3 ms·

We switched already to pnpm and won't look back. > Hardened Mode, constraints engine a) pin your dependencies, set save-prefix='' in .npmrc, use a tool like p

We switched already to pnpm and won't look back. > Hardened Mode, constraints engine a) pin your dependencies, set save-prefix='' in .npmrc, use a tool like pnpm outdated, Renovate, Dependabot, npm-check-updates to keep them updated. Doesn't need to be done or enforced in the package manager, Git Hooks and CI are sufficient. b) use syncpack to ensure all your dependencies in different workspaces use the same versions. This doesn't need to be done in the package manager. pnpm also has pnpm licenses to help keep compliance happy. If someone wants to write a package manager in Rust for speed (pnpm is already moving in this direction, see https://github.com/pnpm/pn https://github.com/pnpm/pn and https://github.com/pnpm/pacquet https://github.com/pnpm/pacquet ), we'd take a look. Otherwise - not enough benefit to switching away.

silverwind 3y ago
Said rust npm package manager already exists, but it's somewhat buggy still: https://github.com/orogene/orogene https://github.com/orogene/orogene
- solatic 3y ago
  Interesting, but no support for workspaces yet: https://github.com/orogene/orogene/issues/161 https://github.com/orogene/orogene/issues/161
__jonas 3y ago
I'm just trying to switch to pnpm and I'm a bit lost on how to dockerize packages in my workspace, something that I thought would be a common thing to do. The example in their docs [1] seems to just be wrong > FROM common AS app1 > COPY --from=prod-deps /app/packages/app1/node_modules/ /app/packages/app1/node_modules > COPY --from=build /app/packages/app1/dist /app/packages/app1/dist This of course will not work, since the node_modules folders of packages in a pnpm workspace just contain symlinks to the virtual store at the root of the monorepo, not the actual modules. I don't see any good way to do what this example pretends to achieve (minimize docker image build size) since even when hoisting is forced, pnpm seems to only ever hoist node_modules in the root of the repo. Sorry for this somewhat unrelated rant, I was just surprised at hitting such an obstacle immediately after trying to adopt pnpm after I heard so much praise for this tool. [1] https://pnpm.io/docker#example-2-build-multiple-docker-images-in-a-monorepo https://pnpm.io/docker#example-2-build-multiple-docker-image...
- mirekrusin 3y ago
  Bundle your backend code to single file just like you'd bundle f/e.
  - TurningCanadian 3y ago
    An optimization pass will speed up the server runtime too. Well worth it.
  - __jonas 3y ago
    I'm considering this path, yes – just find it strange that the docs have this example that clearly can't work due to how the package manager functions. Adding bundling with another tool like rollup also brings another layer of complexity, now I'm starting to feel like I should just use bun.
- solatic 3y ago
  Checkout Depot's example Dockerfile for node + pnpm: https://depot.dev/docs/languages/node-pnpm-dockerfile https://depot.dev/docs/languages/node-pnpm-dockerfile which is best-practices based even if you're not using Depot. They also explain each of the lines in the Dockerfile. As someone struggling with Docker caching at work at the moment, I think your problem is less with pnpm and more with the difficulty of writing decent Dockerfiles.
  - __jonas 3y ago
    Thank you, but I think that’s a bit different since the example is not using workspaces, which makes it a lot simpler > COPY --from=deps /app/node_modules /app/node_modules This won’t work in the case of the workspace setup since the node_modules folder for my app just contains symlinks, not the actual node_modules, that’s the essential problem I’m facing.
    - solatic 3y ago
      Right, what the Dockerfile is doing is building the store first inside the image using pnpm fetch. Then, when the Dockerfile does pnpm install inside the image, the resulting links in the generated node_modules are pointing to the store path inside the image. When you do COPY . ., either your .gitignore file is already ignoring node_modules or you have a separate .dockerignore file which should also exclude node_modules; thus, when copying files into the image, you're never copying the node_modules folder and thus links inside the node_modules folder to places on your host laptop are irrelevant.
cantSpellSober 3y ago
> Hardened Mode [...] doesn't need to be done in the package manager Why not?
erhaetherth 3y ago
> If someone wants to write a package manager in Rust for speed How about Zig? Seriously, try Bun. It's stupid fast. Even if you don't use all its other features, just try "bun install".
- solatic 3y ago
  Doesn't support pnpm workspaces, only package.json workspaces: https://bun.sh/docs/install/workspaces https://bun.sh/docs/install/workspaces pnpm is more than just pnpm install, there's an evolving ecosystem of tools. For a mainstream project looking for tools to depend on, either everything supports bun, or it might as well be nothing.

