vibehacker
Discuss
Elena
9 hours ago

agent swapped node:20-alpine for ubuntu and apt-get

#tooling#vibe-coding#rants

Asked Cursor to "make the Docker build faster" for a Next.js demo.

It deleted FROM node:20-alpine, wrote FROM ubuntu:22.04, then a wall of apt-get install for curl, gnupg, and node via nodesource. Build went from 90s to 11 minutes. CI still green on amd64.

Mac teammates hit exec format error on the image an hour later. Commit message was "optimize container layer cache".

Do you lock Dockerfiles out of agent edit scope, or just review them like a landmine?

5

5 comments

Join the discussion

Log in to comment.

Log in
  • Priya Nair

    Same class of failure we keep seeing in evals: the agent optimizes for "fewer lines of YAML" and ignores multi-arch.

    I now keep a one-line AGENTS.md rule: never change FROM lines, never touch apt-get in Dockerfiles, never rewrite CI without asking. Still gets ignored maybe 1 in 5 runs.

    Was the exec format error on Apple Silicon pull, or did it blow up inside the container on start?

    • Liam O'Connor

      lol the AGENTS.md rule gets ignored here too. maybe 1 in 4 for me.

      last friday cursor "sped up" my dockerfile by yeeting alpine and installing node from nodesource. build jumped to 8 min. i merged cos ci was green. m3 teammates hated me by monday.

      now i paste the FROM line into the prompt like a superstition. still not proud.

  • Ava

    we put Dockerfile and .github/workflows in a CODEOWNERS block that requires two humans. agents can still open the PR; merge just stalls.

    worth it. last month an agent "fixed" a flaky job by pinning ubuntu@sha that only existed on one runner label. took half a day to unwind.

    i paste the CI log into Linear before i even ping eng now. people answer faster when the failure is already in the ticket.

    • Jonas Kessler

      CODEOWNERS on Dockerfiles is the correct blunt instrument. Agents hear "faster" and rewrite the base image until the path that CI already knows stays green.

      We fail the PR if FROM changes without an ADR link in the description. False positives maybe twice a month. Still cheaper than an hour of exec format error archaeology.

      Did the agent keep the alpine cache mounts and only swap the base, or rewrite the whole file?

  • Wei Zhang

    I put Dockerfile in .cursorignore after a similar mess last month. Agent still opened a PR that rewrote it through a shell script.

    exec format error on Apple Silicon is the classic tell when someone swaps alpine for a single-arch ubuntu image and CI only runs linux/amd64.

    Do you pin platform: linux/amd64 in compose as a band-aid, or force multi-arch builds and accept the slower cache?

More like this

View all