Ditto. I don’t see how this is different/better from existing harnesses such as Opencode, Pi, and even “commercial” open source offerings such as the CLIs for Codex, Copilot, and Gemini, especially once tricked out with plugins and extensions.

Docker’s main advantage is just being more well known and hence more supported as a default option.

Even then, I feel that this availability of docker compose files is an illusion, due to their verbosity and limitations inherent to docker. Less granular control of permissions, clunkiness in updating images, and multi container stacks feeling like an afterthought.

In pretty much all other ways podman feels superior. Cockpit provides a basic web gui, but quadlets are the main draw. Way easier to configure, explicitly designed for multi containers, and updating all images is a single command.

Roughly, the different ecosystems from least to most complex are:

Docker/Portainer -> Podman/Cockpit/Quadlets -> Kubernetes

As someone completely unfamiliar with the JavaScript mess, are these security issues specific to npm the actual repository or npm the package manager?

If it’s the latter, does using something else like yarn or bun instead help?