> I think it's better to not run npm as root user on container. I would suggest ... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		ashishb 16 days ago \| parent \| context \| favorite \| on: Shai-Hulud Returns: Over 300 NPM Packages Infected > I think it's better to not run npm as root user on container. I would suggest adding --user 1000 to your docker run command. Good point. Here's the improvement that work for me https://github.com/ashishb/dotfiles/commit/fe4fb15fe867bf77a...

jayknight 16 days ago [–]

It gets tricky with private dependencies, then you have to pass some sort of token into the container to authenticate with the host when installing dependencies.

ashishb 16 days ago | [–]

Definitely.

Would you prefer doing those tricks or exposing everything on your machine to random npm packages?

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact