npm automatically picks up GITHUB_TOKEN / NPM_TOKEN from the build
environment and writes them as _authToken entries in /root/.npmrc and
/usr/local/etc/npmrc during 'npm install -g'. Add a cleanup RUN step
that removes any npmrc file containing auth tokens before the image is
finalised, and explicitly deletes the two most common registry auth
keys via 'npm config delete'.
Also add .npmrc to .dockerignore as an extra guard against accidentally
COPY-ing a local credential file into the build context.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Docker Desktop requires a commercial licence for business use. Replace all
references with free alternatives:
- macOS: Rancher Desktop (GUI) or Colima (CLI)
- Linux: Docker Engine CE (no Desktop needed at all)
- Windows: Rancher Desktop or WSL2 + Docker Engine
setup.sh detects the OS and shows platform-specific install instructions.
claude.sh defers to setup.sh for install hints to avoid duplication.
README documents all options including a WSL2 setup walkthrough.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
