From a security standpoint, the attack surface of Node.js and whatever libraries are used to make `npm start` happen is a lot larger than plain Nginx.

From a general usability standpoint, a Node.js container with all build dependencies will surely turn into a bloated several hundred megabyte Docker image — an Nginx image with just the built static files is a lot smaller.

I understand you're comparing NodeJS vs Nginx there, but for my curiosity, if someone is building an API, how do you think NodeJS would compare to Ruby on Rails or Python/Django from a security standpoint?

I don’t think either language is fundamentally more secure than the other.

That being said, the Node.js ecosystem feels more immature than Python’s. The common practice of using microdependencies means that an average project has countless dependencies with varying levels of support — it’s all but impossible to make sure every one of those dependencies is properly maintained.

The framework/library churn rate seems to have decreased though, so that’s certainly good from a security standpoint as well.

It happened to me to have memory leaks and eventually OOM errors using Node.js as static files server. Switched then to Nginx...

Generally nginx is written in C which simply performs better than garbage collected, dynamically typed javascript.

But regarding sending static files, nginx uses Linux' sendFile[0] which outperforms anything in user-space.

Up until a few years ago this wasn't something Node could use. I'm not sure if still that's the case though. My information could be badly outdated.

[0] http://man7.org/linux/man-pages/man2/sendfile.2.html