baredevcontainer/node repository overview

⁠node

Dev container image with Node.js installed, built on the debian⁠ base image.

Like every image in this repository, it is minimal, built only from upstreams verified at build time, and published with SLSA provenance, a GitHub artifact attestation, and an SBOM; it runs as the non-root user dev. Why these images⁠ explains the reasoning, and Verifying the image⁠ below shows how to check a build.

⁠Image

ghcr.io/bare-devcontainer/node:<tag>

Reference it from .devcontainer/devcontainer.json, pinning the digest as well as the tag:

{
  "image": "ghcr.io/bare-devcontainer/node:26@sha256:<digest>"
}

⁠Dev Container Template

A ready-to-use Dev Container template for this image is available at bare-devcontainer/templates⁠. It provides the recommended configuration for this image, including security hardening.

⁠Tags

Tags are also published with a date suffix on each build (e.g., 26.10.0-trixie-<YYYYMMDD>).

⁠Installed software

Everything from the debian⁠ base image, plus:

• Node.js⁠
• Corepack⁠

⁠Not installed

• No npm or npx. Both are removed from the image, so the package manager comes from the project's packageManager field through Corepack rather than from the image.
• No enabled package manager. Corepack is installed but not enabled by default. Run corepack enable as root — for example in a Dockerfile layered on this image — to activate the yarn/pnpm shims.
• No global JavaScript tooling. Linters, formatters, and test runners are left to the project's own dependencies.

⁠Supply chain

The Node.js binary is downloaded from nodejs.org⁠, and its checksum is verified against SHASUMS256.txt.asc, signed by the Node.js Release Team. The keyring (node/node-keyring.kbx) is committed to this repository, so signatures are checked against keys reviewed here rather than keys fetched at build time.

⁠Verifying the image

Every build is published with SLSA provenance, a GitHub artifact attestation, and an SBOM. The attestation confirms that an image was built by the release workflow of this repository and has not been altered since:

gh attestation verify oci://ghcr.io/bare-devcontainer/node:<tag>@sha256:<digest> \
  --owner bare-devcontainer

The Docker Hub mirror carries the same digests, so the same command verifies an image pulled from docker.io/baredevcontainer/node. Verifying Published Images⁠ covers inspecting the provenance and the SBOM as well.