bellsoft/hardened-nodejs repository overview

⁠Hardened Containers images with Node.js

This repository contains Hardened Containers Stream images with Node.js and related utilities (npm).

The images are compatible with the Docker official image for Node⁠ with notable improvements:

• For enhanced security the images include only minimum amount of packages, exclude a package manager and are configured to execute the application as a non-root user (node) .
• There are 2 flavours of libc supported: Musl and Glibc. Using Musl often leads to a smaller final image size.
• The images include tini⁠ which can be used to wrap the Node process for proper signal handling. To enable this set your entrypoint to ENTRYPOINT ["/usr/sbin/tini", "--"].
• The default entrypoint is configured so that all command line arguments are passed 'as is' to the /usr/bin/node binary.

⁠Example

Here are the steps to produce an image with the basic HTTP server application from nodejs.org⁠.

First create a server.js file with content:

import { createServer } from 'node:http';

const server = createServer((req, res) => {
  res.writeHead(200, { 'Content-Type': 'text/plain' });
  res.end('Hello World!\n');
});

server.listen(3000, '0.0.0.0', () => {
  console.log('Listening on 0.0.0.0:3000');
});

Then create a Dockerfile:

FROM bellsoft/hardened-nodejs:musl

WORKDIR /app
COPY server.js .

ENTRYPOINT ["/usr/sbin/tini", "--"]
CMD ["node", "server.js"]

Please note that we configured tini to be the entrypoint. This enables our image to handle signals properly.

Finally, build and run the image:

$ docker build -t hardened-node-example . 
$ docker run --rm -p 3000:3000 hardened-node-example
Listening on 0.0.0.0:3000

Accessing it will produce expected results:

$ curl http://127.0.0.1:3000
Hello World!
$ 

⁠Tags

Hardened Containers images support the latest major Node.js release, and there are tags for each libc type:

• X-glibc, X.Y-glibc, X.Y.Z-glibc - specified version of Node.js with Glibc
• X-musl, X.Y-musl, X.Y.Z-musl - specified version of Node.js with Musl
• glibc - latest Node.js version with Glibc
• musl, latest - latest Node.js version with Musl

⁠License

As with all Docker images, these also contain other software, which may be distributed under other licenses.

The list of installed software components and their licenses can be retrieved by executing the grep -E '^[PVL]:' /var/lib/apk/db/installed command in the image.

As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.