# File read write security
**URL:** https://discourse.nodered.org/t/file-read-write-security/96252
**Category:** General
**Tags:** docker
**Created:** [25 March 2025 16:15 UTC](https://discourse.nodered.org/t/file-read-write-security/96252 "2025-03-25T16:15:14Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@ebimohi](https://discourse.nodered.org/u/ebimohi)
#### Post date: [25 March 2025 16:15 UTC](https://discourse.nodered.org/t/file-read-write-security/96252/1 "2025-03-25T16:15:14Z")
Hi,
I use Node-RED in a project where users can create flows and export data from the server to other systems through a specific endpoint (I have created a custom node for this). If I allow the **"Write File"** and **"Read File"** nodes, it seems that someone could potentially gain access to the `/data` folder. This folder contains important files, such as the `settings.js` file, which I do not want users to read.
How can I secure or restrict file read/write operations in a Docker environment so that users can only access a **temporary folder** during runtime without being able to read or write to any other files or directories?
thank you!
---
### Author:  [@hardillb](https://discourse.nodered.org/u/hardillb)
#### Post date: [25 March 2025 17:17 UTC](https://discourse.nodered.org/t/file-read-write-security/96252/2 "2025-03-25T17:17:34Z")
You would need to ship modified versions of the file nodes.
You can do this by excluding the `10-file.js` in your settings.js file and then installing your version like any other node.
---
### Author:  [@ebimohi](https://discourse.nodered.org/u/ebimohi)
#### Post date: [25 March 2025 21:26 UTC](https://discourse.nodered.org/t/file-read-write-security/96252/3 "2025-03-25T21:26:31Z")
Thanks for your answer!
I understand that I can disable the "Write File" and "Read File" nodes as you suggested. However, my goal is not to completely disable them but rather to **restrict their access** so that they can only read from and write to a specific folder (e.g., `/data/tmp`) while preventing access to other directories, such as `/data/settings.js`.
Since I am running Node-RED in a Docker environment, I am looking for a way to enforce this restriction; either through container-level configurations (e.g., volume mounts, permissions) or by modifying the behavior of the file nodes.
---
### Author:  [@Colin](https://discourse.nodered.org/u/Colin)
#### Post date: [25 March 2025 21:26 UTC](https://discourse.nodered.org/t/file-read-write-security/96252/4 "2025-03-25T21:26:38Z")
Also don't forget the Exec node which can do anything that the node red user has permissions to do.
---
### Author:  [@hardillb](https://discourse.nodered.org/u/hardillb)
#### Post date: [25 March 2025 21:47 UTC](https://discourse.nodered.org/t/file-read-write-security/96252/5 "2025-03-25T21:47:57Z")
Yes, I understood your requirement and I'm saying there is no way to do what you want with the standard nodes and still allow saving of flows to `/data` or installing new nodes (which go in `/data/node_modules`).
You can't just bind mount a file to `/data/flows.json` because Node-RED writes temp copies first, then moves them over the top to help prevent corruption if a crash happens mid write.
The only way is to create a copy of the existing file nodes and modify them to only accept path prefixes you want, because out of the box the file nodes don't support a "Allow list" of paths.
Also worth pointing out that if the user can install arbitrary nodes or use the function node to load arbitrary modules, they can do pretty much anything at all.
The other option is to build a custom Node-RED launcher (embedding) that loads the settings.js from somewhere else.
A better question is what is in the `settings.js` file you don't want the users to see? Because if you move to a different storage module and a auth plugin it then you should be able to get the point where there are no useful secrets in the `settings.js` file so it doesn't matter if they see it. This is basically the approach we've taken with FlowFuse.
---
### Author:  [@system](https://discourse.nodered.org/u/system)
#### Post date: [23 June 2025 21:48 UTC](https://discourse.nodered.org/t/file-read-write-security/96252/6 "2025-06-23T21:48:13Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.