Skip to content

Conversation

@jdmarshall
Copy link
Collaborator

While npmjs.org is trying to take important steps to reduce supply chain attacks, working with, or indeed on, other people's OSS projects is still a bit fraught at the moment.

While dev containers are really meant for more elaborate workflows, a barebones implementation seems to be pretty okay for isolating npm install from having access to things it should not have access to.

code.

minFormatted and maxFormatted add a bit of unnecessary overhead for
a consumer to do any logic or tracking of the min/max range (eg,
for telemetry).
@jdmarshall jdmarshall force-pushed the devcontainer branch 2 times, most recently from 39457b3 to d65a553 Compare January 22, 2026 01:59
@@ -0,0 +1,3 @@
FROM node:24.4-bookworm-slim
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why bookworm?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh. Huh. I think the first page I found with the releases and LTS schedule made it look like bookworm was the current LTS version. Found another chart that’s clearer.

How do you feel about alpine?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants