.tip

Apr 13, 2026 · one of the small things

Cache the package manager's store across builds with a mount

A layer cache is all or nothing: change the lockfile and the whole install reruns from the network. A cache mount keeps the store between builds.

RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store \
    pnpm install --frozen-lockfile

The install still runs, but it links from the local store instead of downloading. Same trick for pip, cargo and go caches.

dockerci

~/tips/today — 2026-09-04

~cat tips/today

Session cookies: HttpOnly, Secure, SameSite=Lax

securityhttp

Three attributes, each closing a class of attack. HttpOnly keeps scripts from reading it. Secure keeps it off plain HTTP. SameSite=Lax stops it being sent on cross-site POSTs, which is most CSRF.

Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=1209600

Strict breaks arriving from an external link while logged in. Lax is the default worth keeping.

↵ open y yesterday l ls /tips

esc close