Symlink shenanigans - node.js, npm, express and vagrant
Recently I was working on a new project on a virtual box set up through vagrant. For those of you who haven’t used it, vagrant is an amazing tool that makes it crazy-easy to set up and deploy uniform development environments on virtual servers. However, I ran in to a very frustrating issue when trying to install the node.js framework express through npm.
Node was set up and running fine, and I’d successfully gotten a few modules working by adding them to the dependencis list in package.json and running npm install. I then added express, so my dependencies list now looked like:
"dependencies": {
"aws-sdk": "0.9.x",
"express": "3.x",
"pg": "x"
}
I ran npm install, then got hit with an error along the lines of:
error code EROFS
error errno 56
This error means the file system is read only. But I already managed to install two other modules in the same way on the same system! So what gives?
Symlink shenanigans
The issue is caused by the way express attempts to symlink binaries. One of the restrictions when using virtualbox is that symlinks can’t be created within shared folders. (My code was mounted from a shared folder on my local machine) This is discussed in a bit more detail on this github issue.
There are a wide variety of suggested fixes for this floating around on the net. One is to edit the vagrant config file to allow symlinks to be created, explained in more detail here. This one didn’t work for me, so my search went on, and eventually led me to the github issue linked above.
The issue resulted in a patch being added to npm which will install packages without forcing the symlinks. So, when running “npm install” on a virtual machine created through vagrant, run it as:
npm install --no-bin-link
This will install the dependencies listed in the packages.json file, whilst preventing npm from creating symlinks for any binaries the packages may contain.
CyberWiseCon 2025
In May 2025, I'll be giving a talk at CyberWiseCon 2025 in Vilnius, Lithuania. From selling 10 Downing St, to moving the Eiffel Tower to Dublin, this talk covers real-world examples of unconventional ways to stop scrapers, phishers, and content thieves. You'll gain practical insights to protect assets, outsmart bad actors, and avoid the mistakes we made along the way!
Get your ticket now and I'll see you there!