{ "type": "module", "source": "doc/api/single-executable-applications.md", "modules": [ { "textRaw": "Single executable applications", "name": "single_executable_applications", "introduced_in": "v19.7.0", "type": "module", "meta": { "added": [ "v19.7.0", "v18.16.0" ], "changes": [ { "version": "v25.5.0", "pr-url": "https://github.com/nodejs/node/pull/61167", "description": "Added built-in single executable application generation via the CLI flag `--build-sea`." }, { "version": "v20.6.0", "pr-url": "https://github.com/nodejs/node/pull/46824", "description": "Added support for \"useSnapshot\"." }, { "version": "v20.6.0", "pr-url": "https://github.com/nodejs/node/pull/48191", "description": "Added support for \"useCodeCache\"." } ] }, "stability": 1.1, "stabilityText": "Active development", "desc": "

This feature allows the distribution of a Node.js application conveniently to a\nsystem that does not have Node.js installed.

Node.js supports the creation of single executable applications by allowing\nthe injection of a blob prepared by Node.js, which can contain a bundled script,\ninto the node binary. During start up, the program checks if anything has been\ninjected. If the blob is found, it executes the script in the blob. Otherwise\nNode.js operates as it normally does.

The single executable application feature supports running a\nsingle embedded script using the CommonJS or the ECMAScript Modules module system.

Users can create a single executable application from their bundled script\nwith the node binary itself and any tool which can inject resources into the\nbinary.

\n
1. \n

   Create a JavaScript file:

   \n

   echo 'console.log(`Hello, ${process.argv[2]}!`);' > hello.js\n

   \n
\n
2. \n

   Create a configuration file building a blob that can be injected into the\nsingle executable application (see\nGenerating single executable preparation blobs for details):

   \n
   \n
   • On systems other than Windows:
   \n
   \n

   echo '{ \"main\": \"hello.js\", \"output\": \"sea\" }' > sea-config.json\n

   \n
   \n
   • On Windows:
   \n
   \n

   echo '{ \"main\": \"hello.js\", \"output\": \"sea.exe\" }' > sea-config.json\n

   \n

   The .exe extension is necessary.

   \n
\n
3. \n

   Generate the target executable:

   \n

   node --build-sea sea-config.json\n

   \n
\n
4. \n

   Sign the binary (macOS and Windows only):

   \n
   \n
   • On macOS:
   \n
   \n

   codesign --sign - sea\n

   \n
   \n
   • On Windows (optional):
   \n
   \n

   A certificate needs to be present for this to work. However, the unsigned\nbinary would still be runnable.

   \n

   signtool sign /fd SHA256 sea.exe\n

   \n
\n
5. \n

   Run the binary:

   \n
   \n
   • On systems other than Windows
   \n
   \n

   $ ./sea world\nHello, world!\n

   \n
   \n
   • On Windows
   \n
   \n

   $ .\\sea.exe world\nHello, world!\n

   \n
\n

To generate a single executable application directly, the --build-sea flag can be\nused. It takes a path to a configuration file in JSON format. If the path passed to it\nisn't absolute, Node.js will use the path relative to the current working directory.

The configuration currently reads the following top-level fields:

{\n  \"main\": \"/path/to/bundled/script.js\",\n  \"mainFormat\": \"commonjs\", // Default: \"commonjs\", options: \"commonjs\", \"module\"\n  \"executable\": \"/path/to/node/binary\", // Optional, if not specified, uses the current Node.js binary\n  \"output\": \"/path/to/write/the/generated/executable\",\n  \"disableExperimentalSEAWarning\": true, // Default: false\n  \"useSnapshot\": false,  // Default: false\n  \"useCodeCache\": true, // Default: false\n  \"execArgv\": [\"--no-warnings\", \"--max-old-space-size=4096\"], // Optional\n  \"execArgvExtension\": \"env\", // Default: \"env\", options: \"none\", \"env\", \"cli\"\n  \"assets\": {  // Optional\n    \"a.dat\": \"/path/to/a.dat\",\n    \"b.txt\": \"/path/to/b.txt\"\n  }\n}\n

If the paths are not absolute, Node.js will use the path relative to the\ncurrent working directory. The version of the Node.js binary used to produce\nthe blob must be the same as the one to which the blob will be injected.

Note: When generating cross-platform SEAs (e.g., generating a SEA\nfor linux-x64 on darwin-arm64), useCodeCache and useSnapshot\nmust be set to false to avoid generating incompatible executables.\nSince code cache and snapshots can only be loaded on the same platform\nwhere they are compiled, the generated executable might crash on startup when\ntrying to load code cache or snapshots built on a different platform.

