Skip to content

README.md

Latest commit

 

History

History
60 lines (43 loc) · 2.04 KB

README.md

File metadata and controls

60 lines (43 loc) · 2.04 KB
Raw

node

Dev container image with Node.js installed, built on the debian base image.

Image

ghcr.io/bare-devcontainer/node:<tag>

Reference it from .devcontainer/devcontainer.json, pinning the digest as well as the tag:

{
  "image": "ghcr.io/bare-devcontainer/node:26@sha256:<digest>"
}

Dev Container Template

A ready-to-use Dev Container template for this image is available at bare-devcontainer/templates. It provides the recommended configuration for this image, including security hardening.

Tags

Tags Debian variant
26.7.0-trixie, 26-trixie, trixie, 26.7.0, 26 trixie
26.7.0-bookworm, 26-bookworm, bookworm bookworm
24.19.0-trixie, 24-trixie, 24.19.0, 24 trixie
24.19.0-bookworm, 24-bookworm bookworm

Tags are also published with a date suffix on each build (e.g., 26.7.0-trixie-<YYYYMMDD>).

Installed software

Everything from the debian base image, plus:

Not installed

  • No npm or npx. Both are removed from the image, so the package manager comes from the project's packageManager field through Corepack rather than from the image.
  • No enabled package manager. Corepack is installed but not enabled by default. Run corepack enable as root — for example in a Dockerfile layered on this image — to activate the yarn/pnpm shims.
  • No global JavaScript tooling. Linters, formatters, and test runners are left to the project's own dependencies.

Supply chain

The Node.js binary is downloaded from nodejs.org, and its checksum is verified against SHASUMS256.txt.asc, signed by the Node.js Release Team. The keyring (node/node-keyring.kbx) is committed to this repository, so signatures are checked against keys reviewed here rather than keys fetched at build time.