Node.js Permission Model in Production: Enforcing Restricted Filesystem & Network Access

The Problem with Unrestricted Node.js Runtimes

By default, any third-party npm package running in a Node.js process has unrestricted access to the underlying filesystem, network interfaces, and environment variables. If a dependency contains malicious payload, it can read /etc/passwd, scan environment secrets (.env), or spawn reverse shells using child_process.exec().

Configuring the Native --permission Flag

Starting in Node.js 20 and stabilized in Node.js 22 LTS, the native Permission Model allows administrators to restrict process permissions without external containers:

node --permission      --allow-fs-read=/var/www/app/storage/,/var/www/app/dist/      --allow-fs-write=/var/www/app/storage/logs/      --deny-fs-read=/var/www/app/.env      server.js

Attempting to access unauthorized file paths throws an immediate ERR_ACCESS_DENIED security exception.