A practical guide to running Node.js containers with least privilege: dropping Linux capabilities, switching to a non-root user, enabling read-only root filesystems, and applying seccomp profiles so a container breakout is significantly harder.
Your pod restarts at random. No error in the application log. No uncaughtException. The process just vanishes. The culprit is the Linux OOM killer, and fixing it means understanding the gap between what Node.js thinks it allocated and what the kernel is actually tracking.