template(node): persist Corepack cache across container rebuilds

src/node/.devcontainer/devcontainer.json

@@ -7,11 +7,19 @@
   "runArgs": ["--cap-drop=ALL"],
   // Remove "no-new-privileges" if users need to gain elevated privileges inside the container (e.g., su, sudo).
   "securityOpt": ["no-new-privileges"],
-  "init": true
+  "init": true,
   // If you use VS Code, uncomment the following to open $EDITOR/$VISUAL/$GIT_EDITOR (e.g. `git commit`) in a VS Code tab:
   // "remoteEnv": {
   //   "VISUAL": "code --wait",
   //   "EDITOR": "code --wait",
   //   "GIT_EDITOR": "code --wait"
-  // }
+  // },
+  "mounts": [
+    // Persist Corepack's cache across rebuilds to avoid re-downloading package managers.
+    {
+      "source": "${devcontainerId}-node-corepack-cache",
+      "target": "/home/dev/.cache/node/corepack",
+      "type": "volume"
+    }
+  ]
 }

src/node/NOTES.md

@@ -13,9 +13,17 @@ This template applies the shared hardening defaults of Bare Dev Container Templa
 
 After applying the template, we recommend pinning the image to a digest so every rebuild uses exactly the image you expect — see [Pinning Images to a Digest](https://github.com/bare-devcontainer/templates#pinning-images-to-a-digest).
 
+## Persistent Caches
+
+Corepack's cache directory is persisted in a named volume, so rebuilding the container to pick up image updates doesn't require re-downloading package managers:
+
+| Volume | Mount path | Purpose |
+|--------|------------|---------|
+| `${devcontainerId}-node-corepack-cache` | `/home/dev/.cache/node/corepack` | Corepack's cache of downloaded `yarn`/`pnpm` releases |
+
 ## Tips
 
-- To keep npm's download cache across container rebuilds, add a named volume to `mounts` in `devcontainer.json`:
+- npm and npx are not shipped in the image. If you enable npm through Corepack, keep npm's download cache across container rebuilds by adding a named volume to `mounts` in `devcontainer.json`:
 
   ```json
   {

src/node/README.md

@@ -24,9 +24,17 @@ This template applies the shared hardening defaults of Bare Dev Container Templa
 
 After applying the template, we recommend pinning the image to a digest so every rebuild uses exactly the image you expect — see [Pinning Images to a Digest](https://github.com/bare-devcontainer/templates#pinning-images-to-a-digest).
 
+## Persistent Caches
+
+Corepack's cache directory is persisted in a named volume, so rebuilding the container to pick up image updates doesn't require re-downloading package managers:
+
+| Volume | Mount path | Purpose |
+|--------|------------|---------|
+| `${devcontainerId}-node-corepack-cache` | `/home/dev/.cache/node/corepack` | Corepack's cache of downloaded `yarn`/`pnpm` releases |
+
 ## Tips
 
-- To keep npm's download cache across container rebuilds, add a named volume to `mounts` in `devcontainer.json`:
+- npm and npx are not shipped in the image. If you enable npm through Corepack, keep npm's download cache across container rebuilds by adding a named volume to `mounts` in `devcontainer.json`:
 
   ```json
   {

src/node/devcontainer-template.json

@@ -1,6 +1,6 @@
 {
   "id": "node",
-  "version": "1.0.4",
+  "version": "1.1.0",
   "name": "Node.js",
   "description": "Security-focused Node.js dev container for JS/TS with hardened, non-root defaults.",
   "publisher": "Bare Dev Container Maintainers",