Document the shadowing risk and the leftover dir; close two holes in the mount guard

2026-08-05 19:17:07 +02:00
parent bcf4d7fb1f
commit 3d3313c0ee
4 changed files with 25 additions and 6 deletions
@@ -1,4 +1,6 @@
 .git
+# Load-bearing: deps live at /node_modules, so a builder's stray copy would bake in at
+# /app/node_modules and shadow them for every consumer of the image, production included.
 node_modules
 npm-debug.log
 *.log