Users can include assets by adding a key-path dictionary to the configuration\nas the assets field. At build time, Node.js would read the assets from the\nspecified paths and bundle them into the preparation blob. In the generated\nexecutable, users can retrieve the assets using the sea.getAsset() and\nsea.getAssetAsBlob() APIs.

{\n  \"main\": \"/path/to/bundled/script.js\",\n  \"output\": \"/path/to/write/the/generated/executable\",\n  \"assets\": {\n    \"a.jpg\": \"/path/to/a.jpg\",\n    \"b.txt\": \"/path/to/b.txt\"\n  }\n}\n

The single-executable application can access the assets as follows:

const { getAsset, getAssetAsBlob, getRawAsset, getAssetKeys } = require('node:sea');\n// Get all asset keys.\nconst keys = getAssetKeys();\nconsole.log(keys); // ['a.jpg', 'b.txt']\n// Returns a copy of the data in an ArrayBuffer.\nconst image = getAsset('a.jpg');\n// Returns a string decoded from the asset as UTF8.\nconst text = getAsset('b.txt', 'utf8');\n// Returns a Blob containing the asset.\nconst blob = getAssetAsBlob('a.jpg');\n// Returns an ArrayBuffer containing the raw asset without copying.\nconst raw = getRawAsset('a.jpg');\n

See documentation of the sea.getAsset(), sea.getAssetAsBlob(),\nsea.getRawAsset() and sea.getAssetKeys() APIs for more information.

The useSnapshot field can be used to enable startup snapshot support. In this\ncase, the main script would not be executed when the final executable is launched.\nInstead, it would be run when the single executable application preparation\nblob is generated on the building machine. The generated preparation blob would\nthen include a snapshot capturing the states initialized by the main script.\nThe final executable, with the preparation blob injected, would deserialize\nthe snapshot at run time.

When useSnapshot is true, the main script must invoke the\nv8.startupSnapshot.setDeserializeMainFunction() API to configure code\nthat needs to be run when the final executable is launched by the users.

The typical pattern for an application to use snapshot in a single executable\napplication is:

\n
1. At build time, on the building machine, the main script is run to\ninitialize the heap to a state that's ready to take user input. The script\nshould also configure a main function with\nv8.startupSnapshot.setDeserializeMainFunction(). This function will be\ncompiled and serialized into the snapshot, but not invoked at build time.
\n
2. At run time, the main function will be run on top of the deserialized heap\non the user machine to process user input and generate output.
\n

The general constraints of the startup snapshot scripts also apply to the main\nscript when it's used to build snapshot for the single executable application,\nand the main script can use the v8.startupSnapshot API to adapt to\nthese constraints. See\ndocumentation about startup snapshot support in Node.js.

When useCodeCache is set to true in the configuration, during the generation\nof the single executable preparation blob, Node.js will compile the main\nscript to generate the V8 code cache. The generated code cache would be part of\nthe preparation blob and get injected into the final executable. When the single\nexecutable application is launched, instead of compiling the main script from\nscratch, Node.js would use the code cache to speed up the compilation, then\nexecute the script, which would improve the startup performance.

Note: import() does not work when useCodeCache is true.

The execArgv field can be used to specify Node.js-specific\narguments that will be automatically applied when the single\nexecutable application starts. This allows application developers\nto configure Node.js runtime options without requiring end users\nto be aware of these flags.

For example, the following configuration:

{\n  \"main\": \"/path/to/bundled/script.js\",\n  \"output\": \"/path/to/write/the/generated/executable\",\n  \"execArgv\": [\"--no-warnings\", \"--max-old-space-size=2048\"]\n}\n

will instruct the SEA to be launched with the --no-warnings and\n--max-old-space-size=2048 flags. In the scripts embedded in the executable, these flags\ncan be accessed using the process.execArgv property:

// If the executable is launched with `sea user-arg1 user-arg2`\nconsole.log(process.execArgv);\n// Prints: ['--no-warnings', '--max-old-space-size=2048']\nconsole.log(process.argv);\n// Prints ['/path/to/sea', 'path/to/sea', 'user-arg1', 'user-arg2']\n

The user-provided arguments are in the process.argv array starting from index 2,\nsimilar to what would happen if the application is started with:

node --no-warnings --max-old-space-size=2048 /path/to/bundled/script.js user-arg1 user-arg2\n

The execArgvExtension field controls how additional execution arguments can be\nprovided beyond those specified in the execArgv field. It accepts one of three string values:

\n
• \"none\": No extension is allowed. Only the arguments specified in execArgv will be used,\nand the NODE_OPTIONS environment variable will be ignored.
\n
• \"env\": (Default) The NODE_OPTIONS environment variable can extend the execution arguments.\nThis is the default behavior to maintain backward compatibility.
\n
• \"cli\": The executable can be launched with --node-options=\"--flag1 --flag2\", and those flags\nwill be parsed as execution arguments for Node.js instead of being passed to the user script.\nThis allows using arguments that are not supported by the NODE_OPTIONS environment variable.
\n

