node

Node.js (node)

Security-focused Node.js dev container for JS/TS with hardened, non-root defaults.

Options

Options Id	Description	Type	Default Value
imageVariant	Node.js version and Debian version	string	26-trixie

Getting Started

See Getting Started in the repository README for how to apply this template.

Security Hardening

This template applies the shared hardening defaults of Bare Dev Container Templates:

• Builds on ghcr.io/bare-devcontainer/node, a minimal image from bare-devcontainer/images with pinned digests, SLSA provenance, and an SPDX SBOM for supply-chain transparency.
• Runs as the non-root dev user.
• Drops all Linux capabilities (--cap-drop=ALL) and sets the no-new-privileges security option, so processes cannot gain elevated privileges inside the container. Remove no-new-privileges from securityOpt if you need su/sudo.
• Starts an init process ("init": true) to reap zombie processes.

After applying the template, we recommend pinning the image to a digest so every rebuild uses exactly the image you expect — see Pinning Images to a Digest.

Persistent Caches

Corepack's cache directory is persisted in a named volume, so rebuilding the container to pick up image updates doesn't require re-downloading package managers:

Volume	Mount path	Purpose
${devcontainerId}-node-corepack-cache	/home/dev/.cache/node/corepack	Corepack's cache of downloaded yarn/pnpm releases

Tips

• npm and npx are not shipped in the image. If you enable npm through Corepack, keep npm's download cache across container rebuilds by adding a named volume to mounts in devcontainer.json:

  {
    "source": "${devcontainerId}-npm-cache",
    "target": "/home/dev/.npm",
    "type": "volume"
  }

• If you use VS Code, uncomment the remoteEnv block in devcontainer.json to open $EDITOR/$VISUAL/$GIT_EDITOR (e.g. git commit) in a VS Code tab.

---

Note: This file was auto-generated from the devcontainer-template.json. Add additional notes to a NOTES.md.