yanwit/nodejs-dev repository overview

⁠nodejs-dev

Full-featured Node.js development container with multiple versions, package managers, and essential build tools for JavaScript/TypeScript projects.

⁠What's Inside

⁠Node.js Versions (via fnm)

⁠Package Managers

⁠Languages & Tools

• TypeScript - tsc, tsx (global)
• Python 3 - via apk
• Build tools - gcc, g++, make (build-base)
• CLI tools - git, curl, vim, ripgrep, tree, htop

⁠Quick Start

# Interactive shell with project mounted
docker run -it --rm \
  -v $(pwd)/my-project:/app \
  -p 3000:3000 \
  nodejs-dev:<version> bash

# Run specific Node version
docker run -it --rm \
  -v $(pwd)/my-project:/app \
  nodejs-dev:<version> fnm use 22 npm test

⁠Usage Examples

⁠Switch Node Version

# Inside container
fnm use 24
node -v

# On run
docker run -it --rm nodejs-dev:<version> bash -c "fnm use 24 && node -v"

⁠Run Commands

# Development server
docker run --rm -v $(pwd)/my-project:/app -p 3000:3000 nodejs-dev:<version> npm run dev

# Install dependencies
docker run --rm -v $(pwd)/my-project:/app nodejs-dev:<version> pnpm install

# Run tests
docker run --rm -v $(pwd)/my-project:/app nodejs-dev:<version> npm test

# Build project
docker run --rm -v $(pwd)/my-project:/app nodejs-dev:<version> npm run build

⁠Initialize New Project

# Create project folder
mkdir -p my-project

# Start container and init
docker run -it --rm -v $(pwd)/my-project:/app nodejs-dev:<version> bash

# Inside container
npm init -y
npm install express

⁠Exposed Ports

⁠Environment Variables

⁠Directory Structure

/
├── app/              # Working directory (mount your project here)
├── root/.fnm/        # fnm versions
└── root/.bun/        # bun runtime

⁠Base Image

• OS: Alpine edge (musl libc, rolling release for latest security patches)
• Node Manager: fnm v1.39.0 (Fast Node Manager)
• Runtime: Bun 1.3.14
• Size: ~1.56GB

⁠Changelog

⁠v3.0.2 (2026-07-17)

Security Fixes:

• Added apk upgrade --no-cache to runtime stage for latest security patches
• musl upgraded from 1.2.5-r21 to 1.2.6-r2 (fixes CVE-2026-40200, CVE-2026-6042)
• zlib upgraded from 1.3.1-r2 to 1.3.2-r0 (fixes CVE-2026-22184, CVE-2026-27171)
• busybox upgraded from 1.37.0-r31 to 1.38.0-r1

⁠v3.0.1 (2026-07-17)

Security Fixes:

• Runtime base image switched from alpine:3.23.5 to alpine:edge to get latest patched packages
• openssh upgraded from 10.2_p1-r0 to 10.4_p1-r0 (fixes CVE-2026-35385, CVE-2026-35414, CVE-2026-35386, CVE-2026-35387, CVE-2026-35388)
• git upgraded from 2.52.0-r0 to 2.55.0-r0 (fixes CVE-2025-66413)
• busybox upgraded from 1.37.0-r30 to 1.37.0-r31 (fixes CVE-2025-60876)

⁠v3.0.0 (2026-07-17)

Breaking Changes:

• Base image changed from ubuntu:24.04 to alpine:3.23.5
• All Node.js binaries now use musl builds from unofficial-builds.nodejs.org
• Node.js 20 removed (EOL since April 2026)
• Node.js 25 removed (non-LTS, odd-numbered release)
• yq removed (not in Alpine default repos)
• cmake removed (not in Alpine repos, use cmake from build-base if needed)
• unzip, wget, jq, tar, nano, coreutils removed from runtime (use curl, busybox, and vim instead)

Security Fixes:

• Alpine 3.23.5 has significantly fewer CVEs than Ubuntu 24.04
• Removed Node.js 20 (EOL) which bundled vulnerable [email protected], [email protected], [email protected]
• Removed Node.js 25 (non-LTS) which bundled 9 npm CVEs ([email protected], [email protected], [email protected], [email protected], [email protected], @sigstore/[email protected], @sigstore/[email protected])
• Upgraded npm to latest (12.0.1) in all Node.js versions ([email protected], [email protected])
• Removed Python pip from runtime (no setuptools/wheel CVEs)
• Removed tar (busybox provides), nano (use vim), coreutils (busybox provides) from runtime

Performance:

• Multi-stage build (builder + runtime) keeps build tools out of final image
• Alpine's musl libc is smaller and faster than glibc for most workloads

⁠v2.0.0 (2026-07-17)

Breaking Changes:

• Base image changed from debian:bookworm-slim to ubuntu:24.04
• Node.js 18 removed (EOL since April 2025)

Security Fixes:

• Added apt-get upgrade -y to patch all available OS-level CVEs
• Upgraded Python setuptools 68.1.2 -> 83.0.0 (fixes CVE-2025-47273, CVE-2024-6345)
• Upgraded Python wheel 0.42.0 -> 0.47.0 (fixes CVE-2026-24049)
• Pinned fnm install to --skip-shell (prevents shell RC modification during build)
• Pinned bun to v1.3.14 (reproducible builds)
• Added npm cache clean --force after global installs (reduces image size)
• Added apt-get purge --auto-remove and cleanup of /tmp/* and /var/tmp/*

Remaining Vulnerabilities (unfixable at container level):

• 49 Linux kernel CVEs (Ubuntu 24.04 kernel 6.8.0 — unpatched upstream, most irrelevant inside containers)
• 18 npm CVEs bundled inside Node.js v22.23.1 (tar, minimatch, undici, cross-spawn, picomatch, sigstore, glob — awaiting upstream Node.js patches)

⁠v1.0.0

• Initial release
• Base: debian:bookworm-slim
• Node.js versions: 18, 20, 22 (default), 24, 26
• Package managers: npm, pnpm, yarn, bun
• Global tools: typescript, tsx

⁠License

MIT