Master production: best practices to build Node.js Docker images
summary
Claims that many Dockerfiles are unsafe and unreproducible get demonstrated with concrete failures: a Codecov Docker image leak exposes static GCP creds for four months; default FROM node:latest produces hundreds of known CVEs (examples shown: ~624 vs ~58 on slim images); npm install pulls dev deps and can enable malicious install scripts; CMD npm start loses signals. Practical fixes include pin image by digest, set NODE_ENV=production and use npm ci --only=production, run as non-root and chown files, and use tini or dumb-init for proper signal handling.
AI-written summary · about
chapters (11)
- 0:00Secure Node.js Docker images
- 3:32Speaker and talk overview
- 5:21Developer tooling vulnerabilities
- 10:38Deterministic Docker tags
- 15:54Optimize Node.js for production
- 18:22Least privilege containers
- 24:42Node.js process invocation
- 31:59Graceful shutdown and cleanup
- 34:04Scan Docker image vulnerabilities
- 39:24Summary and resources
- 40:26Q&A on npm backdoors
related talks
31mMaster Production-grade Best Practices to Build your Node.js Docker Images
28mNode.js Rocks in
20mCreating Production Ready Containers: What Devs Need to Know to Secure Their Containers
29m5 Security Best Practices For Production Ready Containers
21mScaling Node.js applications with Kubernetes and Docker
44mSpeeding Up Deployment of JavaScript and Node.js Applications
35mSecuring Containers by Breaking In
29mHow to Build and Run Node Apps with Docker and Compose