Hacker News Reader

Comment by edp | Hacker News Reader

Yes, but in my case tomcat is provided by the distribution and I'll see when an update is coming (and to be honest, like you said, tomcat is pretty boring, which is good in my opinion). By default, dokku/herokuish will download the latest version of a buildpack, that's what got me this time. As other commenters pointed out, I could lock down a specific commit for the buildpack, I'll try that in the future.

View on HN

As I've commented on your reddit thread, dokku/herokuish don't automagically upgrade themselves. Herokuish is pegged to specific buildpack versions, and you would have to manually upgrade it - or have automatic system updates for non-security releases - in order to have newer versions of the buildpacks automatically installed.

Other than the fact that you happen to be running dokku, nothing about this problem is dokku-specific, and you would have hit the same issue with heroku.

As with almost every software in the world, silent version changes may break things. This is why npm, bower, rubygems, maven, python's requirement.txt and almost every other package management system allows you to specify the exact version of a dependency and begs you to use it in production. This is also why you need a staging environment that is as close as possible mirror of production.

Seems like you failed to RTFM

All our dependencies in maven and bower are locked down. However, even though you can do the same with a buildpack, this is not exactly what heroku and dokku will do by default. The documentation [0] specifies a way to do so with a git based system, but all commands given on that page won't specify a tag. Note that this was not in production, like I said in the article, it was an internal release.

[0] https://devcenter.heroku.com/articles/buildpacks

Dokku/herokuish do indeed lock down to specific buildpacks [1]. You just happened to use a method that allowed you to use any version of that buildpack (multi-buildpack, which is provided by Heroku itself).

[1] https://github.com/gliderlabs/herokuish/tree/master/buildpac...

Reply on news.ycombinator.com