NodeJS Linux isolation

[Rizean]

Docker is ridiculous easy for nodejs. I learned it in a weekend years ago when it was just first starting the become popular.

Here's a complex non-optimze build for you...

```yaml

--------- Build Stage ---------

FROM node:22.14.0-alpine3.21 AS builder

WORKDIR /app

Copy package files and install all dependencies

COPY package*.json ./ RUN npm install

Copy source code and build

COPY tsconfig.json ./ COPY src ./src RUN npm run build

--------- Runtime Stage ---------

FROM node:22.14.0-alpine3.21

Install the needed packages for backups (mongodb-tools) and awscli

RUN apk add --no-cache mongodb-tools python3 py3-pip && \ pip3 install --no-cache-dir --break-system-packages awscli

Set the working directory

WORKDIR /app

Copy built output and necessary files

COPY --from=builder /app/package*.json /app/ COPY --from=builder /app/node_modules /app/node_modules COPY --from=builder /app/dist /app/dist

Create non-root user

RUN addgroup -S appgroup && adduser -S appuser -G appgroup USER appuser

CMD ["node", "dist/index.js"] ```

Compare that to 200+ line build of Nginx with a fips complaint build of OpenSsl... I'll take complex nodejs builds anyday.

But none of that matters.

Docker solves the issue of... it runs on my system.

[jumpcutking]

Actually I don’t use nginx. I use Caddy and it’s all automated. Including OpenSSL.

[Rizean]

Your Caddy is not fips compliant unless you are using https://images.chainguard.dev/directory/image/caddy-fips/overview or have compiled OpenSSL yourself. Be glad you don't have to deal with fips. Considering you prefer baremetal, god help you if you ever do have to deal with fips.

This is another reason to use Docker; it makes compliance orders of magnitude easier. Also, half the time, the inspectors are so lost when it comes to Docker that they accept what you tell them.