News for hackers. Stuff that matters.
Re:A web of trust for NPM by martpie on Saturday October 03, 2020 @06:38PM (#24675196)
500-600mb sounds like you are shipping dev dependencies in your images.

You should use npm/yarn's production flags when installing your dependencies for your images, so you only ship runtime dependencies.

Your images will shrink to 100-150mb.

Re:A web of trust for NPM by citrons on Saturday October 03, 2020 @07:10PM (#24675350)
Yeah, for building files in docker try using multi-stage builds. They on the "final" image you can only use prod dependencies.
Re:A web of trust for NPM by SirensOfTitan on Saturday October 03, 2020 @07:26PM (#24675431)
So we’re using multi-stage builds (totally awesome feature!), only including production dependencies, and I’m —squash ing the final image.

The issue is that packages often balloon in size from an accidental transitive inclusion of Babel or webpack. Because JS packages depend on so much, the fanout virtually guarantees someone in your dependency tree will accidentally a dependency every now and then. It’s compounded by the fact that I have several different versions of the same package installed because folks don’t use peerDependencies when they should (and I’m afraid to pin most packages because I don’t want to introduce subtle bugs).

I’d imagine I could solve this for us if I had enough time, but startup life leaves little time for battling with the package manager. And it creeps up on you slowly.

(Also: we use next-transpire-modules @martpie, thanks for a great library)

Re:A web of trust for NPM by ketzo on Saturday October 03, 2020 @08:58PM (#24675854)
Yeah, sounds like the kind of problems you’d hand to your devops team, but oftentimes that’s just you :D

I wonder how much “build maintenance” is/will become a factor in choosing between ecosystems.

Re:A web of trust for NPM by skinner927 on Saturday October 03, 2020 @09:00PM (#24675865)
All I’m hearing is that now and then a teammate makes a mistake and installs a dev dependency as a production dependency. How is this NPM’s fault?
Re:A web of trust for NPM by SirensOfTitan on Saturday October 03, 2020 @09:16PM (#24675924)
This is not what I said.
Re:A web of trust for NPM by takeda on Sunday October 04, 2020 @03:20AM (#24677089)
100-150mb of just a JavaScript code doesn't look that great either.
Re:A web of trust for NPM by kchr on Sunday October 04, 2020 @07:38AM (#24678209)
I think the problem is that you normally use 5% of the functions from your deps but still have to pull it all in.

Minimizing dependencies and writing as much as possible on your own would probably cut a 500 MB nodejs project to 5 MB in plain JS.

Note: Not a node dev but share the grief...