I build my nodejs/npm stuff in containers. Actually I build almost everything that way.
There are a lot of advantages in addition to the security gains, such as that I don't need to rely on every javascript programmer in the world understanding semver (they don't, and I have wasted more of my "sanity" on tracking down API changes and sloppy type contracts than I ever have spent cleaning up after malice.
Version Control for Cloud Configurations
(not affiliated in any way, just a happy user)
The argument that "Apache + Commons Clause" is a "combination" is straightforward to counter. The "Commons Clause" is not additive — it fundamentally changes the license, making it more restrictive and taking away potential uses. Consumers could not count on being able to do the things with software under such a license that they would ordinarily expect to be able to do with "Apache" licensed software, which damages the "Apache" brand.
In any case, it's not clear that it's worthwhile to go up against a sympathetic defendant like the ASF and make such an argument for limited benefit.
I was under the impression that it was Commons Clause that people started avoiding in favor of other "cloud protection licenses", both to avoid possible confusion and because Commons Clause got visceral reactions from some members of FLOSS community. Unfortunately, other similar licenses are less recognizable. The whole point of generic licenses is that they should be well known, widely used, and the legal departments already know their tradeoffs. If each company writes their own license then this makes it difficult for other companies to use their software, because legal departments need to check every license separately.
Is there a generic license that is the same (in spirit) as Apache + Commons Clause?
That said, I often make a messy "wip" commit that I push to my branch, just so that the work doesn't get lost. But I always undo such a commit and clean it up.
Also, I always use git add -p, so that I can break changes into multiple meaningful commits and review them one more time before pushing.
That aside, I am not advocating for less choice, merely observing that in many cases users willingly give up their privacy (or other rights) for convenience. Your reaction to my observation actually proves my point.