Trouble running "jspm install" under npm postinstall on Docker

[techniq]

I wasn't sure whether this issue should be filed under jspm, npm, or Docker, but I'm starting here :)

I've ran into an issue with running jspm install under postinstall for npm when building a Docker image

When I perform a docker build . and postinstall runs the following warning is logged:

npm WARN cannot run in wd project-name@0.0.1 jspm install (wd=/usr/src/app)

The rest of the build continues and finishes successfully, but as expected, I have no jspm_packages directory or resources.

Here is a snippet of my package.json

package.json

{
  ...
  "scripts": {
    "start": "gulp serve",
    "test": "gulp lint && gulp test:unit",
    "postinstall": "jspm install"
  },
}

I'm not installing jspm globally but relying on npm to add jspm to my path. I've also tried ./node_modules/.bin/jspm install with no change.

Here is my simple Dockerfile using the official base image

FROM node:0.12-onbuild

EXPOSE 8000

While researching the issue I found npm/npm#3497. I attempted to add the unsafe-perm = true to both my package.json:

{
  ...
  "config": {
    "unsafe-perm": true
  }
}

as well as created a .npmrc file at the root of the project (sibling to package.json) with:

unsafe-perm = true

but neither had any affect with the issue.

[guybedford]

I'm really not sure what to suggest here - I think it does sound like a permissions issue on the machine to do with the npm usage. Perhaps you need to run with higher / different privileges or something like that? Others may have better suggestions here too.

[techniq]

Well, I made some progress and furthered my understanding of npm some.

Turns out setting unsafe-perm=true is the fix (or more so a workaround) for the issue.

The problems I was running into having this config set are due to how the official Node Docker image is setup, and my misunderstanding of the config section within package.json works.

Issue using .npmrc

For the .npmrc file, the problem was this file was not being added to the image until after npm install runs (only package.json is added to the image initially to improve Docker's caching).

Here is the official image's Dockerfile

FROM node:0.12.5

RUN mkdir -p /usr/src/app
WORKDIR /usr/src/app

ONBUILD COPY package.json /usr/src/app/
ONBUILD RUN npm install
ONBUILD COPY . /usr/src/app

CMD [ "npm", "start" ]

If ONBUILD COPY package.json /usr/src/app/ was instead ONBUILD COPY package.json .npmrc /usr/src/app/ then this approach would have worked.

Issue using config in package.json

The problem with setting "config": { "unsafe-perm": true } in package.json is that I didn't understand that npm prefixes all the config properties with npm_config_ so the environment variable that is set is actually npm_config_unsafe-perm. While this should still work, this SO seems to indicate the inability to set unsafe-perm within package.json might be a bug.

Solution

My solution to the issue is to not use Node's node:0.12-onbuild base image but instead using their regular node:0.12 image and setting the unsafe-perm=true as a CLI argument to npm install

FROM node:0.12.5

RUN mkdir -p /usr/src/app
WORKDIR /usr/src/app

COPY package.json config.js /usr/src/app/
RUN npm install --unsafe-perm=true

COPY . /usr/src/app

EXPOSE 8000

CMD [ "npm", "start" ]

In hindsight, using their standard (non -onbuild) version would have been required since I need to also copy over config.js for the jspm install postinstall step.

[techniq]

Btw, I recommended joyant/docker-node update their -onboard version to also copy .npmrc before npm install runs.

I also tested to see if jspm was doing anything special that required it to need the unsafe-perm=true but I changed "postinstall": "ls" and still received the warning npm WARN cannot run in wd project-name@0.0.1 ls (wd=/usr/src/app)

I might log an issue with npm to see if they have any explanation / solution to needing to run unsafe-perm=true. Come to think of it, I'm sure it stems from Docker using root as the current user when performing builds. It could be overridden with https://docs.docker.com/reference/builder/#user and is actually recommended as a best practice by them. Maybe another suggestion for joyant/docker-node

[techniq]

Seems like the USER thing has already been suggested and discussed

• Security issue: node is run as root nodejs/docker-node#1
• Shouldn't be running node as root? nodejs/docker-node#6