For example, with \"execArgvExtension\": \"cli\":

{\n  \"main\": \"/path/to/bundled/script.js\",\n  \"output\": \"/path/to/write/the/generated/executable\",\n  \"execArgv\": [\"--no-warnings\"],\n  \"execArgvExtension\": \"cli\"\n}\n

The executable can be launched as:

./my-sea --node-options=\"--trace-exit\" user-arg1 user-arg2\n

This would be equivalent to running:

node --no-warnings --trace-exit /path/to/bundled/script.js user-arg1 user-arg2\n

The node:sea builtin allows interaction with the single-executable application\nfrom the JavaScript main script embedded into the executable.

This method can be used to retrieve the assets configured to be bundled into the\nsingle-executable application at build time.\nAn error is thrown when no matching asset can be found.

Similar to sea.getAsset(), but returns the result in a Blob.\nAn error is thrown when no matching asset can be found.

This method can be used to retrieve the assets configured to be bundled into the\nsingle-executable application at build time.\nAn error is thrown when no matching asset can be found.

Unlike sea.getAsset() or sea.getAssetAsBlob(), this method does not\nreturn a copy. Instead, it returns the raw asset bundled inside the executable.

For now, users should avoid writing to the returned array buffer. If the\ninjected section is not marked as writable or not aligned properly,\nwrites to the returned array buffer is likely to result in a crash.

This method can be used to retrieve an array of all the keys of assets\nembedded into the single-executable application.\nAn error is thrown when not running inside a single-executable application.

To specify how Node.js should interpret the injected main script, use the\nmainFormat field in the single-executable application configuration.\nThe accepted values are:

\n
• \"commonjs\": The injected main script is treated as a CommonJS module.
\n
• \"module\": The injected main script is treated as an ECMAScript module.
\n

If the mainFormat field is not specified, it defaults to \"commonjs\".

Currently, \"mainFormat\": \"module\" cannot be used together with \"useSnapshot\".

In the injected main script, module loading does not read from the file system.\nBy default, both require() and import statements would only be able to load\nthe built-in modules. Attempting to load a module that can only be found in the\nfile system will throw an error.

Users can bundle their application into a standalone JavaScript file to inject\ninto the executable. This also ensures a more deterministic dependency graph.

To load modules from the file system in the injected main script, users can\ncreate a require function that can load from the file system using\nmodule.createRequire(). For example, in a CommonJS entry point:

const { createRequire } = require('node:module');\nrequire = createRequire(__filename);\n

require() in the injected main script is not the same as the require()\navailable to modules that are not injected.\nCurrently, it does not have any of the properties that non-injected\nrequire() has except require.main.

The values of __filename and module.filename in the injected main script\nare equal to process.execPath.

The value of __dirname in the injected main script is equal to the directory\nname of process.execPath.

When using \"mainFormat\": \"module\", import.meta is available in the\ninjected main script with the following properties:

\n
• import.meta.url: A file: URL corresponding to process.execPath.
\n
• import.meta.filename: Equal to process.execPath.
\n
• import.meta.dirname: The directory name of process.execPath.
\n
• import.meta.main: true.
\n

import.meta.resolve is currently not supported.

When using \"mainFormat\": \"module\", import() can be used to dynamically\nload built-in modules. Attempting to use import() to load modules from\nthe file system will throw an error.

Native addons can be bundled as assets into the single-executable application\nby specifying them in the assets field of the configuration file used to\ngenerate the single-executable application preparation blob.\nThe addon can then be loaded in the injected main script by writing the asset\nto a temporary file and loading it with process.dlopen().

{\n  \"main\": \"/path/to/bundled/script.js\",\n  \"output\": \"/path/to/write/the/generated/executable\",\n  \"assets\": {\n    \"myaddon.node\": \"/path/to/myaddon/build/Release/myaddon.node\"\n  }\n}\n

// script.js\nconst fs = require('node:fs');\nconst os = require('node:os');\nconst path = require('node:path');\nconst { getRawAsset } = require('node:sea');\nconst addonPath = path.join(os.tmpdir(), 'myaddon.node');\nfs.writeFileSync(addonPath, new Uint8Array(getRawAsset('myaddon.node')));\nconst myaddon = { exports: {} };\nprocess.dlopen(myaddon, addonPath);\nconsole.log(myaddon.exports);\nfs.rmSync(addonPath);\n

Known caveat: if the single-executable application is produced by postject running on a Linux arm64 docker container,\nthe produced ELF binary does not have the correct hash table to load the addons and\nwill crash on process.dlopen(). Build the single-executable application on other platforms, or at least on\na non-container Linux arm64 environment to work around this issue.

