Use private npm repo in Docker

Question

We have a private npm repo hosted using sinopia it has basic auth credentials. And our application uses the npm package of the private repo. I created the authentication token and tried it but I am getting error at the line RUN npm install [email protected]:

npm ERR! code E403
npm ERR! 403 Forbidden: [email protected]
npm ERR! A complete log of this run can be found in:
npm ERR!     /root/.npm/_logs/2018-07-05T10_55_25_752Z-debug.log

And my Dockerfile is:

FROM keymetrics/pm2:latest-alpine
RUN mkdir -p /app
WORKDIR /app
COPY package.json ./
COPY .npmrc ./
RUN npm config set registry http://private.repo/:_authToken=CqgPS5l++vjD0n6ynxrVNg==.
RUN npm install [email protected]
RUN apk update && apk add yarn python g++ make && rm -rf /var/cache/apk/*
RUN set NODE_ENV=production
RUN npm config set registry https://registry.npmjs.org/
RUN npm install
COPY . /app
RUN ls -al -R
EXPOSE 51967
CMD [ "pm2-runtime", "start", "pm2.json" ]

And the error log is:

11 verbose stack     at tryCatcher (/usr/local/lib/node_modules/npm/node_modules/bluebird/js/release/util.js:16:23)
11 verbose stack     at Promise._settlePromiseFromHandler (/usr/local/lib/node_modules/npm/node_modules/bluebird/js/release/promise.js:512:31)
11 verbose stack     at Promise._settlePromise (/usr/local/lib/node_modules/npm/node_modules/bluebird/js/release/promise.js:569:18)
11 verbose stack     at Promise._settlePromise0 (/usr/local/lib/node_modules/npm/node_modules/bluebird/js/release/promise.js:614:10)
11 verbose stack     at Promise._settlePromises (/usr/local/lib/node_modules/npm/node_modules/bluebird/js/release/promise.js:693:18)
11 verbose stack     at Async._drainQueue (/usr/local/lib/node_modules/npm/node_modules/bluebird/js/release/async.js:133:16)
11 verbose stack     at Async._drainQueues (/usr/local/lib/node_modules/npm/node_modules/bluebird/js/release/async.js:143:10)
11 verbose stack     at Immediate.Async.drainQueues (/usr/local/lib/node_modules/npm/node_modules/bluebird/js/release/async.js:17:14)
11 verbose stack     at runCallback (timers.js:794:20)
11 verbose stack     at tryOnImmediate (timers.js:752:5)
11 verbose stack     at processImmediate [as _immediateCallback] (timers.js:729:5)

Can anyone help me with this?

Answer 1

I'm guessing the package [email protected] is your private package? If so, it would seem your auth token either isn't being used or doesn't have access to that package for some reason.

You could try writing the ~/.npmrc file rather than using the config set, this would just be a case of using:

RUN echo -e "//private.repo/:_authToken=... > ~/.npmrc

This will cause your docker user to then authenticate using that token against the registry defined. This is how we setup auth tokens for npm for the most part.

On a side note, you might want to consider not using multiple RUN commands one after another. This causes a new image layer to be created for every single command and can bloat the size of your container massively. Try using && \ at the end of your commands and then placing the next command on a new line without the RUN bit. For example:

FROM keymetrics/pm2:latest-alpine

RUN mkdir -p /app

WORKDIR /app

COPY package.json ./
COPY .npmrc ./

RUN npm config set registry http://private.repo/:_authToken=$AUTH_TOKEN && \
  npm install [email protected] && \
  apk update && apk add yarn python g++ make && rm -rf /var/cache/apk/* && \
  set NODE_ENV=production && \
  npm config set registry https://registry.npmjs.org/ && \
  npm install

COPY . /app

RUN ls -al -R

EXPOSE 51967

CMD [ "pm2-runtime", "start", "pm2.json" ]

It should be just as readable but the final image should be smaller and potentially a bit faster to build.