# Hosting Node-RED and running "untrusted" flows

**URL:** https://discourse.nodered.org/t/hosting-node-red-and-running-untrusted-flows/10961
**Category:** General
**Created:** [9 May 2019 14:31 UTC](https://discourse.nodered.org/t/hosting-node-red-and-running-untrusted-flows/10961 "2019-05-09T14:31:44Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![BenediktMiller](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/benediktmiller/32/11461_2.png) [@BenediktMiller](https://discourse.nodered.org/u/BenediktMiller)
#### Post date: [9 May 2019 14:31 UTC](https://discourse.nodered.org/t/hosting-node-red-and-running-untrusted-flows/10961/1 "2019-05-09T14:31:44Z")

</div>

Hey,

I am currently wondering if it is possible for me to host Node-Red for Users and let them create their own flows that run on my server/in my docker container. This setup would create one docker container per user.

Is it possible to protect against all kinds of attacks that a User could write in a Node-Red function?  
Are there other attack vectors that I should be aware of?