npm’s configuration system is a layered hierarchy of files, environment variables, and command-line flags. The .npmrc file is the persistent layer: an INI-formatted list of key = value pairs that npm reads at startup. The file exists at four scopes—project, user, global, and builtin—and the values resolve in priority order, with the most specific scope…
Testing a package locally before publishing it is not a single workflow. npm link and npm pack solve different problems, and the choice between them determines whether the test reflects the published artifact or a symlinked approximation of it. Key point: npm link creates a symlink, which means the consumer project sees your working directory…
A quick-reference for Docker commands, concepts, and internals. Organized for lookup, not for reading. Container Lifecycle Command Purpose docker run <image> Create + start container docker run -d <image> Detached (background) docker run -it <image> sh Interactive with TTY docker run –rm <image> Auto-remove on exit docker run –name foo <image> Named container docker start…
This chapter traces a single TCP SYN packet from the moment it arrives on the host’s physical network interface to the moment it is delivered to the application listening inside a container. The path is not a straight line. It crosses the host’s network stack, passes through the Netfilter framework where Docker’s NAT rules rewrite…
Zero-downtime deployment is not a single technique but a family of patterns that share one requirement: the old version must keep serving traffic until the new version is proven ready. The two patterns that matter most in Docker environments are rolling updates, which replace replicas incrementally, and blue-green, which runs two complete environments and switches…
The OCI specification defines two independent standards that are often confused: the Runtime Specification describes how to configure and execute a container (the config.json and the lifecycle), and the Image Specification describes how to package a filesystem and its metadata. Building a custom runtime means implementing the former; building a custom image means producing the…
High-throughput Docker workloads fail at the host layer before they reach the application layer. The default Linux kernel is configured for balanced desktop and general-purpose server use, not for tens of thousands of concurrent connections. The three parameters that most often become the bottleneck are the file descriptor limit, the ephemeral port range, and the…
The CIS Docker Benchmark is a vendor-neutral hardening standard published by the Center for Internet Security, currently at version 1.6.0, with over 100 recommendations organized into seven sections covering the host, daemon, configuration files, images, runtime, operations, and Swarm . Auditors for SOC 2 Type II, PCI DSS 4.0, and FedRAMP accept CIS Docker scores…
An unsafe trait is a trait whose implementations must uphold a safety contract that the compiler cannot verify. Declaring the trait with unsafe trait tells implementors that there is a proof obligation; implementing it with unsafe impl is the programmer’s assertion that the obligation has been discharged. The pattern exists for traits like Send and…
A static mut is a global variable with a fixed memory address that can be modified at runtime. The Rust compiler requires an unsafe block for any read or write because it cannot guarantee that the access is free of data races or aliasing violations . The 2024 edition goes further: taking a reference to…