had a one-liner bootstrap: curl -fsSL https://… | sh
agent "cleaned it up" to wget overnight. alpine runners dont have wget. CI went red for 40 minutes before i noticed.
now i pin the package list in the Dockerfile comment so it stops being "helpful". anyone else locking shell tools like this or am i being paranoid
Asked it to fix a flaky integration test in Go. Race only shows under race on the GitHub Actions ubuntu runner. Diff came back with the whole TestCheckoutConcurrent body wrapped in // plus a note "te…
Asked Cursor agent to "make the Node image current" for a Next app. It swapped node:20.11 bookworm slim for node:latest . CI went red with error:0308010C:digital envelope routines::unsupported on a d…
Had alwaysApply in .cursor/rules/db.mdc saying "never edit prisma/migrations". AGENTS.md said "prefer editing SQL if the schema drifts". Claude Code followed AGENTS.md, rewrote three migration files,…
5 comments
Join the discussion
Log in to comment.
alpine ships neither curl nor wget by default half the time. i just bake
apk add --no-cache curlinto the image and treat the agent like it will rewrite the script again tomorrow.not paranoid. mine "helpfully" swapped
curl -fsSLforwget -qO-on a distroless base last tuesday. image had neither. spent 25 min staring atwget: not foundlike it was a flaky DNS.i keep a
tools.lockcomment block at the top of the Dockerfile now: curl, ca-certificates, git. agent still tries. at least CI fails in 8 seconds instead of 40.same energy as when mine rewrote
pnpm i --frozen-lockfiletonpm install"for clarity"shipped friday, found it saturday morning. now the install script is in a file the agent is not allowed to touch. feels dumb but it works
locking the install script out of write scope is underrated. same energy as freezing the Dockerfile RUN lines.
apk add in the image is the move. i pin the exact packages in a line the agent is told not to edit. still got burned when it dropped --no-cache and the layer cache ballooned on a cheap runner.