Skip to main content
Sentinel ships as an npm package (@allanoricil/nrg-sentinel) and a pre-built Docker image (allanoricil/nrg-sentinel). Choose the path that matches your deployment.

​
Local / Host install

​
Install the package

Install Sentinel into your Node-RED user directory so that Node-RED auto-discovers it as a plugin:
cd ~/.node-red
npm install @allanoricil/nrg-sentinel
Node-RED scans ~/.node-red/node_modules/ for packages with a node-red.plugins field. Sentinel declares nrg-sentinel: plugin.js, so the sidebar panel and editor features load automatically on the next restart.

​
Activate the preload guard

The plugin covers the Node-RED API surface (node isolation, Express routing, settings mutation, and so on). To also intercept require() calls for dangerous built-in modules, the preload must run before Node-RED’s first require().Set NODE_OPTIONS and start Node-RED:
NODE_OPTIONS="--require @allanoricil/nrg-sentinel/preload" node-red
Do not use ./node_modules/.bin/node-red to start Node-RED. The node-red binary is installed globally — not inside ~/.node-red — so that symlink does not exist in the user directory. Use the node-red command from PATH directly.

​
Make the preload permanent

Add the export to your shell profile so every new terminal session picks it up:
export NODE_OPTIONS="--require @allanoricil/nrg-sentinel/preload"
Reload your profile after editing:
source ~/.bashrc   # or source ~/.zshrc
For systemd units or other init systems, set NODE_OPTIONS in the [Service] environment block or an EnvironmentFile.

​
The bin/node-red.js wrapper

Sentinel ships a wrapper binary (bin/node-red.js) that handles preload injection automatically. You do not need to use it for local installs — the NODE_OPTIONS approach above is the standard path — but understanding what it does explains the Docker entrypoint.The wrapper does two things before starting Node-RED:
  1. Settings signature verification — if NRG_SENTINEL_PUBLIC_KEY is set in the environment, it verifies the Ed25519 signature of settings.js before Node-RED reads it. If the signature is missing or invalid, the process exits before any grants are loaded.
  2. Preload injection — it prepends --require preload.js to NODE_OPTIONS, then spawns the real node-red binary.
To find node-red, the wrapper first searches for a co-installed copy (used in Docker, where both packages share /usr/src/nodered/node_modules/). If none is found, it falls back to the node-red command in PATH (the local install scenario).

​
Build from source

To build the Docker image from the repository instead of pulling from Docker Hub: 
docker build -t nrg-sentinel .
You can pin specific versions of Node.js and Node-RED using build arguments: 
docker build \
  --build-arg NODE_VERSION=22 \
  --build-arg NODERED_VERSION=latest \
  -t nrg-sentinel .
The resulting image has the same filesystem layout and entrypoint as the pre-built image. Use the same docker run commands from the Docker tab above.

​
Next steps

Quickstart

Configure your first capability grant and verify Sentinel is active

Capability reference

Every capability string, what it gates, and common grant patterns

Build docs developers (and LLMs) love

Get started for freeTalk to us