Secondly, I don't want to run a NodeJS application as root in order to allow it to run iptables. FROM node:14-buster-slim RUN apt-get update \ && apt-get -y install \ iptables \ libpcap-dev \ libcap2-bin \ && rm -rf /var/lib/apt/lists/* RUN chmod u+s /usr/sbin/xtables-nft-multi RUN setcap cap_net_raw,cap_net_admin = eip /usr/local/bin/node An isolated nodejs application, not running as root, but which can read raw network packets on the host, and run iptables commands.