Install deps above WORKDIR so no root-owned node_modules lands in the checkout #60

2026-08-05T18:19:01+02:00

lilleman commented

2026-08-05 18:19:01 +02:00

node_modules/ appeared in the checkout as an empty root-owned directory: the daemon created it as the mountpoint for compose.override.yml's - /app/node_modules anonymous volume, which existed only to stop .:/app shadowing the image's deps.

Re-owning it is not possible — the daemon creates a missing mount destination as root whatever user the container runs as (--user 1000:1000 still yields root). So the volume goes: deps now install to /node_modules, one level above WORKDIR /app, and Node resolves bare specifiers upward. Nothing to shadow, nothing to mount, and the stale-on-dep-bump anonymous volume goes with it.

Fallout handled: icons.test.ts resolves lucide-static by specifier instead of <repo>/node_modules; README's npm install now runs --package-lock-only --user \"$(id -u):$(id -g)\" so it cannot recreate the problem; src/compose.test.ts locks the invariant.

Local bash ci.sh is ALL GREEN.

`node_modules/` appeared in the checkout as an empty root-owned directory: the daemon created it as the mountpoint for compose.override.yml's `- /app/node_modules` anonymous volume, which existed only to stop `.:/app` shadowing the image's deps. Re-owning it is not possible — the daemon creates a missing mount destination as root whatever user the container runs as (`--user 1000:1000` still yields root). So the volume goes: deps now install to `/node_modules`, one level above `WORKDIR /app`, and Node resolves bare specifiers upward. Nothing to shadow, nothing to mount, and the stale-on-dep-bump anonymous volume goes with it. Fallout handled: `icons.test.ts` resolves lucide-static by specifier instead of `<repo>/node_modules`; README's `npm install` now runs `--package-lock-only --user \"$(id -u):$(id -g)\"` so it cannot recreate the problem; `src/compose.test.ts` locks the invariant. Local `bash ci.sh` is ALL GREEN.

lilleman added 1 commit 2026-08-05 18:19:01 +02:00

Install deps above WORKDIR so no root-owned node_modules lands in the checkout

CI / full-gate (push) Successful in 2m45s

Details

bcf4d7fb1f

lilleman marked the pull request as work in progress 2026-08-05 18:20:59 +02:00

lilleman added 1 commit 2026-08-05 19:17:14 +02:00

Document the shadowing risk and the leftover dir; close two holes in the mount guard

CI / full-gate (push) Successful in 2m38s

Details

3d3313c0ee

lilleman marked the pull request as ready for review 2026-08-05 19:21:51 +02:00