A Node.js deployment is a tested release artifact plus configuration, identity, networking, health, observability, scaling, and rollback. The same application lifecycle applies whether the runtime is a VM service, container, managed platform, or serverless function.
Choose an Active or Maintenance LTS Node line for production; Node 24 is LTS in July 2026. Declare the supported engine, commit package-lock.json, install with npm ci, run tests and build in a clean environment, and package only runtime files and production dependencies.
Build once and promote the same immutable artifact through environments. Record source revision, dependency lock digest, runtime version, build time, and migration version. Do not compile independently on every server because artifacts can drift.
Read deployment-specific values from environment or the platform secret mechanism. Validate the complete configuration before binding the public port. Keep secrets out of images, source, command lines, URLs, health output, and logs.
Bind to the host and PORT contract expected by the platform, commonly 0.0.0.0 and an injected port in containers. Treat forwarded headers as trusted only behind known proxies and configure the application or framework accordingly.
Liveness answers whether the process should be restarted. Readiness answers whether it should receive traffic. Startup checks allow slow initialization without premature restarts. Keep liveness independent of a transient downstream outage that a restart cannot fix.
Readiness remains false until required configuration, migrations, connection pools, and essential warmup are complete. Health endpoints must be cheap, bounded, unauthenticated only as platform design requires, and free of secrets or large dependency detail.
import { createServer } from 'node:http';
let ready = false;
const server = createServer((req, res) => {
if (req.url === '/live') return res.end('ok');
if (req.url === '/ready') {
res.statusCode = ready ? 200 : 503;
return res.end(ready ? 'ready' : 'starting');
}
res.statusCode = 404;
res.end('not found');
});
server.listen(Number(process.env.PORT ?? 3000), '0.0.0.0', () => { ready = true; });The endpoints answer different operational questions; a real service sets readiness after required dependencies succeed.
On SIGTERM, fail readiness, stop new connections, drain in-flight requests within a deadline, close queues and database pools, flush bounded telemetry, then exit. Keep the platform termination grace period longer than the application drain deadline.
Rolling, blue-green, and canary releases require old and new versions to coexist. Make database changes backward compatible with expand, migrate, switch, and contract stages. Track errors and latency by release version and halt promotion on regression.
On a VM, run Node under the operating-system service manager or a dedicated process manager that starts on boot, restarts crashes with backoff, limits resources, captures logs, and sends termination signals. Run as a non-root account with a narrow working directory and environment file permissions.
Place TLS and public connection policy at a maintained reverse proxy or managed load balancer when appropriate. Configure request size, idle and upstream timeouts, keep-alive alignment, compression, and trusted proxy headers consistently. Avoid stacking multiple restart managers that fight one another.
Use an official supported Node base image pinned according to update policy, copy lockfiles before dependency installation for cache efficiency, use a multi-stage build where compilation is required, and run the final image as a non-root user. Include only runtime artifacts and scan both OS and npm dependencies.
Containers should write logs to stdout and stderr, store durable state externally, and receive secrets at runtime. Set CPU and memory requests or limits from load tests. Test SIGTERM because PID 1 and shell entrypoints can affect signal forwarding; use an exec-form command.
FROM node:24-bookworm-slim AS dependencies
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev
FROM node:24-bookworm-slim
ENV NODE_ENV=production
WORKDIR /app
COPY --from=dependencies /app/node_modules ./node_modules
COPY package.json server.mjs ./
USER node
EXPOSE 3000
CMD ["node", "server.mjs"]The final image has production dependencies, a non-root user, and an exec-form command. Pinning and patch cadence remain deployment-policy decisions.
Managed application platforms and container services reduce host maintenance and commonly provide TLS, health checks, revisions, autoscaling, secrets, and logs. Configure min and max instances, concurrency, region, network access, and database connection budgets instead of accepting defaults blindly.
Serverless functions suit event-driven or bursty bounded work but introduce cold starts, execution deadlines, ephemeral files, concurrency, and connection reuse constraints. Split a service only when the operational model fits; a long-lived HTTP server is often simpler for sustained stateful connections or background ownership.
Before promotion, verify artifact integrity, configuration, migrations, permissions, health, smoke behavior, security headers, dependency connectivity, and graceful shutdown. After release, watch error rate, latency percentiles, saturation, event-loop delay, memory, restarts, and business outcomes.
Rollback must name the previous artifact and database compatibility. Practice it. If a migration cannot roll back safely, use a forward fix and keep old application versions compatible until the transition is complete. Preserve incident evidence without delaying urgent recovery.
Node recommends Active LTS or Maintenance LTS for production. Current is useful for evaluating upcoming features but may change more quickly.
Usually the container orchestrator owns restart and scaling. Run one application process per container unless a measured design requires otherwise.
Explore 500+ free tutorials across 20+ languages and frameworks.