`vite build` should not write a files outside of explicitly set directories (`build.outDir`, etc.)

Description

I run vite inside a docker container for security reasons.

My docker run looks like:

docker container run -d --rm --name "myApp" \
	-v "~/myApp:/var/www/myApp:ro" \
	-v "~/myApp/tmp:/var/www/myApp/tmp:rw" \
	-v "~/myApp/logs:/var/www/myApp/logs:rw" \
	-v "~/myApp/package-lock.json:/var/www/myApp/package-lock.json:rw" \
	"myApp:latest"

As you can see, the application code files are read-only and they can’t be changed from inside the docker container (for example, some mistake like rm -rf * can’t remove all my code files).

But since version 3.0.1, vite build creates the vite.config.js.mjs file in the root directory, and since version 3.0.3 it creates a file with a random name like vite.config.js.timestamp-1659277944620.mjs.

Because my application root is the read-only, then docker container exec -i "myApp" bash -l -c 'npm run build' fails with error:

failed to load config from /var/www/myApp/vite.config.js
error during build:
Error: EROFS: read-only file system, open '/var/www/myApp/vite.config.js.timestamp-1659277944620.mjs'

Suggested solution

Write file only to explicitly set directories.

Alternative

No response

Additional context

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn’t already an issue that request the same feature to avoid creating a duplicate.

[bluwy]

vite.config.js.timestamp-1659277944620.mjs is a file bundled by Vite to read the config file. It happens for TS by default in Vite 3.0.0, and expanded to do so for JS too in Vite 3.0.1.

It doesn’t generate to build.outDir because the import paths would then be different. I’m not sure how this can be fixed in Vite, but the Docker setup may need to relax a bit for now, until something like https://github.com/vitejs/vite/issues/5370#issuecomment-1193357749 is implemented.

[lyleaf]

I solved it by just using a python yaml instead of a nodejs yaml, as mine is a static website.