Question 1

What are the main security risks of using the 'eval()' function in Node.js?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js security-focused phone screens — no prior security background assumed. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Every consequence below was **actually demonstrated by running real code**, not described as a hypothetical. ## 1. Why This Even Matters — A Story First Handing a stranger a blank check with your signature already on it is fun

Question 2

How do you containerize a Node.js app with a small, secure Docker image (multi-stage, distroless)?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js deployment/DevOps-adjacent system-design interviews. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The production-vs-full dependency size gap below was **actually measured** in this sandbox via real `npm install` runs. The full Docker image build itself could not be executed in this particular sandbox session (Docker Desktop's engine was not

Question 3

What is the 'vm' (Virtual Machine) module and when would you use it?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js interviews — assumes basic `eval()`/scope familiarity (see the dedicated `eval()` risks question). **Difficulty:** Hard > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The sandbox isolation below was **actually verified** on Node v24.19.0, in both directions — not assumed from the module's name. ## 1. Why This Even Matters — A Story First A test kitchen physically

Question 4

What is the Node.js permission model (--permission) and what does it protect against?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js security and runtime-sandboxing interviews. **Difficulty:** Hard > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The blocked and allowed file reads below were **actually run** with a real `node --permission` process — a genuine, specific error for the unlisted path, not a description of documented behavior. ## 1. Why This Even Matters — A Story First A hotel guest

NODE.JSDECODED.

Easy

What are the main security risks of using the 'eval()' function in Node.js?

Medium

How do you containerize a Node.js app with a small, secure Docker image (multi-stage, distroless)?

Hard

What is the 'vm' (Virtual Machine) module and when would you use it?

What is the Node.js permission model (--permission) and what does it protect against?