create-nodejs-fn 0.0.3 → 0.1.0

package/README.md

@@ -252,6 +252,10 @@ createNodejsFnPlugin({
     preInstallCommands: [],
     postInstallCommands: [],
     env: { MY_VAR: "value" },
+    // Run as a non-root user inside the container
+    user: { name: "app", uid: 1000, gid: 1000 },
+    // Or replace everything above with a fully custom Dockerfile
+    // dockerfilePath: "./containers/native.Dockerfile",
   },
   
   // Environment variables to pass from Worker to Container
@@ -265,6 +269,9 @@ createNodejsFnPlugin({
 });
 ```
 
+- `docker.user` lets you switch the runtime to a non-root user after installs while keeping generated paths (`/app`) writable.
+- To own the entire build, supply `docker: { dockerfilePath: "./containers/native.Dockerfile" }`. The type prevents mixing this with other docker options so you don't accidentally combine incompatible settings. If the custom Dockerfile doesn't already start `server.mjs`, the generator will append `CMD ["node", "./server.mjs"]` to the end.
+
 ---
 
 ## 🏗️ Internal Architecture

package/dist/index.d.mts

@@ -1,13 +1,28 @@
 import { Plugin } from 'vite';
 
-type DockerOptions = {
+type DockerUser = {
+    name: string;
+    uid?: number;
+    gid?: number;
+};
+type GeneratedDockerOptions = {
     baseImage?: string;
     systemPackages?: string[];
     preInstallCommands?: string[];
     postInstallCommands?: string[];
     env?: Record<string, string>;
     extraLines?: string[];
+    /**
+     * Create and switch to a non-root runtime user.
+     * Package installs still run as root; the user is applied before CMD.
+     */
+    user?: DockerUser;
+};
+type CustomDockerfileOption = {
+    /** Use a fully custom Dockerfile (path resolved from project root). */
+    dockerfilePath: string;
 };
+type DockerOptions = GeneratedDockerOptions | CustomDockerfileOption;
 type Opts = {
     files?: string[];
     generatedDir?: string;

package/dist/index.mjs

@@ -63,6 +63,9 @@ function collectExternalDeps(rootPkgPath, needed) {
     dependencies: out
   };
 }
+function isCustomDockerfile(opts) {
+  return Boolean(opts && "dockerfilePath" in opts && typeof opts.dockerfilePath === "string");
+}
 async function buildContainerServer(opts) {
   const { mods, outBaseAbs, dockerOpts, containerPort, external, root } = opts;
   ensureDir(outBaseAbs);
@@ -139,12 +142,35 @@ http.createServer((req, res) => {
 `
     );
   }
+  if (isCustomDockerfile(dockerOpts)) {
+    const customPath = path.resolve(root, dockerOpts.dockerfilePath);
+    if (!fs.existsSync(customPath)) {
+      throw new Error(
+        `[create-nodejs-fn] Custom Dockerfile not found: ${dockerOpts.dockerfilePath} (resolved to ${customPath})`
+      );
+    }
+    let customDockerfile = fs.readFileSync(customPath, "utf8");
+    if (!/server\.mjs/.test(customDockerfile) || !/\b(CMD|ENTRYPOINT)\b/.test(customDockerfile)) {
+      const trimmed = customDockerfile.replace(/\s*$/, "");
+      const suffix = [
+        trimmed,
+        "",
+        "# create-nodejs-fn runtime start",
+        'CMD ["node", "./server.mjs"]',
+        ""
+      ].join("\n");
+      customDockerfile = suffix;
+    }
+    writeFileIfChanged(dockerfile, customDockerfile);
+    return;
+  }
   const {
     baseImage = "node:20-slim",
     systemPackages = [],
     preInstallCommands = [],
     postInstallCommands = [],
-    env: dockerEnv = {}
+    env: dockerEnv = {},
+    user
   } = dockerOpts ?? {};
   const installLines = "RUN corepack enable && pnpm install --prod --no-frozen-lockfile";
   const sysDeps = systemPackages.length > 0 ? [
@@ -158,6 +184,13 @@ http.createServer((req, res) => {
     "ENV NODE_ENV=production",
     ...Object.entries(dockerEnv).map(([k, v]) => `ENV ${k}=${JSON.stringify(v ?? "")}`)
   ];
+  const userLines = user && user.name ? [
+    "# Runtime user (from plugin options)",
+    `RUN groupadd --system${user.gid ? ` --gid ${user.gid}` : ""} ${user.name} \\`,
+    `    && useradd --system --create-home --no-log-init --home-dir /home/${user.name} --gid ${user.name}${user.uid ? ` --uid ${user.uid}` : ""} ${user.name}`,
+    `RUN mkdir -p /app && chown -R ${user.name}:${user.name} /app`,
+    `USER ${user.name}`
+  ] : [];
   writeFileIfChanged(
     dockerfile,
     [
@@ -173,6 +206,7 @@ http.createServer((req, res) => {
       "COPY ./server.mjs ./server.mjs",
       ...envLines,
       ...postRuns,
+      ...userLines,
       `EXPOSE ${containerPort}`,
       `CMD ["node", "./server.mjs"]`,
       ""

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nodejs-fn",
-  "version": "0.0.3",
+  "version": "0.1.0",
   "description": "Vite plugin to enable calling Node.js-dependent functions directly from Cloudflare Workers!!",
   "main": "dist/index.js",
   "module": "dist/index.mjs",