silverwind 3y ago

Said rust npm package manager already exists, but it's somewhat buggy still: https://github.com/orogene/orogene https://github.com/orogene/orogene

solatic 3y ago
Interesting, but no support for workspaces yet: https://github.com/orogene/orogene/issues/161 https://github.com/orogene/orogene/issues/161

__jonas 3y ago

I'm just trying to switch to pnpm and I'm a bit lost on how to dockerize packages in my workspace, something that I thought would be a common thing to do. The example in their docs [1] seems to just be wrong > FROM common AS app1 > COPY --from=prod-deps /app/packages/app1/node_modules/ /app/packages/app1/node_modules > COPY --from=build /app/packages/app1/dist /app/packages/app1/dist This of course will not work, since the node_modules folders of packages in a pnpm workspace just contain symlinks to the virtual store at the root of the monorepo, not the actual modules. I don't see any good way to do what this example pretends to achieve (minimize docker image build size) since even when hoisting is forced, pnpm seems to only ever hoist node_modules in the root of the repo. Sorry for this somewhat unrelated rant, I was just surprised at hitting such an obstacle immediately after trying to adopt pnpm after I heard so much praise for this tool. [1] https://pnpm.io/docker#example-2-build-multiple-docker-images-in-a-monorepo https://pnpm.io/docker#example-2-build-multiple-docker-image...

mirekrusin 3y ago
Bundle your backend code to single file just like you'd bundle f/e.
- TurningCanadian 3y ago
  An optimization pass will speed up the server runtime too. Well worth it.
- __jonas 3y ago
  I'm considering this path, yes – just find it strange that the docs have this example that clearly can't work due to how the package manager functions. Adding bundling with another tool like rollup also brings another layer of complexity, now I'm starting to feel like I should just use bun.
solatic 3y ago
Checkout Depot's example Dockerfile for node + pnpm: https://depot.dev/docs/languages/node-pnpm-dockerfile https://depot.dev/docs/languages/node-pnpm-dockerfile which is best-practices based even if you're not using Depot. They also explain each of the lines in the Dockerfile. As someone struggling with Docker caching at work at the moment, I think your problem is less with pnpm and more with the difficulty of writing decent Dockerfiles.
- __jonas 3y ago
  Thank you, but I think that’s a bit different since the example is not using workspaces, which makes it a lot simpler > COPY --from=deps /app/node_modules /app/node_modules This won’t work in the case of the workspace setup since the node_modules folder for my app just contains symlinks, not the actual node_modules, that’s the essential problem I’m facing.
  - solatic 3y ago
    Right, what the Dockerfile is doing is building the store first inside the image using pnpm fetch. Then, when the Dockerfile does pnpm install inside the image, the resulting links in the generated node_modules are pointing to the store path inside the image. When you do COPY . ., either your .gitignore file is already ignoring node_modules or you have a separate .dockerignore file which should also exclude node_modules; thus, when copying files into the image, you're never copying the node_modules folder and thus links inside the node_modules folder to places on your host laptop are irrelevant.

cantSpellSober 3y ago

> Hardened Mode [...] doesn't need to be done in the package manager Why not?

erhaetherth 3y ago

> If someone wants to write a package manager in Rust for speed How about Zig? Seriously, try Bun. It's stupid fast. Even if you don't use all its other features, just try "bun install".

solatic 3y ago
Doesn't support pnpm workspaces, only package.json workspaces: https://bun.sh/docs/install/workspaces https://bun.sh/docs/install/workspaces pnpm is more than just pnpm install, there's an evolving ecosystem of tools. For a mainstream project looking for tools to depend on, either everything supports bun, or it might as well be nothing.