ESLint compromised, may have stolen your credentials

Re:ESLint compromised, may have stolen your credentials by Waterluvian on Thursday July 12, 2018 @11:25AM (#17515528)

Maybe I just haven't taken the time to learn Docker well enough but the blocker that stopped me from doing this last time is how much my dev environment (VSCode and other tools) depend on my node package and its dependencies being accessed from a certain spot for import autocomplete, intellisense, etc.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by t3h2mas on Thursday July 12, 2018 @12:59PM (#17516502)

When I develop locally using Docker, I live link my code directory into the container. I.E.

docker run -v "$PWD":/some/app/location ...

My editor doesn't know I'm using Docker. You can change your workflow when you want to deploy to a container registry, etc.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by Waterluvian on Thursday July 12, 2018 @01:05PM (#17516555)

Aha!! So all code is executed in the container but all the code is stored locally so all my local tools see it normally. Yes on the surface that seems like the approach I need.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by dylukes on Thursday July 12, 2018 @02:19PM (#17517222)

Consider vagrant.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by infogulch on Thursday July 12, 2018 @12:22PM (#17516087)

This was the blocker for me to use it on my local machine as well. How can we fix this? Is there a way to do it without updating every tool to explicitly special-case docker?

Dev machines are one thing, but there is no reason our CI tools should ever expose credentials in a way that is accessible to any build or test step. Build and test steps should be sandboxed to take input and produce an artifact, which is then uploaded to wherever in a completely separate sandbox.

[ Parent | on HN ]