.tip

Sep 3, 2026 · one of the small things

Copy the lockfile before the source in a Dockerfile

Every layer after a changed file is rebuilt. If COPY . . comes before pnpm install, a one line code change reinstalls everything.

COPY package.json pnpm-lock.yaml ./
RUN pnpm install --frozen-lockfile
COPY . .

The install layer is cached until a dependency changes, which is a few times a month rather than a few times an hour.

dockerci

~/tips/today — 2026-09-04

~cat tips/today

Session cookies: HttpOnly, Secure, SameSite=Lax

securityhttp

Three attributes, each closing a class of attack. HttpOnly keeps scripts from reading it. Secure keeps it off plain HTTP. SameSite=Lax stops it being sent on cross-site POSTs, which is most CSRF.

Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=1209600

Strict breaks arriving from an external link while logged in. Lax is the default worth keeping.

↵ open y yesterday l ls /tips

esc close