I think you'd be surprised how often the route from dev to prod is "copy it from my machine into the cloud".

Good practices start at home.

Well, it's also a good practice the other way round:

If you can make your dev setup model the production setup, that's one less thing to worry about.

That's what VMs are for.

VMs are one tool for that. But they are neither necessary nor sufficient.

it's docker that requires root, you don't use root yourself

It's perfectly possible to use podman rootless. Presumably docker too, but I only have experience with podman. That is, the podman process does not have root privileges.

Maybe excessive, maybe a good prophylactic for potentially damaging NPM packages (for example) to not get root on my CI infrastructure.

It certainly is a problem. We want to run local development stacks with Docker, but, since it runs as root, it leaves files into your home directory (database and other files mounted from the guest) that are owned by root, so you can never delete them.

It's really bad UX.

Rootless Podman does this as well but with the subuid owned files. For instance you run postfix in a container and it has files owned by postfix. You can’t change the files outside of the container. You can make yourself root in the namespace and delete with podman unshare however. But it isn’t optimal from UX perspective either.

If you create a user inside of your Dockerfile and switch to that your files will be owned by whoever is assigned to uid:gid 1000:1000 on your dev box if you use a volume mount. This solves the problem in nearly every case because your primary dev box user is almost always going to be 1000:1000. It'll work on native Linux, Windows (WSL) and macOS using Docker Desktop or not.

Here's a bunch of complete web app examples of it working: https://github.com/nickjj?tab=repositories&q=docker-*-exampl...

Oh, good call, I wasn't doing this because 1000 is not always the user uid, but it's almost always, and at worst you'll need root to delete the files, thanks!

Home directory, /etc, or /root/.ssh/authorized_keys, depending on what arguments you pass to -v.

The main motive for me to make podman-apple-silicon was due do Docker Desktop's pricing model change.