Check your local runtime
Check the runtime and fixed app before the next exercise.
Need to set up your terminal or tools? · Look up a term
YOUR TASK · LOCAL MACHINE
Check the local runtime and the fixed source before running the API.
Node.js 24 and the fixed files from lab 02. Docker is not used on this route.
Node.js is version 24, app.mjs parses, and all five tests pass.
Do the exercise on your computer. This page provides instructions and saves completion marks; it does not run commands or check your files.
Follow these steps
Terminal · extracted starter folder
Open a terminal in the exercise folder
Use the same extracted folder and fixed app from lab 02.
How do I open a terminal in the right folder?
Windows: open the extracted folder in File Explorer. Click the address bar, type
powershell, and press Enter.VS Code: open the extracted folder with File → Open Folder, then choose Terminal → New Terminal.
macOS or Linux: open Terminal and type
cdfollowed by the extracted folder’s path. If the path contains spaces, put it in quotes.The terminal must be in the folder containing
app.mjsandsecurity.test.mjs. Commands below are entered in that terminal, not in the browser address bar.Check before continuingapp.mjs and security.test.mjs are in the folder opened by your terminal.
Terminal
Check your Node.js runtime
TERMINALnode --version
Check before continuingThe version begins with v24.
Terminal
Check that the app parses
TERMINALnode --check app.mjs
This checks JavaScript syntax without starting the server. It does not prove that the authorization rule works.
Check before continuingThe command returns to the prompt with no syntax error.
Terminal
Run the security tests
TERMINALnode verify-lab.mjs fixed
Keep this saved app and these unchanged tests together for the next labs. This route runs the source directly; it does not produce a container image.
Check before continuingAll 5 tests pass. If they fail, return to the fix in lab 02.
Need to set up your terminal or tools? · Look up a term
YOUR TASK · DOCKER
Build a container image that runs the fixed API as a non-root user.
Docker running with Linux containers and the fixed files from lab 02. You do not need Node.js installed on your computer.
The image builds with five passing tests and its configured user is node.
Do the exercise on your computer. This page provides instructions and saves completion marks; it does not run commands or check your files.
Follow these steps
Terminal · extracted starter folder
Check Docker and your fixed app
Open a terminal in the folder containing the fixed app, tests, and supplied Dockerfile. Run these commands one at a time.
How do I open a terminal in the right folder?
Windows: open the extracted folder in File Explorer. Click the address bar, type
powershell, and press Enter.VS Code: open the extracted folder with File → Open Folder, then choose Terminal → New Terminal.
macOS or Linux: open Terminal and type
cdfollowed by the extracted folder’s path. If the path contains spaces, put it in quotes.The terminal must be in the folder containing
app.mjsandsecurity.test.mjs. Commands below are entered in that terminal, not in the browser address bar.TERMINALdocker info docker run --rm --mount "type=bind,source=.,target=/app,readonly" -w /app node:24-alpine node verify-lab.mjs fixed
Check before continuingdocker info shows server information, and the test command reports 5 passes.
Terminal · same folder
Build the image
TERMINALdocker build -t opsrung-lab:local .
The final dot means “use this folder.” The build reads the supplied Dockerfile and runs the tests. The first build may take longer while Docker downloads the base image.
Check before continuingThe build completes successfully. If it stops at the test step, return to lab 02 and fix the app before rebuilding.
Terminal · same folder
Check the user configured in the image
TERMINALdocker image inspect opsrung-lab:local --format "{{.Config.User}}"Read the
USER nodeline in the Dockerfile and connect it with this output.Check before continuingThe output is node.
Terminal · same folder
Check the runtime user
TERMINALdocker run --rm --network=none --entrypoint id opsrung-lab:local -u
This starts a short-lived container that prints its user ID and exits. It does not start the API or publish a port.
Check before continuingThe UID is a non-zero number (1000 in the supplied image). The temporary container exits automatically.
TRY WITHOUT COPYING · OPTIONAL
Separate the two ideas
For your chosen route, explain the difference between testing the app and checking the runtime. Can an app pass its tests while running with more privileges than it needs?
Compare your reasoning
Yes. Passing access-control tests does not prove the process has limited operating-system privileges. Runtime checks answer a different question.
Explain your answer aloud or write a sentence before opening the explanation. This does not change your completion record.
A QUICK CHECK
What should happen if an access-control regression test fails?
Done with this one?
Marking complete is your own record.
Confirm both results before marking this lab complete.