Building Enterprise JavaScript Applications

Setting capabilities

Another solution is to set capabilities.

On Linux, when a thread or process requires certain privilege(s) to perform an action, such as reading a file or binding to a port, it checks with a list of capabilities. If it has that capability, it'll be able to perform that function; otherwise, it can't. By default, the root user has all capabilities, for instance, the CAP_CHOWN capability, which allows it to change a file's UID and GID.

Therefore, rather than running the process as root, we can simply grant our Node process the capability of binding to privileged ports:

hobnob@hobnob:$ sudo setcap CAP_NET_BIND_SERVICE=+ep $(which node)

You can check that the capability is set for this process by running getcap:

hobnob@hobnob:$ ...