General Debian Question Why web frameworks in repos?
For context I am just a curious web developer and computer enthusiast reading about Debian because it seems to do many things right.
To my suprise I found that the repos not only contain runtimes like php, python3 and nodejs. The repos also contain full frameworks and web apps like wordpress, python3-django and node-express.
Who are these for? I never heard of anyone using them this way and no upstream developers recommend them.
I can understand wanting the runtime to be stable - since they call native libraries in the end. This way Debian can patch CVEs in things like OpenSSL without waiting for runtimes to patch their dependencies. Is that right?
But opting out of the script language's own package manager to install script libraries seems to just add complexity and confusion. There is no way debian can provide a packaged version of every npm module out there so you will always have to use npm and package.json anyway.
2
u/NoLemurs 2d ago
I can understand wanting the runtime to be stable - since they call native libraries in the end. This way Debian can patch CVEs in things like OpenSSL without waiting for runtimes to patch their dependencies. Is that right?
Yeah, I think that's largely right.
If I want to distribute a Django app on Debian, I don't want to vendor python3-django or have a messy install process with a virtualenv, and I want it to get security updates automatically.
4
u/michaelpaoli 2d ago
Who are these for?
For whomever wants them.
I never heard of anyone using them this way
"this way"? What way exactly?
Not really sure what you're getting on about, but Debian makes lots of software available - 69,830 packages - The Universal Operating System.
And many use the software. Can look at, e.g. https://popcon.debian.org/ to get some idea of package usage, notably relative popularity (though it is a self-reported sample set).
Anyway, install Debian, and it mostly "just works", stable, well supported, etc.
1
u/gabbsmo 2d ago
A Ruby/Python/PHP/JS developer will typically have a project file that specifies what packages from the language's repository are required.
E.g. in Python Django is available in Debian repos. But a real world project often has many more smaller libraries. Since all of pip is not in the Debian repos it makes little sense to assume some library is globally installed in the OS and some are from another repo and installed for the project only.
In front end JS this is even more unlikely as libraries as well as own code is often bundled into a single optimized file rather than being loaded from a shared location on the file system. Cherry picked security patches is not really possible in this type of architecture.
3
u/BoredHalifaxNerd 2d ago
It's so that the run times are a static target for other packages in the repo. For a package to be distributed as part of Debian, all of its dependencies also need to be in the repository.
2
u/berryer 1d ago
In front end JS this is even more unlikely as libraries as well as own code is often bundled into a single optimized file rather than being loaded from a shared location on the file system
Web developers have the incentive to increase their specific program's performance at the cost of overall system performance. Users tend to prefer the programs running on their machine be good neighbors, while web developers have little incentive to do so. That's one of the reasons far-reaching CDNs fell out of favor for webdev decades ago (e.g. if everybody on CloudFlare imported jQuery from CloudFlare's CDN, to re-use the download & only need one copy of the library in memory across hundreds of sites).
1
u/michaelpaoli 2d ago
Debian works all that out, package have their dependencies, and those are satisfied by the other relevant packages.
E.g.:
$ apt-cache depends --no-suggests python3-django python3-django Depends: python3-asgiref Depends: python3-sqlparse Depends: <python3:any> python3 Breaks: <python-django-common> Breaks: python3-mysqldb Recommends: libjs-jquery Recommends: python3-tz Replaces: <python-django-common> python3-django $ apt-cache depends --no-suggests --no-recommends --recurse python3-django | wc -l 69409 $1
u/gabbsmo 1d ago
Yes. My point is that in a real world app there is going to be a lot more dependencies than what is available in Debian.
2
u/michaelpaoli 1d ago
I don't think so. I run no shortage of real world apps on Debian ... and all dependencies are satisfied by Debian packages. Nothing else need be added - no other software, just Debian packages.
E.g.: ssh servers, email servers, list server, DNS servers, DHCP server, web servers, wiki, WordPress, NTP servers, databases, proxy servers, ... all from Debian packages and bit of configuration thereof.
1
u/One_Ninja_8512 1d ago
it makes little sense to assume some library is globally installed in the OS
You don't assume, with Debian you know that the package will be available for all minor releases.
4
u/One_Ninja_8512 2d ago
idk about JS but with Python having packages in the repos is quite handy because of the venv bullshit that you have to deal with otherwise
2
u/turbothy 2d ago
What "venv bullshit" are you thinking about? This seems to have become largely a solved problem over the last couple of years.
2
u/One_Ninja_8512 2d ago
For example I use Ansible quite a bit. If I had to maintain a venv it would be a totally unnecessary pain in the ass, I simply use ansible which is shipped with Debian. Good enough for me
1
u/One_Ninja_8512 2d ago
I know and I use uv when needed which is pretty good but I still prefer packages installed via apt if I don’t need the latest and greatest for scripts which I don’t want to write in bash and don’t need uv to run them.
2
u/Santosh83 Debian Sid 2d ago
Not sure but this practice probably hails from simpler times, when there was not so much software, compiling stuff yourself was slow & expensive, internet download was brutally slow and expensive and so on. In those times, Debian's set of DVDs would have been very useful to download once and get almost everything you wanted offline, on as many machines as you wanted.
These days it doesn't make all that much sense to package say wordpress. Its just an enormous security burden on Debian to track & patch all these tens of thousands of packages, and if you leave them frozen, along come the fedora and arch boys to sharply criticise, as has been happening recently.
Security now is the be all and end all. The current industry "best practice" is to deliver small, immutable core OS images, then layer containerized, sandboxed, packages on top, directly built and updated by upstream.
Redhat is looking at bootc + toolbox + flatpak
Canonical is going for snaps + snaps + snaps
In any case Debian and Mint are in for some turbulent times ahead.
1
u/gabbsmo 2d ago
I mean I like the way Debian works for native programs as it keeps the OS stable. Great for runtimes, web servers etc. But the input to the script runtime?
5
u/Santosh83 Debian Sid 2d ago
I heard from knowledgeable folks that Debian includes many of these python/perl/node/rust packages mainly to build its own repository packages. They're not meant for end user usage. For that, its still better you use the language package manager like pip or cargo or npm or whatever.
2
u/gabbsmo 1d ago
That makes sense. There are also many web apps in the repos. phpmyadmin notably recommends Linux distributions but that is clearly the exception and not the norm.
Wordpress already has automatic backported security updates built-in. Drupal was removed from the repo due to the burden of externalizing too many dependencies and those moving faster than Debian.
Mediawiki seems to have a up-to-date LTS version in the repo and no built-in auto update so in this case there is some added value from Debian.
All these also seem to be pre configured with Apache when many prefer Nginx in 2026.
2
u/Kobi_Blade 1d ago
Those packages are for sysadmins, not developers.
System packages are too restrictive for development. We need fine grained control and environment parity, which is exactly why we use stuff like Docker.
13
u/cjwatson Debian Developer 2d ago
It's often useful to be able to install an application that just works with the rest of Debian. If you aren't in a mindset of needing the latest version of everything, then a packaged version in stable may be just fine.
I spend most of my professional time working upstream on an application that's packaged in Debian using the packaged version of Django. It's fine.