I have a dockerfile where I am using alpine-nodejs version 16 as the base image. The npm version is 8.
When the step of npm install --production
is executed while doing docker build
, it is also installing dependencies listed under dev-dependencies of package.json, contrary to the use-case of production flag.
I also used npm install --only=production
but that also doesn’t seem to work.
With alpine nodejs version 14, the flag is working as expected and dev-dependencies are not getting installed in container. Is there any issue with alpine node version 16 image? Thanks.
3
Answers
After struggling with this for weeks, I have finally found the root cause and it is really dumb of me to not pay attention to that, I don't want others to make the same mistake. Since the code is proprietary, I can't share it. But I will explain the problem.
The image with
nodejs:16
usesnpm
8.0 whereas the one withnodejs:14
uses somenpm
version < 8.0.The difference between them is in version 8.0,
npm
will also install the dependencies listed withinpeerDependencies
block. (I am unsure if this behavior started from npm 8.0 or some previous versions)So, why did I think npm is installing both
devDependencies
as well asdependencies
?When I was working with the
nodejs:14
image, I moved certain dependencies fromdependencies
block todevDependencies
block. So when I upgraded tonodejs:16
, those dependencies returned.Actually, the reason they came back because they were being internally used by a transitive dependency, which was listed within
peerDependency
block ofpackage.json
.So, the takehome lesson?
Make sure the dependency you want to be removed isn't being consumed directly or transitively within
dependency
as well aspeerDependency
block.I suspect your
Dockerfile
probably has something likeCOPY . .
but you don’t set.dockerignore
correctly, e.g. you didn’t addnode_modules
to your.dockerignore
(check COPY with docker but with exclusion for the further information about.dockerignore
)I made the same mistake too and it should have nothing do with nodejs14 or nodejs16
BTW,
npm install --only=prod[uction]
is npm 6.x format andnpm install --production
is npm 8.x format. One difference is that in npm 8.x if you setNODE_ENV production
npm 8.x will only install dependencies even if you runnpm install
but for npm6.xnpm install --only
will ignore NODE_ENVIt seems that npm ignores –production (or equivalent) flags when
package-lock.json
file is present.