Green on my machine, red in CI, same image. The bug was a single permission bit on /tmp, and the real fault was a test running the container in a shape it never ships in.
Blog
Writing notes
Notes I want to share and keep around, for me and for whoever finds them useful.
-
-
A pre-commit hook that formats your code before it reaches the pipeline. No husky, no lint-staged, fifteen lines of shell.
-
A pipeline that lints, tests, scans and ships the image on every push, plus the monthly rebuild that stops a pinned base from rotting in silence.
-
Freeze the filesystem, drop every Linux privilege, keep the secret out of docker inspect, and publish no ports at all. The other half of running a container safely.
-
Build in stages so no compiler ships to production, run as a user with no powers, and strip out everything an attacker could use. The Dockerfile I reach for on web projects.