Hacker News Reader

Comment by georgewfraser | Hacker News Reader

Bazel guarantees that each build step depends only on its declared inputs, and that each step is deterministic. So if the inputs to a step have not changed, Bazel can skip that step and use a cached copy of the result of that step. If you break up a large multi module build into a tree of small steps, Bazel can perform an incremental build after a small change in a few minutes, even though running the entire build from scratch would take hours.

View on HN

> Bazel guarantees that each build step depends only on its declared inputs

How does it enforce that? Does it sandbox the compiler or something? Java compiler annotation processors can perform arbitrary IO.

Exactly that: https://docs.bazel.build/versions/master/sandboxing.html

There's also (I believe experimental) support for using Docker as a sandbox backend. That ends up being useful if you're using the remote build execution support: you can run a build locally in exactly the same environment it will run on a build farm.

I wonder if this stops you reading the clock and random number sources during build?

(I once accidentally baked a time and random number into a binary myself - and the random number thing would have been a serious security bug if we had not found it with test coverage. Would have been better if the build system disallowed it.)

You can actually input system stuff like this via: https://docs.bazel.build/versions/master/user-manual.html#fl...

They already have support for build times and labels, but you can add arbitrary stuff like got hashes too

It can't stop you doing dumb things in code (e.g. use #pragmas or variables in C++ code) which will probably make your build behave funny, because it'll cache outputs not knowing that they're supposed to change.

You can of course define these as variables, but that'll just drop all your caches on each build which eliminates the main selling point of Bazel.

I don’t see Windows in supported systems for sandboxfs. I guess that would make bazel not suitable for most developers.

You have to declare all input explicitly, including your compiler and Bazel will monitor them: Any changes in input files, compilers or even some environmental variables like $PATH will trigger a rebuild.

Bazel can use sandbox as an additional layer to prevent you from accessing undeclared inputs, but the sandbox is optional and can be turned off.

Maven does exactly that as well. The term is "artifacts" in Maven.

Most plugins do not though, and will happily do stuff like run static analysis or lint rules over code that hasn’t changed from the last build 30 seconds ago.

Reply on news.ycombinator.com