Docker构建Node.js项目时，如何阻止所有npm包推送到Azure Artifacts？

我使用Azure DevOps Pipelines构建私有Node.js（npm）包，并通过Azure Artifacts发布供组织内项目使用。本地执行npm install、npm run dev、npm run build均正常，但通过Docker运行项目时，项目中所有来自公共npm registry的包都会被推送到Azure Artifacts。

项目根目录的.npmrc文件配置如下：

registry=https://pkgs.dev.azure.com/myorganization/MyProject/_packaging/nodejs/npm/registry/

always-auth=true

; begin auth token
//pkgs.dev.azure.com/myorganization/MyProject/_packaging/nodejs/npm/registry/:username=myorganization
//pkgs.dev.azure.com/myorganization/MyProject/_packaging/nodejs/npm/registry/:_password=mytoken
//pkgs.dev.azure.com/myorganization/MyProject/_packaging/nodejs/npm/registry/:email=npm requires email to be set but doesn't use the value
//pkgs.dev.azure.com/myorganization/MyProject/_packaging/nodejs/npm/:username=myorganization
//pkgs.dev.azure.com/myorganization/MyProject/_packaging/nodejs/npm/:_password=mytoken
//pkgs.dev.azure.com/myorganization/MyProject/_packaging/nodejs/npm/:email=npm requires email to be set but doesn't use the value
; end auth token

Dockerfile配置如下：

FROM node:16.17.0
RUN mkdir -p /var/www/app
WORKDIR /var/www/app
COPY ./app-frontend/.npmrc /root/.npmrc
COPY ./app-frontend/package*.json ./
RUN npm install
COPY ./app-frontend .
RUN npm run build
EXPOSE 4000
ENV NUXT_HOST=0.0.0.0
ENV NUXT_PORT=4000
CMD [ "npm", "start" ]

请问如何阻止所有包被推送到Azure Artifacts？

解决方案 #

问题根源是当前.npmrc将全局registry设为Azure Artifacts，导致npm会尝试把所有包（包括公共包）都推送到这个私有源。只需调整配置，让私有包走Azure Artifacts，公共包保留使用官方npm源即可。

1. 修改.npmrc，用scope区分私有/公共包 #

仅给组织的私有包指定Azure Artifacts源，公共包仍使用官方源。修改后的配置如下：

; 公共包使用npm官方源
registry=https://registry.npmjs.org/

; 仅@myorganization scope下的私有包使用Azure Artifacts源
@myorganization:registry=https://pkgs.dev.azure.com/myorganization/MyProject/_packaging/nodejs/npm/registry/

always-auth=true

; Azure Artifacts认证信息，仅对私有scope生效
//pkgs.dev.azure.com/myorganization/MyProject/_packaging/nodejs/npm/registry/:username=myorganization
//pkgs.dev.azure.com/myorganization/MyProject/_packaging/nodejs/npm/registry/:_password=mytoken
//pkgs.dev.azure.com/myorganization/MyProject/_packaging/nodejs/npm/registry/:email=npm requires email to be set but doesn't use the value
//pkgs.dev.azure.com/myorganization/MyProject/_packaging/nodejs/npm/:username=myorganization
//pkgs.dev.azure.com/myorganization/MyProject/_packaging/nodejs/npm/:_password=mytoken
//pkgs.dev.azure.com/myorganization/MyProject/_packaging/nodejs/npm/:email=npm requires email to be set but doesn't use the value

注意：将@myorganization替换为你实际的私有包scope名称，确保组织内的私有包都使用该scope发布。

2. 调整Dockerfile的.npmrc使用逻辑 #

保留原Dockerfile的复制步骤即可，只要替换.npmrc内容为上述修改后的版本。如果要提升安全性，可在Azure Pipelines中通过任务动态生成包含认证信息的.npmrc，避免明文token提交到代码仓库：

FROM node:16.17.0
RUN mkdir -p /var/www/app
WORKDIR /var/www/app
COPY ./app-frontend/.npmrc /root/.npmrc
COPY ./app-frontend/package*.json ./
RUN npm install
COPY ./app-frontend .
RUN npm run build
EXPOSE 4000
ENV NUXT_HOST=0.0.0.0
ENV NUXT_PORT=4000
CMD [ "npm", "start" ]

3. 验证配置效果 #

• 本地执行npm install，确认公共包从registry.npmjs.org拉取，私有包从Azure Artifacts拉取。
• 重新构建Docker镜像，查看npm install日志，确认没有将公共包推送到Azure Artifacts的行为。

内容的提问来源于stack exchange，提问作者Fantasmic