Error when running docker-compose up in dev env because of missing package `balanced-match`

[florian-drouet]

Bun v1.3.9 (Linux arm64)

error: Cannot find package 'balanced-match' from '/app/apps/backend/node_modules/brace-expansion/dist/esm/index.js'

Quick fix tested in dev is to remove existing package-lock.json and node_modules and to run npm install again to update

[getnao-bot]

🔍 AI Analysis

Summary: Docker build fails in dev environment due to missing balanced-match package. This is a lockfile synchronization issue between bun.lock and package-lock.json.

Labels: bug, docker, dependencies

Root Cause Analysis

The error occurs because:

1. Lockfile mismatch: The project has both bun.lock (for Bun) and package-lock.json (for npm)
2. Stale lockfile: The package-lock.json likely references an older version of brace-expansion that doesn't include balanced-match as a nested dependency
3. Docker uses npm: The Dockerfile runs npm ci which uses package-lock.json, but the lockfile may be out of sync with the actual dependency tree

When Bun installs, it updates bun.lock to reflect the correct dependency tree (including balanced-match). But when Docker runs npm ci with an outdated package-lock.json, it installs an incompatible version of brace-expansion.

Relevant Code

• Dockerfile (line 35-40): Uses npm ci which relies on package-lock.json
• Lockfiles: Both bun.lock and package-lock.json exist in repo root

Prior Art

This is a common issue in monorepos that support both Bun and npm. The quick fix (removing both lockfiles and reinstalling) works because it forces npm to regenerate package-lock.json from scratch.

Proposed Fixes

Option 1: Fix in Dockerfile (recommended)

# In backend-builder stage, replace:
RUN npm ci --omit=dev --ignore-scripts

# With:
RUN npm install --omit=dev --ignore-scripts

Using npm install instead of npm ci will update package-lock.json if needed, or you could delete it before install:

RUN rm -f package-lock.json && npm install --omit=dev --ignore-scripts

Option 2: Git ignore one lockfile
Consider removing package-lock.json from the repo if Bun is the primary package manager, or add it to .gitignore and document that npm users should run npm install to generate it.

Option 3: Pre-install step
Add a step to regenerate the lockfile before Docker build:

rm package-lock.json && npm install

Alternative Solutions

1. Use only Bun in Docker: Modify Dockerfile to use Bun instead of npm
2. Document the fix: Add a "Troubleshooting" section in README with the quick fix
3. CI check: Add a CI step that fails if lockfiles are out of sync

Suggested Next Steps

1. Quick fix: Update Dockerfile to delete package-lock.json before npm ci, or use npm install
2. Long-term: Decide on single package manager (Bun recommended for this project) and remove the unused lockfile

---

AI-assisted analysis