Runtime Node

Stop shipping OS bloat.

A secure, distroless Node.js base image built entirely FROM scratch.
No shell. No package manager. No OS utilities. Just Node.js — and nothing else.

Runtime Node is a production-grade Docker base image that ships only what Node.js actually needs to run — and nothing more.

Built entirely FROM scratch, the image is assembled by extracting hand-picked binaries and shared libraries from the official Alpine Node.js image, rather than inheriting a full operating system. The result is an image that is smaller, safer, and cleaner than any Alpine or Debian-based alternative — with zero known vulnerabilities and a footprint of approximately <50 MB.

Most Node.js Docker images ship with far more than your application needs at runtime. That extra surface area — shells, package managers, system utilities — doesn't help your app run. It just gives attackers somewhere to hide.

Runtime Node eliminates that entirely. By building from scratch and including only the minimum required components, the image enforces a distroless guarantee: if a tool isn't needed to execute Node.js, it isn't there.

# Docker Hub
docker pull runtimenode/runtime-node:latest
# GitHub Container Registry
docker pull ghcr.io/runtimes-node/runtime-node:latest

For versioned (production-recommended) tags, see the Releases page.

Replace <image_tag> and <node_version> with the values from the latest release.

# Build stage — use the matching Node.js versionFROM node:<node_version>-alpine AS builder
WORKDIR /dist
COPY ./ ./
RUN npm ci --omit=dev --no-cache
# Runtime stage — distroless, production-readyFROM runtimenode/runtime-node:<image_tag>
# Copy your production build artifacts onlyCOPY --from=builder --chmod=555 dist/ /app/
# No shell is available — invoke Node directly using exec formENTRYPOINT ["/usr/local/bin/node", "/app/index.js"]

Note: Because the image has no shell, your ENTRYPOINT must use exec form (JSON array syntax) and reference the Node.js binary by its full path: /usr/local/bin/node.

To report a vulnerability, please follow the responsible disclosure process outlined in SECURITY.md. Do not open a public GitHub Issue for security reports.

This project follows a Code of Conduct. By participating, you are expected to uphold it.

Contributions are welcome. Please read CONTRIBUTING.md before opening a pull request.