Harden the artifact-ownership guards and document the root-owned upgrade trap

2026-08-05 22:40:36 +02:00
parent 073ec294e9
commit 1cf34a0d45
4 changed files with 31 additions and 15 deletions
@@ -9,9 +9,8 @@ RUN npm ci

 COPY e2e-tests/ ./

-# Runs as the invoking `--user` so artifacts land owned by them, not root — that uid has no home
-# here, so point everything that wants one at /tmp (npm's cache, and the browsers' profile dirs).
+# Runs as the invoking `--user` so artifacts land owned by them, not root — and an arbitrary uid has
+# no passwd entry here, so its home would be the unwritable `/`. npm's cache follows HOME.
 ENV HOME=/tmp
-ENV npm_config_cache=/tmp/.npm

 CMD ["npx", "playwright", "test"]