
Security News
PodRocket Podcast: Inside the Recent npm Supply Chain Attacks
Socket CEO Feross Aboukhadijeh discusses the recent npm supply chain attacks on PodRocket, covering novel attack vectors and how developers can protect themselves.
@uscreen.de/nxprune
Advanced tools
turbo prune --docker
for nx.jspre-alpha: supports yarn workspaces with plain nx tasks only. Tested on a few private monorepos only.
Uses multi-stage setup to build a production docker image with the following steps:
nxprune installs globally within docker container to prune one service or package from your workspace. The Dockerfile requires two env variables so it can be used as one template for all services within a workspace.
FROM node:16-bullseye-slim AS base
WORKDIR /app
# prune (aka isolate) scope from all packages in monorepo
FROM base AS pruner
COPY . .
RUN yarn global add @uscreen.de/nxprune
RUN nxprune --scope=${SCOPE}
# install dev deps
FROM base AS dev-deps
COPY --from=pruner /app/out/json/ .
COPY --from=pruner /app/out/yarn.lock ./yarn.lock
RUN yarn install --frozen-lockfile
# install prod deps
FROM base AS prod-deps
COPY --from=pruner /app/out/json/ .
COPY --from=pruner /app/out/yarn.lock ./yarn.lock
RUN yarn install --frozen-lockfile --production --prefer-offline --ignore-scripts
# run a build with dev deps for pruned scope
FROM base AS builder
COPY --from=dev-deps /app/ .
COPY --from=pruner /app/out/full/ .
RUN yarn nx run ${SCOPE}:build
RUN find . -name node_modules | xargs rm -rf
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get -qq install dumb-init
# copy to tiny production image
FROM gcr.io/distroless/nodejs-debian11:16
COPY --from=builder /usr/bin/dumb-init /usr/bin/dumb-init
WORKDIR /app
USER nonroot
COPY --chown=nonroot:nonroot --from=prod-deps /app/ .
COPY --chown=nonroot:nonroot --from=builder /app/ .
ENTRYPOINT ["/usr/bin/dumb-init", "--"]
CMD ["/nodejs/bin/node", "--unhandled-rejections=strict", "${APP}"]
plain sh like command to build a service image, i.e.:
SCOPE=@myrepo/myservice APP=apps/myservice/index.js envsubst < ./Dockerfile | docker build . -f- -t myrrepo-myservice:latest --secret id=npmrc,src=.npmrc
This is to be run from root of the monorepo with a directory layout like so:
├── Dockerfile
├── node_modules
├── nx.json
├── package.json
├── apps
│ ├── myservice
│ │ ├── index.js
│ │ └── package.json
│ └── yourservice
└── yarn.lock
Licensed under MIT.
Published, Supported and Sponsored by u|screen
FAQs
prune your monorepo package for docker build
The npm package @uscreen.de/nxprune receives a total of 11 weekly downloads. As such, @uscreen.de/nxprune popularity was classified as not popular.
We found that @uscreen.de/nxprune demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Socket CEO Feross Aboukhadijeh discusses the recent npm supply chain attacks on PodRocket, covering novel attack vectors and how developers can protect themselves.
Security News
Maintainers back GitHub’s npm security overhaul but raise concerns about CI/CD workflows, enterprise support, and token management.
Product
Socket Firewall is a free tool that blocks malicious packages at install time, giving developers proactive protection against rising supply chain attacks.