No mention of using a non-root user? Any reason why or just oversight?

With Debian based images like node:carbon you could do something like this:

  ENV HOME /home/nodejs
  RUN groupadd -r nodejs \
  && useradd -r -g nodejs nodejs \
  && mkdir -p $HOME \
  && chown nodejs:nodejs $HOME
  USER nodejs

With alpine something like this:

  RUN addgroup -S nodejs && adduser -S -G nodejs nodejs
  USER nodejs