You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Thank you for your contribution. Here are a set of guidelines for contributing to the docker-node project.
3
+
Thank you for your contribution. Here are a set of guidelines for contributing
4
+
to the docker-node project.
4
5
5
6
## Version Updates
6
7
7
8
New **Node.js** releases are released as soon as possible.
8
9
9
-
New **NPM** releases are not tracked. We simply use the NPM version bundled in the corresponding Node.js release.
10
+
New **NPM** releases are not tracked. We simply use the NPM version bundled in
11
+
the corresponding Node.js release.
10
12
11
-
**Yarn** is updated to the latest version only when there is a new Node.js SemVer PATCH release (unless Yarn has received a security update), and it's updated only in the branch with the new release, preferably in the same PR. The `update.sh` script does this automatically when invoked with a specific branch, e.g. `./update.sh 6.10`.
13
+
**Yarn** is updated to the latest version only when there is a new Node.js
14
+
SemVer PATCH release (unless Yarn has received a security update), and it's
15
+
updated only in the branch with the new release, preferably in the same PR. The
16
+
`update.sh` script does this automatically when invoked with a specific branch,
17
+
e.g. `./update.sh 6.10`.
12
18
13
19
### Submitting a PR for a version update
14
20
15
-
If you'd like to help us by submitting a PR for a version update, please do the following:
16
-
17
-
1.[Fork this project.](https://help.github.com/en/github/getting-started-with-github/fork-a-repo)
18
-
1.[Clone the forked repository.](https://help.github.com/en/github/creating-cloning-and-archiving-repositories/cloning-a-repository)
19
-
1. Create a branch for the update PR. For example, `git checkout master; git checkout -b version-update`.
20
-
1. Run `./update.sh`. You can see additional options by using accessing the built-in help documentation with `./update.sh -h`. This script will automatically update the appropriate files with the latest versions and checksums.
21
-
1. Commit the modified files to the `version-update` branch and push the branch to your fork.
22
-
1.[Create a PR to merge the branch from your fork into this project's master branch.](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/creating-a-pull-request-from-a-fork).
21
+
If you'd like to help us by submitting a PR for a version update, please do the
NodeJS is a big ecosystem with a variety of different use cases. The docker images for node are designed to provide the minimum for running core node. Additional dependencies (including dependencies for npm or yarn such as git) will not be included in these base images and will need to be included in descendent image.
41
+
NodeJS is a big ecosystem with a variety of different use cases. The docker
42
+
images for node are designed to provide the minimum for running core node.
43
+
Additional dependencies (including dependencies for npm or yarn such as git)
44
+
will not be included in these base images and will need to be included in
When base images are patched, the images are rebuilt and rolled out to the Docker hub without intervention by this repo. This process is explained in <https://github.com/docker-library/faq/#why-does-my-security-scanner-show-that-an-image-has-cves>.
15
+
When base images are patched, the images are rebuilt and rolled out to the
16
+
Docker hub without intervention by this repo. This process is explained in
<!-- END doctoc generated TOC please keep comment here to allow auto update -->
21
+
1
22
# Docker and Node.js Best Practices
2
23
3
24
<!-- START doctoc generated TOC please keep comment here to allow auto update -->
@@ -21,31 +42,38 @@
21
42
22
43
## Environment Variables
23
44
24
-
Run with `NODE_ENV` set to `production`. This is the way you would pass in secrets and other runtime configurations to your application as well.
45
+
Run with `NODE_ENV` set to `production`. This is the way you would pass in
46
+
secrets and other runtime configurations to your application as well.
25
47
26
-
```
48
+
```console
27
49
-e "NODE_ENV=production"
28
50
```
29
51
30
52
## Global npm dependencies
31
53
32
-
If you need to install global npm dependencies, it is recommended to place those dependencies in the [non-root user](#non-root-user) directory. To achieve this, add the following line to your `Dockerfile`
54
+
If you need to install global npm dependencies, it is recommended to place those
55
+
dependencies in the [non-root user](#non-root-user) directory. To achieve this,
56
+
add the following line to your `Dockerfile`
33
57
34
58
```Dockerfile
35
59
ENV NPM_CONFIG_PREFIX=/home/node/.npm-global
36
60
37
-
ENV PATH=$PATH:/home/node/.npm-global/bin # optionally if you want to run npm global bin without specifying path
61
+
# optionally if you want to run npm global bin without specifying path
62
+
ENV PATH=$PATH:/home/node/.npm-global/bin
38
63
```
39
64
40
65
## Upgrading/downgrading Yarn
41
66
42
67
### Local
43
68
44
-
If you need to upgrade/downgrade `yarn` for a local install, you can do so by issuing the following commands in your `Dockerfile`:
45
-
46
-
> Note that if you create some other directory which is not a descendant one from where you ran the command, you will end up using the global (dated) version. If you wish to upgrade `yarn` globally follow the instructions in the next section.
69
+
If you need to upgrade/downgrade `yarn` for a local install, you can do so by
70
+
issuing the following commands in your `Dockerfile`:
47
71
48
-
> When following the local install instructions, due to duplicated yarn the image will end up being bigger.
72
+
> Note that if you create some other directory which is not a descendant one
73
+
> from where you ran the command, you will end up using the global (dated)
74
+
> version. If you wish to upgrade `yarn` globally follow the instructions in the
75
+
> next section. When following the local install instructions, due to duplicated
76
+
> yarn the image will end up being bigger.
49
77
50
78
```Dockerfile
51
79
FROM node:6
@@ -62,22 +90,25 @@ FROM node:6
62
90
63
91
ENV YARN_VERSION 1.16.0
64
92
65
-
RUN curl -fSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \
Node.js was not designed to run as PID 1 which leads to unexpected behaviour when running inside of Docker. For example, a Node.js process running as PID 1 will not respond to `SIGINT` (`CTRL-C`) and similar signals. As of Docker 1.13, you can use the `--init` flag to wrap your Node.js process with a [lightweight init system](https://github.com/krallin/tini) that properly handles running as PID 1.
121
+
Node.js was not designed to run as PID 1 which leads to unexpected behaviour
122
+
when running inside of Docker. For example, a Node.js process running as PID 1
123
+
will not respond to `SIGINT` (`CTRL-C`) and similar signals. As of Docker 1.13,
124
+
you can use the `--init` flag to wrap your Node.js process with a [lightweight
125
+
init system](https://github.com/krallin/tini) that properly handles running as
126
+
PID 1.
91
127
92
-
```
128
+
```console
93
129
docker run -it --init node
94
130
```
95
131
96
-
You can also include Tini [directly in your Dockerfile](https://github.com/krallin/tini#using-tini), ensuring your process is always started with an init wrapper.
132
+
You can also include Tini [directly in your
133
+
Dockerfile](https://github.com/krallin/tini#using-tini), ensuring your process
134
+
is always started with an init wrapper.
97
135
98
136
## Non-root User
99
137
100
-
By default, Docker runs container as root which inside of the container can pose as a security issue. You would want to run the container as an unprivileged user wherever possible. The node images provide the `node` user for such purpose. The Docker Image can then be run with the `node` user in the following way:
138
+
By default, Docker runs container as root which inside of the container can pose
139
+
as a security issue. You would want to run the container as an unprivileged user
140
+
wherever possible. The node images provide the `node` user for such purpose. The
141
+
Docker Image can then be run with the `node` user in the following way:
101
142
102
-
```
143
+
```console
103
144
-u "node"
104
145
```
105
146
@@ -112,9 +153,12 @@ FROM node:6.10.3
112
153
USER node
113
154
```
114
155
115
-
Note that the `node` user is neither a build-time nor a run-time dependency and it can be removed or altered, as long as the functionality of the application you want to add to the container does not depend on it.
156
+
Note that the `node` user is neither a build-time nor a run-time dependency and
157
+
it can be removed or altered, as long as the functionality of the application
158
+
you want to add to the container does not depend on it.
116
159
117
-
If you do not want nor need the user created in this image you can remove it with the following:
160
+
If you do not want nor need the user created in this image you can remove it
161
+
with the following:
118
162
119
163
```Dockerfile
120
164
# For debian based images use:
@@ -136,7 +180,8 @@ If you need another name for the user (ex. `myapp`) execute:
136
180
RUN usermod -d /home/myapp -l myapp node
137
181
```
138
182
139
-
For alpine based images, you do not have `groupmod` nor `usermod`, so to change the uid/gid you have to delete the previous user:
183
+
For alpine based images, you do not have `groupmod` nor `usermod`, so to change
184
+
the uid/gid you have to delete the previous user:
140
185
141
186
```Dockerfile
142
187
RUN deluser --remove-home node \
@@ -146,26 +191,33 @@ RUN deluser --remove-home node \
146
191
147
192
## Memory
148
193
149
-
By default, any Docker Container may consume as much of the hardware such as CPU and RAM. If you are running multiple containers on the same host you should limit how much memory they can consume.
194
+
By default, any Docker Container may consume as much of the hardware such as CPU
195
+
and RAM. If you are running multiple containers on the same host you should
196
+
limit how much memory they can consume.
150
197
151
-
```
198
+
```console
152
199
-m "300M" --memory-swap "1G"
153
200
```
154
201
155
202
## CMD
156
203
157
-
When creating an image, you can bypass the `package.json`'s `start` command and bake it directly into the image itself. First off this reduces the number of processes running inside of your container. Secondly it causes exit signals such as `SIGTERM` and `SIGINT` to be received by the Node.js process instead of npm swallowing them.
204
+
When creating an image, you can bypass the `package.json`'s `start` command and
205
+
bake it directly into the image itself. First off this reduces the number of
206
+
processes running inside of your container. Secondly it causes exit signals such
207
+
as `SIGTERM` and `SIGINT` to be received by the Node.js process instead of npm
208
+
swallowing them.
158
209
159
210
```Dockerfile
160
211
CMD ["node","index.js"]
161
212
```
162
213
163
214
## Docker Run
164
215
165
-
Here is an example of how you would run a default Node.JS Docker Containerized application:
216
+
Here is an example of how you would run a default Node.JS Docker Containerized
217
+
application:
166
218
167
-
```
168
-
$ docker run \
219
+
```console
220
+
docker run \
169
221
-e "NODE_ENV=production" \
170
222
-u "node" \
171
223
-m "300M" --memory-swap "1G" \
@@ -176,11 +228,14 @@ $ docker run \
176
228
177
229
## Security
178
230
179
-
The Docker team has provided a tool to analyze your running containers for potential security issues. You can download and run this tool from here: https://github.com/docker/docker-bench-security
231
+
The Docker team has provided a tool to analyze your running containers for
232
+
potential security issues. You can download and run this tool from here:
233
+
<https://github.com/docker/docker-bench-security>
180
234
181
235
## node-gyp alpine
182
236
183
-
Here is an example of how you would install dependencies for packages that require node-gyp support on the alpine variant:
237
+
Here is an example of how you would install dependencies for packages that
0 commit comments