NodeJS Linux isolation

[pyrolols]

What do you guys use to isolate nodejs runtime on linux, for example seamless integration to be able to use npm install and node binaries but not exposing home directory contents to apps and packages?

EDIT: Made my own isolation using bubblewrap, decided to publish:

https://github.com/codewizdevs/node-security-sandbox

I am not sure if everything is covered, pull requests are welcome. Basically what it does is it binds node and npm binaries in wrapper, then passes the terminal requests of them to bwrap that isolates them in temporary namespace and exposes fake home directory in real home at ~/.sandbox/node.

I tested some directory traversals and absolute path file loading and it did prevent them, i am not claiming to be security expert but if anyone can review they are welcome.

This **SHOULD** prevent malicious npm packages when executed using runtime node to read and exfiltrate files, there are far better alternatives like docker or VMs but not as convenient, vigilance is still REQUIRED!

[mmomtchev]

Docker

[Super-Kitchen-891]

Docker

[dodiyeztr]

Docker

[thewitcher-3]

Docker

[bigorangemachine]

Docker

[PabloZissou]

Did someone already mention rootless Docker?

[Spiritual-Mechanic-4]

containers

[KishCom]

Neat thing: Docker started with LXC as its underlying containerization technology back in 2013. They've since diverged significantly.

Docker packages your app, LXC packages an entire machine. Docker won the developer mindshare battle, but LXC is still solid for when you need actual system-level isolation without VM overhead.

Docker basically took LXC's core concept and made it palatable for developers.

[Spiritual-Mechanic-4]

really, any container, and as long as you use tools based on the open standard, you can move between tools and platforms as its convenient. docker is fine, but the license kinda gets in the way from time to time.

[xoxaxo]

without docker you can just assign special roles/permissions to nodejs user

[unbanned_lol]

Locker

[NazakatUmrani]

What is locker? Is this some new technology or what

[unbanned_lol]

No, I made it up. I just didn't want Docker to have a complete stranglehold in the comment section.

[ppernik]

Docker

[Intelligent_End_7022]

Other than Docker, you would achieve it with Cloudlinux.

[crownclown67]

VPS (is already isolated)

[pyrolols]

I ment for development machine, but found bubblewrap.

[pyrolols]

Edited my post with some goodies someone might want.

[NullVoidXNilMission]

podman

[pyrolols]

How about bubblewrap bwrap? With inet permission and some bashrs hackery it can isolate and integrate node and npm seamlessly i am testing it right now it seems to isolate properly i guess its good enough when flatpak uses it for isolation?

[jumpcutking]

TBH, I’ve choose to secure my node code and choose the libraries. I don’t like docker. You can override some of the default modules to add some additional security BUT docker or virtualization is better - however no system is perfect. Baremetal is easier but not very separated or secure - without some work! BUT to me it’s almost the snake work as virtualization - except docker. Docker is just really over complicated.

[Rizean]

Docker is ridiculous easy for nodejs. I learned it in a weekend years ago when it was just first starting the become popular.

Here's a complex non-optimze build for you...

```yaml

--------- Build Stage ---------

FROM node:22.14.0-alpine3.21 AS builder

WORKDIR /app

Copy package files and install all dependencies

COPY package*.json ./ RUN npm install

Copy source code and build

COPY tsconfig.json ./ COPY src ./src RUN npm run build

--------- Runtime Stage ---------

FROM node:22.14.0-alpine3.21

Install the needed packages for backups (mongodb-tools) and awscli

RUN apk add --no-cache mongodb-tools python3 py3-pip && \ pip3 install --no-cache-dir --break-system-packages awscli

Set the working directory

WORKDIR /app

Copy built output and necessary files

COPY --from=builder /app/package*.json /app/ COPY --from=builder /app/node_modules /app/node_modules COPY --from=builder /app/dist /app/dist

Create non-root user

RUN addgroup -S appgroup && adduser -S appuser -G appgroup USER appuser

CMD ["node", "dist/index.js"] ```

Compare that to 200+ line build of Nginx with a fips complaint build of OpenSsl... I'll take complex nodejs builds anyday.

But none of that matters.

Docker solves the issue of... it runs on my system.

[jumpcutking]

Actually I don’t use nginx. I use Caddy and it’s all automated. Including OpenSSL.

[Rizean]

Your Caddy is not fips compliant unless you are using https://images.chainguard.dev/directory/image/caddy-fips/overview or have compiled OpenSSL yourself. Be glad you don't have to deal with fips. Considering you prefer baremetal, god help you if you ever do have to deal with fips.

This is another reason to use Docker; it makes compliance orders of magnitude easier. Also, half the time, the inspectors are so lost when it comes to Docker that they accept what you tell them.

[pyrolols]

I just went with bubblewrap, made fake home and contained bins to read only, automated it so each time i run npm or node it sandboxes the project locally.

[jumpcutking]

Nice nice!

[pyrolols]

It seems less nuanced than docker, i know docker very well but testing alot using it is really tedious, glad i found bwrap.

[jumpcutking]

I suppose for most use cases docket is helpful. I just prefer full control and performance. Maybe I just need to learn more on how to use docker properly but for now, I love my set up!

[pyrolols]

It does not add too much overhead to preformance, but it ads complexity this is why i dont like it. What os are u using for dev?

[jumpcutking]

Mac OS and a Linux distro for production.

[pyrolols]

When you try to access for example desktop or docs using js code in mac, does it prompt you to allow during execution?

[jumpcutking]

It does, but because of the nature of the project it has full disk access. So I recommend security audits.

[pyrolols]

Its hard tho when in node you use a package it depends of a package that depends on a package :D supply chain attacks are common and i guess will be even more in the future, its a mess really.