create-nodejs-fn 0.0.3 → 0.1.1

package/README.md

@@ -236,6 +236,9 @@ createNodejsFnPlugin({
   
   // Container port (default: 8080)
   containerPort: 8080,
+
+  // Duration before containers are put to sleep (default: "10s")
+  sleepAfter: "30s",
   
   // External dependencies to install in container
   external: ["@napi-rs/canvas", "sharp"],
@@ -252,6 +255,10 @@ createNodejsFnPlugin({
     preInstallCommands: [],
     postInstallCommands: [],
     env: { MY_VAR: "value" },
+    // Run as a non-root user inside the container
+    user: { name: "app", uid: 1000, gid: 1000 },
+    // Or replace everything above with a fully custom Dockerfile
+    // dockerfilePath: "./containers/native.Dockerfile",
   },
   
   // Environment variables to pass from Worker to Container
@@ -265,6 +272,9 @@ createNodejsFnPlugin({
 });
 ```
 
+- `docker.user` lets you switch the runtime to a non-root user after installs while keeping generated paths (`/app`) writable.
+- To own the entire build, supply `docker: { dockerfilePath: "./containers/native.Dockerfile" }`. The type prevents mixing this with other docker options so you don't accidentally combine incompatible settings. If the custom Dockerfile doesn't already start `server.mjs`, the generator will append `CMD ["node", "./server.mjs"]` to the end.
+
 ---
 
 ## 🏗️ Internal Architecture

package/dist/index.d.mts

@@ -1,19 +1,38 @@
 import { Plugin } from 'vite';
 
-type DockerOptions = {
+type DockerUser = {
+    name: string;
+    uid?: number;
+    gid?: number;
+};
+type GeneratedDockerOptions = {
     baseImage?: string;
     systemPackages?: string[];
     preInstallCommands?: string[];
     postInstallCommands?: string[];
     env?: Record<string, string>;
     extraLines?: string[];
+    /**
+     * Create and switch to a non-root runtime user.
+     * Package installs still run as root; the user is applied before CMD.
+     */
+    user?: DockerUser;
 };
+type CustomDockerfileOption = {
+    /** Use a fully custom Dockerfile (path resolved from project root). */
+    dockerfilePath: string;
+};
+type DockerOptions = GeneratedDockerOptions | CustomDockerfileOption;
 type Opts = {
     files?: string[];
     generatedDir?: string;
     binding?: string;
     className?: string;
     containerPort?: number;
+    /**
+     * Duration before containers are put to sleep. Accepts the Cloudflare duration string format (e.g. "10s", "5m").
+     */
+    sleepAfter?: string;
     external?: string[];
     docker?: DockerOptions;
     /**

package/dist/index.mjs

@@ -63,6 +63,9 @@ function collectExternalDeps(rootPkgPath, needed) {
     dependencies: out
   };
 }
+function isCustomDockerfile(opts) {
+  return Boolean(opts && "dockerfilePath" in opts && typeof opts.dockerfilePath === "string");
+}
 async function buildContainerServer(opts) {
   const { mods, outBaseAbs, dockerOpts, containerPort, external, root } = opts;
   ensureDir(outBaseAbs);
@@ -139,12 +142,35 @@ http.createServer((req, res) => {
 `
     );
   }
+  if (isCustomDockerfile(dockerOpts)) {
+    const customPath = path.resolve(root, dockerOpts.dockerfilePath);
+    if (!fs.existsSync(customPath)) {
+      throw new Error(
+        `[create-nodejs-fn] Custom Dockerfile not found: ${dockerOpts.dockerfilePath} (resolved to ${customPath})`
+      );
+    }
+    let customDockerfile = fs.readFileSync(customPath, "utf8");
+    if (!/server\.mjs/.test(customDockerfile) || !/\b(CMD|ENTRYPOINT)\b/.test(customDockerfile)) {
+      const trimmed = customDockerfile.replace(/\s*$/, "");
+      const suffix = [
+        trimmed,
+        "",
+        "# create-nodejs-fn runtime start",
+        'CMD ["node", "./server.mjs"]',
+        ""
+      ].join("\n");
+      customDockerfile = suffix;
+    }
+    writeFileIfChanged(dockerfile, customDockerfile);
+    return;
+  }
   const {
     baseImage = "node:20-slim",
     systemPackages = [],
     preInstallCommands = [],
     postInstallCommands = [],
-    env: dockerEnv = {}
+    env: dockerEnv = {},
+    user
   } = dockerOpts ?? {};
   const installLines = "RUN corepack enable && pnpm install --prod --no-frozen-lockfile";
   const sysDeps = systemPackages.length > 0 ? [
@@ -158,6 +184,13 @@ http.createServer((req, res) => {
     "ENV NODE_ENV=production",
     ...Object.entries(dockerEnv).map(([k, v]) => `ENV ${k}=${JSON.stringify(v ?? "")}`)
   ];
+  const userLines = user && user.name ? [
+    "# Runtime user (from plugin options)",
+    `RUN groupadd --system${user.gid ? ` --gid ${user.gid}` : ""} ${user.name} \\`,
+    `    && useradd --system --create-home --no-log-init --home-dir /home/${user.name} --gid ${user.name}${user.uid ? ` --uid ${user.uid}` : ""} ${user.name}`,
+    `RUN mkdir -p /app && chown -R ${user.name}:${user.name} /app`,
+    `USER ${user.name}`
+  ] : [];
   writeFileIfChanged(
     dockerfile,
     [
@@ -173,6 +206,7 @@ http.createServer((req, res) => {
       "COPY ./server.mjs ./server.mjs",
       ...envLines,
       ...postRuns,
+      ...userLines,
       `EXPOSE ${containerPort}`,
       `CMD ["node", "./server.mjs"]`,
       ""
@@ -529,6 +563,7 @@ function generateWorkerFiles(opts) {
     binding,
     className,
     containerPort,
+    sleepAfter,
     workerEnvVars,
     clientFileName,
     doFileName,
@@ -652,7 +687,7 @@ ${envVarEntries.map(([key, src]) => `  ${JSON.stringify(key)}: env[${JSON.string
       extends: "Container",
       properties: [
         { name: "defaultPort", initializer: String(containerPort) },
-        { name: "sleepAfter", initializer: JSON.stringify("10s") },
+        { name: "sleepAfter", initializer: JSON.stringify(sleepAfter) },
         ...envVarInitializer ? [{ name: "envVars", initializer: envVarInitializer }] : []
       ]
     });
@@ -718,6 +753,7 @@ function createNodejsFnPlugin(opts = {}) {
   const binding = opts.binding ?? "NODEJS_FN";
   const className = opts.className ?? "NodejsFnContainer";
   const containerPort = opts.containerPort ?? 8080;
+  const sleepAfter = opts.sleepAfter ?? "10s";
   const external = opts.external ?? [];
   const docker = opts.docker ?? {};
   const workerEnvVars = opts.workerEnvVars ?? [];
@@ -819,6 +855,7 @@ function createNodejsFnPlugin(opts = {}) {
       binding,
       className,
       containerPort,
+      sleepAfter,
       workerEnvVars,
       clientFileName: GENERATED_FILENAMES.client,
       doFileName: GENERATED_FILENAMES.durableObject,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nodejs-fn",
-  "version": "0.0.3",
+  "version": "0.1.1",
   "description": "Vite plugin to enable calling Node.js-dependent functions directly from Cloudflare Workers!!",
   "main": "dist/index.js",
   "module": "dist/index.mjs",