Skip to content

DL3016

Jump to bottom
Tanmay Pereira Naik edited this page Mar 8, 2024 · 2 revisions

Pin versions in npm.

Problematic code:

FROM node:8.9.1

RUN npm install express
RUN npm install @myorg/privatepackage
RUN npm install express [email protected]
RUN npm install --global express
RUN npm install git+ssh://[email protected]:npm/npm.git
RUN npm install git+http://[email protected]/npm/npm
RUN npm install git+https://[email protected]/npm/npm.git
RUN npm install git://github.com/npm/npm.git

Correct code:

FROM node:8.9.1

RUN npm install [email protected]
RUN npm install @myorg/privatepackage@">=0.1.0"
RUN npm install express@"4.1.1" [email protected]
RUN npm install --global express@"4.1.1"
RUN npm install git+ssh://[email protected]:npm/npm.git#v1.0.27
RUN npm install git+http://[email protected]/npm/npm#semver:^5.0
RUN npm install git+https://[email protected]/npm/npm.git#v1.0.27
RUN npm install git://github.com/npm/npm.git#v1.0.27

Rationale:

https://docs.docker.com/develop/develop-images/instructions/#apt-get

Version pinning forces the build to retrieve a particular version regardless of what’s in the cache. This technique can also reduce failures due to unanticipated changes in required packages.

Exceptions:

Pin your versions in package.json and run npm install with no arguments.

Clone this wiki locally