npm not found in dhi.io -dev images

[carlos-lehmann]

Hey Community,

I'm lost and would appreciate some help! :-/ I feel like I'm missing basic information but I can't figure it out...

when I pull the dhi.io/node:24-alpine3.23-dev image:

~# docker run --rm -it dhi.io/node:24-alpine3.23-dev /bin/sh
Unable to find image 'dhi.io/node:24-alpine3.23-dev' locally
24-alpine3.23-dev: Pulling from node
5e4870038675: Pull complete
2852796e3cec: Pull complete
857ed60e4853: Pull complete
738bd3dd6e23: Pull complete
2cfad43e59db: Pull complete
7e4aae3e734a: Pull complete
Digest: sha256:98e6a72e18932e4c27de1529b498410549ae7351cc3e618240e6aa888291d53d
Status: Downloaded newer image for dhi.io/node:24-alpine3.23-dev
/app # which npm
/usr/local/bin/npm
/app # npm --version
11.7.0
/app #

I can clearly see that I have npm installed on this image.
Now I'm trying to build my own image on basis of dhi.io/node:24-alpine3.23-dev as build-stage with Kaniko but for some reason it can't find npm?

Dockerfile:

FROM my.dockerhub.proxy/dhi.io/node:24-alpine3.23-dev AS build-stage

# Output the PATH variable to debug
RUN echo $PATH

# Check if npm is accessible
RUN which npm || echo "npm is not in PATH"

# Try to print npm version
RUN npm --version

docker run --rm -v /root:/workspace     path/to/my/kaniko/image/kaniko-executor:v1.25.4     --context /workspace --dockerfile /workspace/Dockerfile --no-push
INFO[0000] Resolved base name my.dockerhub.proxy/dhi.io/node:24-alpine3.23-dev to build-stage
INFO[0000] Retrieving image manifest my.dockerhub.proxy/dhi.io/node:24-alpine3.23-dev
INFO[0000] Retrieving image my.dockerhub.proxy/dhi.io/node:24-alpine3.23-dev from registry my.dockerhub.proxy
INFO[0000] Built cross stage deps: map[]
INFO[0000] Retrieving image manifest my.dockerhub.proxy/dhi.io/node:24-alpine3.23-dev
INFO[0000] Returning cached image manifest
INFO[0000] Executing 0 build triggers
INFO[0000] Building stage 'my.dockerhub.proxy/dhi.io/node:24-alpine3.23-dev' [idx: '0', base-idx: '-1']
INFO[0000] Unpacking rootfs as cmd RUN echo $PATH requires it.
INFO[0002] RUN echo $PATH
INFO[0002] Initializing snapshotter ...
INFO[0002] Taking snapshot of full filesystem...
INFO[0004] Cmd: /bin/sh
INFO[0004] Args: [-c echo $PATH]
INFO[0004] Util.Lookup returned: &{Uid:0 Gid:0 Username:root Name: HomeDir:/root}
INFO[0004] Performing slow lookup of group ids for root
INFO[0004] Running: [/bin/sh -c echo $PATH]
/sbin:/usr/sbin:/bin:/usr/bin
INFO[0004] Taking snapshot of full filesystem...
INFO[0004] No files were changed, appending empty layer to config. No layer added to image.
INFO[0004] RUN which npm || echo "npm is not in PATH"
INFO[0004] Cmd: /bin/sh
INFO[0004] Args: [-c which npm || echo "npm is not in PATH"]
INFO[0004] Util.Lookup returned: &{Uid:0 Gid:0 Username:root Name: HomeDir:/root}
INFO[0004] Performing slow lookup of group ids for root
INFO[0004] Running: [/bin/sh -c which npm || echo "npm is not in PATH"]
npm is not in PATH
INFO[0004] Taking snapshot of full filesystem...
INFO[0004] No files were changed, appending empty layer to config. No layer added to image.
INFO[0004] RUN npm --version
INFO[0004] Cmd: /bin/sh
INFO[0004] Args: [-c npm --version]
INFO[0004] Util.Lookup returned: &{Uid:0 Gid:0 Username:root Name: HomeDir:/root}
INFO[0004] Performing slow lookup of group ids for root
INFO[0004] Running: [/bin/sh -c npm --version]
/bin/sh: npm: not found
error building image: error building stage: failed to execute command: waiting for process to exit: exit status 127

What I noticed is that the $PATH is different when using the image:

/app # which npm
/usr/local/bin/npm

vs using it during build in kaniko (it doesn't include /usr/local/(bin):

INFO[0004] Running: [/bin/sh -c echo $PATH]
/sbin:/usr/sbin:/bin:/usr/bin

But I can't find any information for this matter :-/

Of course this only happens with dhi.io images and we did not have this issue with the non-hardened public images and we were just following along the docs to replace those with dhi.io images.

[LaurentGoderre]

This looks like it could be a bug with Kaniko: GoogleContainerTools/kaniko#3403

[carlos-lehmann]

Interesting @LaurentGoderre thanks a lot!

I was able to fix it with adding PATH:

FROM node:24-alpine3.23 AS build-stage

# Adding /usr/local/bin to PATH
ENV PATH="/usr/local/bin:$PATH"

# Output the PATH variable to debug
RUN echo $PATH

# Check if npm is accessible
RUN which npm || echo "npm is not in PATH"

# Try to print npm version
RUN npm --version

But still then there must be a difference between the Public Docker Images and the hardened Images, right? Because on those I don't have to add the PATH, never had to with any images? I wonder if that's some security thing?

[LaurentGoderre]

This was fixed in v25 and the fix will be incorporated in other versions next time the images are updated

[carlos-lehmann]

Hey @LaurentGoderre much appreciated! Could you elaborate on the fix? Maybe a link? I have no idea where I would look for this.

Thank you very much!
Carlos

[LaurentGoderre]

Most runtime have an implicit PATH but it seems that Kaniko doesn't follow that convention so we added the env var explicitly.

If you inspect the node image with an OCI tool here is one of the version for a specific arch:
https://oci.dag.dev/?image=node@sha256:71a0b604347e88012324aea6cd371c31394de2e747c2eb67454a1fd33394ef04&mt=application%2Fvnd.oci.image.manifest.v1%2Bjson&size=2493

If you select the config digest, it shows the image configuration that includes the env var:
https://oci.dag.dev/?blob=node@sha256:0bbc9ccc88e2bf2def927a3987e089190cab08dbc7de8f66cd16aea7de88aa12&mt=application%2Fvnd.oci.image.config.v1%2Bjson&size=6748&manifest=node@sha256:71a0b604347e88012324aea6cd371c31394de2e747c2eb67454a1fd33394ef04

[carlos-lehmann]

This is awesome info, thanks so much @LaurentGoderre 👍