Yes, and this is why npm is never installed on my hosts.
Folks podman is good. Very, very good. You want good developer ergonomics? Use dev containers. The cost of pulling npm packages Willy nilly on the host is not worth it!
Potential malware will share a kernel with the host. One exploit and we're owned. Virtual machines are the better solution. Infinitely smaller attack surface. If they crack hardware hypervisors, it means the entire industry is in deep shit, not just us.
I went so far as to code up my own development virtual machine orchestration software. Now I'm making a custom Rust network stack for it.
Comments
Yes, and this is why npm is never installed on my hosts.
Folks podman is good. Very, very good. You want good developer ergonomics? Use dev containers. The cost of pulling npm packages Willy nilly on the host is not worth it!
Potential malware will share a kernel with the host. One exploit and we're owned. Virtual machines are the better solution. Infinitely smaller attack surface. If they crack hardware hypervisors, it means the entire industry is in deep shit, not just us.
I went so far as to code up my own development virtual machine orchestration software. Now I'm making a custom Rust network stack for it.