They don't need to pin it directly. They only need to "npm ci" (based on package...

LunaSea on March 22, 2022 | parent | context | favorite | on: Ask HN: Who operates at scale without containers?

They don't need to pin it directly.

They only need to "npm ci" (based on package-lock.json) instead of "npm install" (based on package.json) within the Docker container to get a fully reproducible build.