Runtime Node

Stop shipping OS bloat.

A secure, distroless Node.js base image built entirely FROM scratch.
No shell. No package manager. No OS utilities. Just Node.js — and nothing else.

Runtime Node is a production-grade Docker base image that ships only what Node.js actually needs to run — and nothing more.

Built entirely FROM scratch, the image is assembled by extracting hand-picked binaries and shared libraries from the official Alpine Node.js image, rather than inheriting a full operating system. The result is an image that is smaller, safer, and cleaner than any Alpine or Debian-based alternative — with zero known vulnerabilities and a footprint of approximately ~45 MB.

Most Node.js Docker images ship with far more than your application needs at runtime. That extra surface area — shells, package managers, system utilities — doesn't help your app run. It just gives attackers somewhere to hide.

Runtime Node eliminates that entirely. By building from scratch and including only the minimum required components, the image enforces a distroless guarantee: if a tool isn't needed to execute Node.js, it isn't there.

# Docker Hub
docker pull runtimenode/runtime-node:latest

# GitHub Container Registry
docker pull ghcr.io/Runtimes-Node/runtime-node:latest

Add Runtime Node as your base image and copy in your application:

FROM runtimenode/runtime-node:v2.2.0-25.8.0

COPY --chown=nobody:nobody dist/ /app/

USER nobody
ENTRYPOINT ["/usr/local/bin/node", "/app/index.js"]

Note: Because the image has no shell, your ENTRYPOINT must use exec form (JSON array syntax) and reference the Node.js binary by its full path: /usr/local/bin/node.

To report a vulnerability, please follow the responsible disclosure process outlined in SECURITY.md. Do not open a public GitHub Issue for security reports.

This project follows a Code of Conduct. By participating, you are expected to uphold it.

Contributions are welcome. Please read CONTRIBUTING.md before opening a pull request.