Goodbye Package Management

Package management on an appliance is wrong -- plain and simple. The whole concept of an appliance is to have a contained system that has been fully tested and quality assured. When you introduce package management into such a system, you immediately lose the integrity and quality of the system.

Why ? A network-enabled package management system increases the number of variables involved for testing exponentially. A customer running a version of package X and a version of package Y , might decide to upgrade the version of package X, but has some custom application that upgrading package Y will break. This has produced a new type of system, one that has version 1 of package Y, and version 2 of package X. This might seem fairly simple, just create a QA test case for this scenario. Most Linux systems have hundreds of packages, as you start to scale up, you see that its no easy task to actually test each one of these scenarios. The moment you run update with yum, apt-get or conary, you've immediately stepped away from the QA blessed version of the operating system.

The problems however, don't stop there. Package management is making live changes to libraries, and executables on your system. The package management software is essentially, removing and install, or installing over the system. With automated systems such as conary, and systems you could automate like yum / apt-get, you run into a situation where human error is a factor, as is the integrity of the repositories you have to trust. What happens if in a rush to get a security fix out, a package isn't fully tested with the entire system, you grab your automated update, and next minute, your PHP applications stop working. Your only option is to roll back, and rolling back with package management (ask anyone who has used rpm for a few years) is a very hairy situation to be in.

What happens if your system is running a third party application, or your own custom application. It might have files open, that the package management system is trying to upgrade, and hence the package update fails unless those applications release the lock on the files in question, such as libraries.

Then of course there is the problem with your configuration. What happens if the system decides to update maybe bind, and this new release of bind may have changed a particular option you are using. Unless the package management system is designed to cater for this scenario, and in testing, we've found none that will do this effectively, your system is rendered unusable without manual intervention.

Package management is perfectly fine for the desktop, if something gets upgraded and it turns out to break your system, while its annoying, its not catastrophic. The same can't be said for the server or the appliance.

While some vendors would like you to think that a package management system is the way to go, its not. The only real advantage to package management on an appliance, is not to make the administration easy, but to make the development easier. In fact, package management adds a new point of failure and adds complexity to administration.

The real benefit is for the developer, yes thats right, the folks who are supposed to know their stuff, that you are entrusting the integrity of your business to, package management dumbs down their tasks for them. You might say, but this whole packaging system has complex configuration, how could it be dumbing things down?

Things are being dumbed down because the developer just needs to use a nice web interface, pick the packages that they need, perhaps add a few packages of their own and suddenly they are pitching to you this "Enterprise Ready" appliance solution. The fact of the matter is, they don't know when they imported openssl, who built it, if it contains patented algorithms, is it exportable and what extra patches it might contain. In some cases they could find that information out, but honestly, when they can click and roll, do you really think they have?

So whats going on here is essentially the "dumbing down" of the developer, the very person(s) who you trust your business to. Package management is bad all around for appliances, and it is far from Enterprise ready. The next time someone tries to tell you Ubuntu Server is Enterprise ready, ask them if Ubuntu has QA'd all the package management combinations, and you'll get a resounding... NO..