You could also just run the node.js process via a `systemd` service and sandbox it that way using hardening directives.