Linode should as a common courtesy provide and host local network/datacenter packages/rpm/distro mirror for all build distros it advertises as providing installations for. Such mirrors should include official linode.com GPG key (or equivalent) for user verification at install time.

It is unreasonable to pay a bandwidth penalty just to get a base build up to speed. Many distros ship with nearly 4gigs of package/source/binary data for a full install (e.g. with all X apps).

It is false for linode.com to claim it provides 'DISTRO-X' installations when what is actually provided is not much more than a kernel and GNU-coreutils. In these cases this is _less_ than a distro.

At the very least linode.com should provide installation distros with the equivalent of that distros 'live cd\live-usb'. For source based distros it is unreasonable and _unsecure_ to advertise provision of a distro which installs without a basic tool-chain - configure, make, gcc, glibc, gzip, bz2, etc.

FWIW I chose linode _because_ it offered Arch/Gentoo/Slackware distros where many competitors don't. I assumed that this was an acknowledgment by linode of the viability of these installations. That said, crippling their native builds does little to promote the use of these otherwise Superior GNU/Linux ditributions.

Linode's base images are lean and mean because these are servers. Your definition of security is backwards: it would be insecure to have a lot of extra software installed that you don't need by default. As far as the toolchain goes, best practice is actually to NOT have that installed on a server, and to do your compiling elsewhere.

A great part of Linode's service is the stripped-down distros. It's a lot easier to install what you need after the fact than to figure out for yourself what can be removed. The Linode crew do the heavy lifting for us.

Would it be nice for Linode to host distro repositories? I suppose. I'd rather have them focus their resources elsewhere though. Do you have bandwidth or connectivity problems with the main repositories? I don't. Also if you're downloading 4GB for a "full install" with "all X apps", then you're doing it wrong. These are servers.

If you were to hit 202GB on your 200GB quota because you needed to download every piece of server software ever and then some, I'm sure Linode would cut you some slack.

You missed my point not my explicit caveat that:

"For source based distros it is unreasonable and _unsecure_ to advertise provision"

The operative part being the _source_ part. It is absolutely not safe to compile these types of builds on a separate machine.



Of course. But figuring out how to remove a package from _source_ based distros is a no brainer... obv. YMMV with CentOS, Ubuntu, etc.



This is a strawman. I didn't indicate this as a rationale -please don't make it one.



Again, where do is it indicated that this is a motivation?
It is not.



Why should they have to?

Why?

Cuz he said so?

Strawman seems harsh. It's at least related to the rationale I did see you make, which was not wanting to use your bandwidth allocation from Linode. Even given your 4GB value, that's like 2% of one month of bandwidth for the smallest Linode configuration - unlikely to be something to worry about - unless as Xan inferred (perhaps erroneously), your bandwidth "penalty" comment was also thinking of bandwidth and/or connectivity to the repositories (in terms of performance) compared to local.

I'm not familiar with how much work repository mirrors need to be managed (pure http/ftp servers maybe not so much, but I believe many of the source guys, like Gentoo, also need other services like rsync, and surely there's upstream coordination involved or some local overhead in any case to run a good repository), but I could see how Linode offering up some file space to house such services might be a useful contribution to the community. I'm not, however, sure I see much benefit other than potential performance gains from the repository being local, and certainly wouldn't be too concerned otherwise about the transfer as a fraction of monthly limits.

In terms of the actual images, when I was running Gentoo more regularly for example, it was certainly my experience that it didn't take too many months away from a particular point release for a new install to want to rebuild virtually everything anyway, so having a minimal image that doesn't bring along packages that are going to be immediately rebuilt/replaced seems to me to be not such a bad thing.

-- David

Do you really want to try to stand behind that argument? Linode IS providing DISTRO-X, but in a stripped down state. Just because the distro (in my case, Fedora) is stripped down doesn't make it something other than Fedora. It is the exact same thing I would do when I do a base install for a real server.



Since when? Take a security class and you will be told otherwise. I've even been told in security classes to remove compilers AND package managers so that an attacker cannot compile code on the system. Doing so requires that you compile on a separate system.


I really don't understand the problem here. I have been imaging, updating, reimaging, and updating over and over again so that I can come up with a script to automate server installations. I think I have barely exceeded 2% of my total bandwidth for the month, even for a distribution with lots of updates. In most cases updates will be a very minute amount of your overall bandwidth usage.

It likely requires less than 1GB of packages to bring a freshly deployed Linode into a final working state. This is $0.10 of bandwidth. If $0.10 of bandwidth is a problem for you, then VPS hosting is not for you.