Node.js v20.0.0 documentation

Single executable applications#

Source Code: lib/internal/main/single_executable_application.js

This feature allows the distribution of a Node.js application conveniently to a system that does not have Node.js installed.

Node.js supports the creation of single executable applications by allowing the injection of a blob prepared by Node.js, which can contain a bundled script, into the node binary. During start up, the program checks if anything has been injected. If the blob is found, it executes the script in the blob. Otherwise Node.js operates as it normally does.

The single executable application feature currently only supports running a single embedded script using the CommonJS module system.

Users can create a single executable application from their bundled script with the node binary itself and any tool which can inject resources into the binary.

Here are the steps for creating a single executable application using one such tool, postject:

1. Create a JavaScript file:

   $ echo 'console.log(`Hello, ${process.argv[2]}!`);' > hello.js copy

2. Create a configuration file building a blob that can be injected into the single executable application (see Generating single executable preparation blobs for details):

   $ echo '{ "main": "hello.js", "output": "sea-prep.blob" }' > sea-config.json copy

3. Generate the blob to be injected:

   $ node --experimental-sea-config sea-config.json copy

4. Create a copy of the node executable and name it according to your needs:

   $ cp $(command -v node) hello copy

5. Remove the signature of the binary:

   • On macOS:

   $ codesign --remove-signature hello copy

   • On Windows (optional):

   signtool can be used from the installed Windows SDK. If this step is skipped, ignore any signature-related warning from postject.

   $ signtool remove /s hello copy

6. Inject the blob into the copied binary by running postject with the following options:

   • hello - The name of the copy of the node executable created in step 2.
   • NODE_SEA_BLOB - The name of the resource / note / section in the binary where the contents of the blob will be stored.
   • sea-prep.blob - The name of the blob created in step 1.
   • --sentinel-fuse NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2 - The fuse used by the Node.js project to detect if a file has been injected.
   • --macho-segment-name NODE_SEA (only needed on macOS) - The name of the segment in the binary where the contents of the blob will be stored.

   To summarize, here is the required command for each platform:

   • On systems other than macOS:

     $ npx postject hello NODE_SEA_BLOB sea-prep.blob \
         --sentinel-fuse NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2 copy

   • On macOS:

     $ npx postject hello NODE_SEA_BLOB sea-prep.blob \
         --sentinel-fuse NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2 \
         --macho-segment-name NODE_SEA copy

7. Sign the binary:

   • On macOS:

   $ codesign --sign - hello copy

   • On Windows (optional):

   A certificate needs to be present for this to work. However, the unsigned binary would still be runnable.

   $ signtool sign /fd SHA256 hello copy

8. Run the binary:

   $ ./hello world
   Hello, world! copy

{
  "main": "/path/to/bundled/script.js",
  "output": "/path/to/write/the/generated/blob.blob"
} copy

const { createRequire } = require('node:module');
require = createRequire(__filename); copy