing dependencies, including something container-based like bubblewrap, symlink farms, or Landlock.  I think that would work, though I haven&amp;#x27;t tried it.  The shared library issue is tricky, etc.&lt;p&gt;It&amp;#x27;s very useful to have the build config &amp;#x2F; generator split for this reason, and many others (e.g. build variants go only in the first stage, not the second).&lt;p&gt;I wrote 3 substantial GNU makefiles from scratch and regretted it largely because it lacks this split -- it has a very tortured way of doing build &amp;quot;metaprogramming&amp;quot;.  IIRC one dimension of variants was OK, but 2 got you into the &amp;quot;write a Lisp in Make&amp;quot; territory.  Might as well use Python (or Lua, etc.)</text></comment>
<story><title>Using Landlock to Sandbox GNU Make</title><url>https://justine.lol/make/</url></story><parent_chain><item><author>jart</author><text>One of the nice things about Bazel that the article didn&amp;#x27;t get a chance to go into is it uses SHA hashes of files, rather than file timestamps, to determine when an artifact has changed and therefore needs to be updated. It&amp;#x27;s slightly more costly to compute hashes, but it&amp;#x27;s necessary if you want to have something like a global cache of build artifacts, since synchronizing time across machines is hard.&lt;p&gt;What I&amp;#x27;d recommend for anyone really, is to just do what Google did. For the first six years of Google&amp;#x27;s lifecycle, they got along just fine with GNU Make. Then they switched to the huge scalable thing once they actually reached that inflection point. I&amp;#x27;m obviously not there since I&amp;#x27;m just a scrappy open source coder. So for me I&amp;#x27;m quite happy to be working with GNU Make and I can foresee myself getting many additional years of use out of it.</text></item><item><author>gray_-_wolf</author><text>This is definitely interesting and cool, however:&lt;p&gt;&amp;gt; Landlock Make can build code five times faster than Bazel, while offering the same advantages in terms of safety. In other words, you get all the benefits of a big corporation build system, in a tiny lightweight binary that any indie developer can love.&lt;p&gt;In terms of safety, maybe almost (bazel can check if the source files changed
during the build, this (afaict) can not). But bazel also provides a lot more
(caching, remote builds, ...). So, while cool, read more on it and evaluate it
in depth before deciding to replace bazel with this.</text></item></parent_chain><comment><author>gravypod</author><text>&amp;gt; What I&amp;#x27;d recommend for anyone really, is to just do what Google did. For the first decade and a half of Google&amp;#x27;s company lifecycle, they got along just fine with GNU Make. Then they switched to the huge scalable thing once they actually reached that inflection point.&lt;p&gt;Hopefully as a community we can build things that are scalable and as-simple-as Make. I think please.build is a step in the right direction but still too complicated.</text></comment>