Skip to content

Conversation

@jdmarshall
Copy link
Collaborator

While npmjs.org is trying to take important steps to reduce supply chain attacks, working with, or indeed on, other people's OSS projects is still a bit fraught at the moment.

While dev containers are really meant for more elaborate workflows, a barebones implementation seems to be pretty okay for isolating npm install from having access to things it should not have access to.

code.

minFormatted and maxFormatted add a bit of unnecessary overhead for
a consumer to do any logic or tracking of the min/max range (eg,
for telemetry).
@jdmarshall jdmarshall force-pushed the devcontainer branch 2 times, most recently from 39457b3 to d65a553 Compare January 22, 2026 01:59
Dockerfile Outdated
@@ -0,0 +1,3 @@
FROM node:24.4-bookworm-slim
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why bookworm?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh. Huh. I think the first page I found with the releases and LTS schedule made it look like bookworm was the current LTS version. Found another chart that’s clearer.

How do you feel about alpine?

Copy link
Owner

@RafaelGSS RafaelGSS Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alpine is an unofficial build too. See: nodejs/docker-node#2363

but I guess that's ok for this project.

Also 24.6 is the last node version that honors the nodejs CLI flags.
@@ -0,0 +1,3 @@
FROM node:24.6-trixie-slim
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we avoid fixing a semver-minor version? What about node:24-alpine only?

Copy link
Collaborator Author

@jdmarshall jdmarshall Jan 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not with the outstanding issue with commandline flags and tests.

Copy link
Owner

@RafaelGSS RafaelGSS left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You should rebase and keep only the devcontainer.json changes. Feel free to land it once you remove the two unrelated commit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants