How to sandbox Node.js apps?

[zkochan]

Unlike Deno, Node.js allows arbitrary code to do whatever it wants on your system. As a result, there is a huge attack opportunity via packages installed to node_modules.

Just preventing the execution of scripts will not solve the problem.

What if we make some user friendly tooling for running Node.js apps inside docker images? Is that at all possible?

[quentincaffeino]

Anyone can create a basic nodejs image. However it certainly takes some time and knowledge to make it safe. But I'm not sure it should be a part of this project since creating a service container is a big taks in itself.

It is much easier to compile your app and use deno to run it. For example with sveltekit: https://github.com/pluvial/svelte-adapter-deno

[Jack-Works]

You may want to know https://github.com/endojs/endo which is a Node.js sandbox.

Also, Deno has a Node compatibility mode that can run many NodeJS packages.