mirror of
https://github.com/goauthentik/authentik
synced 2026-05-14 19:06:39 +02:00
Adds scripts/container-sandbox and a node-install-containerized Makefile target that runs the npm install steps inside an ephemeral Linux microVM via Apple's container runtime (macOS 15+, Apple Silicon). The container mounts the repo at /work and sees nothing else — no ~/.ssh, no ~/.aws, no Keychain — providing kernel-level isolation on top of the .npmrc ignore-scripts defense from the parent PR. Opt-in only. Default 'make node-install' is unchanged and identical across platforms. README documents the workflow tradeoffs (Linux binaries in node_modules, exclusive with the native install). Co-Authored-By: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>