Master Production-grade Best Practices to Build your Node.js Docker Images
summary
Pins base images by digest instead of FROM node:latest, uses npm ci --only=production with a lockfile to get deterministic, faster installs, and sets NODE_ENV outside install. Runs as a nonroot user and uses dumb-init to forward signals and enable graceful shutdowns. Demonstrates command injection via ImageMagick in an unpinned base and shows docker scan finding 624 vulnerabilities which drop to 58 by switching to a slimmer base. Uses multi stage builds and BuildKit secrets to avoid leaking tokens.
AI-written summary · about
chapters (12)
- 0:00Introduction and speaker intro
- 1:44Why simplistic Dockerfiles fail
- 2:46Use explicit and deterministic image tags
- 6:15Install dependencies the right way
- 7:59Optimize libraries for production
- 9:41Run containers with least privilege
- 13:11Never run Node as PID 1
- 17:45Use a process manager like dumb-init
- 19:53Scan and fix image vulnerabilities
- 26:39Multi-stage builds for security
- 29:50Mount secrets safely with BuildKit
- 30:31Conclusion and resources
related talks
43mMaster production: best practices to build Node.js Docker images
28mNode.js Rocks in
20mCreating Production Ready Containers: What Devs Need to Know to Secure Their Containers
29m5 Security Best Practices For Production Ready Containers
33mBest Practices for Production-ready .NET Docker Images
21mScaling Node.js applications with Kubernetes and Docker
35mSecuring Containers by Breaking In
29mHow to Build and Run Node Apps with Docker and Compose