All 15 Docker & Deployment questions
More in Docker & Deployment
What is the purpose of a HEALTHCHECK instruction in a Dockerfile for a Node.js application? How do Kubernetes ConfigMaps and Secrets differ, and how are they typically consumed by a Node.js pod? What is the purpose of setting explicit CPU and memory resource requests and limits for a Node.js container in Kubernetes? How do you properly handle process signals (SIGTERM) inside a containerized Node.js application to support graceful shutdown? How would you optimize Docker layer caching in a Node.js Dockerfile to speed up repeated builds during development? What is the difference between deploying a Node.js application to a Platform-as-a-Service (like Heroku or Render) versus a self-managed container orchestrator (like Kubernetes)? What is a Kubernetes Deployment's rolling update strategy, and how does it apply to updating a running Node.js application? How do you handle running database migrations as part of a Kubernetes-based Node.js deployment pipeline?
Advertisement
Back to results for “Deployment”
Node.js › Docker & Deployment

Why should a Node.js Docker container generally run as a non-root user, and how do you configure this in a Dockerfile?

Advanced

Answer

Running a container's process as root means that if an attacker manages to exploit a vulnerability in the application, they gain root-level access within the container, which combined with certain container escape vulnerabilities could pose additional risk to the host -- running as a dedicated, unprivileged user significantly limits the potential blast radius of a successful application-level compromise, following the principle of least privilege at the container level.
FROM node:20-alpine
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
WORKDIR /app
COPY --chown=appuser:appgroup . .
USER appuser
CMD ["node", "server.js"]
Real-world example A security audit flags that a company's production containers were all running as root by default; adding a dedicated non-root user to the Dockerfile and switching to it via the USER instruction closes that gap without requiring any change to the application code itself.

Common follow-ups: What specific additional Docker or Kubernetes security features (like read-only root filesystems) complement running as non-root?;Does official Node.js Docker images already include a pre-configured non-root user option?

Security;Cloud & DevOps
All 15 Docker & Deployment questions