The process documented here is subject to change.

To build a single executable application, Node.js would first generate a blob\nthat contains all the necessary information to run the bundled script.\nWhen using --build-sea, this step is done internally along with the injection.

Before --build-sea was introduced, an older workflow was introduced to write the\npreparation blob to disk for injection by external tools. This can still\nbe used for verification purposes.

To dump the preparation blob to disk for verification, use --experimental-sea-config.\nThis writes a file that can be injected into a Node.js binary using tools like postject.

The configuration is similar to that of --build-sea, except that the\noutput field specifies the path to write the generated blob file instead of\nthe final executable.

{\n  \"main\": \"/path/to/bundled/script.js\",\n  // Instead of the final executable, this is the path to write the blob.\n  \"output\": \"/path/to/write/the/generated/blob.blob\"\n}\n

To complete the creation of a single executable application, the generated blob\nneeds to be injected into a copy of the node binary, as documented below.

When using --build-sea, this step is done internally along with the blob generation.

\n
• If the node binary is a PE file, the blob should be injected as a resource\nnamed NODE_SEA_BLOB.
\n
• If the node binary is a Mach-O file, the blob should be injected as a section\nnamed NODE_SEA_BLOB in the NODE_SEA segment.
\n
• If the node binary is an ELF file, the blob should be injected as a note\nnamed NODE_SEA_BLOB.
\n

Then, the SEA building process searches the binary for the\nNODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2:0 fuse string and flip the\nlast character to 1 to indicate that a resource has been injected.

Before --build-sea was introduced, an older workflow was introduced to allow\nexternal tools to inject the generated blob into a copy of the node binary.

For example, with postject:

\n
1. \n

   Create a copy of the node executable and name it according to your needs:

   \n
   \n
   • On systems other than Windows:
   \n
   \n

   cp $(command -v node) hello\n

   \n
   \n
   • On Windows:
   \n
   \n

   node -e \"require('fs').copyFileSync(process.execPath, 'hello.exe')\"\n

   \n

   The .exe extension is necessary.

   \n
\n
2. \n

   Remove the signature of the binary (macOS and Windows only):

   \n
   \n
   • On macOS:
   \n
   \n

   codesign --remove-signature hello\n

   \n
   \n
   • On Windows (optional):
   \n
   \n

   signtool can be used from the installed Windows SDK. If this step is\nskipped, ignore any signature-related warning from postject.

   \n

   signtool remove /s hello.exe\n

   \n
\n
3. \n

   Inject the blob into the copied binary by running postject with\nthe following options:

   \n
   \n
   • hello / hello.exe - The name of the copy of the node executable\ncreated in step 4.
   \n
   • NODE_SEA_BLOB - The name of the resource / note / section in the binary\nwhere the contents of the blob will be stored.
   \n
   • sea-prep.blob - The name of the blob created in step 1.
   \n
   • --sentinel-fuse NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2 - The\nfuse used by the Node.js project to detect if a file has been injected.
   \n
   • --macho-segment-name NODE_SEA (only needed on macOS) - The name of the\nsegment in the binary where the contents of the blob will be\nstored.
   \n
   \n

   To summarize, here is the required command for each platform:

   \n
   \n
   • \n

     On Linux:

     \n

     npx postject hello NODE_SEA_BLOB sea-prep.blob \\\n    --sentinel-fuse NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2\n

     \n
   \n
   • \n

     On Windows - PowerShell:

     \n

     npx postject hello.exe NODE_SEA_BLOB sea-prep.blob `\n    --sentinel-fuse NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2\n

     \n
   \n
   • \n

     On Windows - Command Prompt:

     \n

     npx postject hello.exe NODE_SEA_BLOB sea-prep.blob ^\n    --sentinel-fuse NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2\n

     \n
   \n
   • \n

     On macOS:

     \n

     npx postject hello NODE_SEA_BLOB sea-prep.blob \\\n    --sentinel-fuse NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2 \\\n    --macho-segment-name NODE_SEA\n

     \n
   \n
   \n
\n

Single-executable support is tested regularly on CI only on the following\nplatforms:

\n
• Windows
\n
• macOS (arm64 only; x64 is not currently supported and is skipped in the\ntests)
\n
• Linux (all distributions supported by Node.js except Alpine and all\narchitectures supported by Node.js except s390x)
\n

This is due to a lack of better tools to generate single-executables that can be\nused to test this feature on other platforms.

Suggestions for other resource injection tools/workflows are welcomed. Please\nstart a discussion at https://github.com/nodejs/single-executable/discussions\nto help us document them.