afaik security-api has only been built for development environments. Its init.sh script kicks off nodemon, which should only ever be used in development. Please investigate if another init script is needed or what needs to be done to still start up server.js without nodemon. If your investigation turns up additional information about what needs to be done to make the application production start-upable, please also document that (eg. I believe someone mentioned to me once that the docker-compose.yml was also only for development purposes. If so, where does configuration need to live?).