Skip to content

.tip

· one of the small things

Run as a user, not root, inside the container

A process that escapes a container as root is root on the node. Most base images ship a user for exactly this.

FROM node:24-slim
USER node
WORKDIR /home/node/app

If the app needs a port below 1024, use a higher one and let the ingress map it. Nothing in a web app needs root.

dockersecurity