Run as a user, not root, inside the container
A process that escapes a container as root is root on the node. Most base images ship a user for this.
FROM node:24-slim
USER node
WORKDIR /home/node/appIf the app needs to bind a port under 1024, use a higher port and let the ingress map it. Nothing in a web app needs root.
dockersecurity