goldbergyoni/nodebestpractices

The Node.js best practices list (May 2023)

Summary

Node.js Best Practices is a curated, community-maintained collection of recommendations for building Node.js applications, organized into eight sections covering project architecture, error handling, code style, testing, production deployment, security, performance, and Docker practices. The 2026 edition is updated for Node.js 22.0.0 and uses tags like #new and #updated to help readers identify recently added or revised guidance.

What it is useful for

The repository functions as a reference guide for engineers designing, reviewing, or auditing Node.js services that use frameworks like Express, Fastify, Nest.js, or Koa. Concrete scenarios covered include structuring a codebase by business components with a three-tier layout (entry-points, domain, data-access), distinguishing operational errors from programmer errors, structuring tests using the AAA pattern, building lean Docker images with multi-stage builds, and applying security measures such as rate limiting middleware, dependency vulnerability scanning, JWT blocklisting, and running Node.js as a non-root user in containers.

The collection also addresses operational concerns like logging to stdout rather than configuring destinations in code, setting NODE_ENV=production, installing packages with npm ci, locking dependencies, and choosing memory management tools, alongside style guidance like preferring const over let, using ESLint with Node.js plugins, and following consistent naming conventions. The performance section is marked as a work in progress with only two items currently published.

How engineers can use it

The README does not document an installation process, since this is a documentation repository rather than a code library. Engineers can browse the table of contents in the README to navigate by topic, use the #new and #updated tags to focus on recent content, and follow the "Read More" links under each practice for code examples, blog citations, and expanded context. A companion starter called Practica.js is referenced for seeing the practices applied in a working application boilerplate, and translations are available in Chinese, French, Brazilian Portuguese, Russian, Polish, Japanese, and Basque.

The repository is licensed under CC-BY-SA-4.0, so content can be shared with attribution. The repository's language metadata is Dockerfile, reflecting the Docker practices section, and it is not archived. Contributions are accepted through issues and pull requests following the project's writing guidelines.