<story><title>Hermit is a hermetic and reproducible sandbox for running programs</title><url>https://github.com/facebookexperimental/hermit</url></story><parent_chain></parent_chain><comment><author>an-unknown</author><text>It seems like this tool does not create a fully deterministic nor reproducible environment. Hermit seems to only intercept and modify syscalls, but this is not the only source of non-determinism and randomness. For example, the layout of environment variables in memory also causes non-determinism, caused by the content of the environment variables as well as their order in memory. CPU instructions like RDTSC, RDRAND, RDSEED and similar also introduce randomness. It seems like Hermit ignores some these sources of randomness, but I can&amp;#x27;t test it, because it doesn&amp;#x27;t build on a current Arch system with the Rust toolchain from the repo.&lt;p&gt;At least it seems Hermit masks RDRAND and RDSEED via CPUID, but not every program is written to support ancient architectures which didn&amp;#x27;t support these instructions and therefore not every program tests availability via CPUID.&lt;p&gt;In addition, even if all of this was deterministic, CPU flags set by various instructions with &amp;quot;undefined&amp;quot; flags according to the CPU manual can slightly differ between different microarchitectures. A &amp;quot;normal&amp;quot; program should not be influenced by this, but it is still a source of non-reproducibility. This might be relevant for certain rare compiler bugs.</text></comment>
<story><title>Hermit is a hermetic and reproducible sandbox for running programs</title><url>https://github.com/facebookexperimental/hermit</url></story><parent_chain></parent_chain><comment><author>eatonphil</author><text>It&amp;#x27;s a really interesting project but it hasn&amp;#x27;t worked for non-trivial programs for me. I tried to use it on my Raft implementation. Hermit crashed with obscure (to me) error messages.&lt;p&gt;Others have commented on here before, it admittedly doesn&amp;#x27;t seem to be actively maintained.&lt;p&gt;&amp;gt; Just to let you know we’re not actively working on Hermit in the team&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;facebookexperimental&amp;#x2F;hermit&amp;#x2F;issues&amp;#x2F;34#issuecomment-1949510810&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;facebookexperimental&amp;#x2F;hermit&amp;#x2F;issues&amp;#x2F;34#iss...&lt;/a&gt;</text></comment>