Purpose: Provide a staged mastery plan for learning Node.js as a runtime, V8 host, libuv application, package ecosystem, and production backend platform.

00 Node.js Runtime Mastery Roadmap

The fastest route to deep Node.js mastery is not memorizing APIs. It is building a layered model, then testing that model with small programs, profilers, production-like limits, and failure drills. This roadmap sequences the compendium from fundamentals to operational judgment.

Phase 1: Runtime Mental Model

Read:

Practice:

node -p "process.versions"
node --v8-options | head -40
node -e "console.log(process.argv, process.cwd(), process.env.NODE_ENV)"
node

Core questions:

Question	Good answer shape
Is Node.js single threaded?	JavaScript execution in an isolate is single threaded, while the runtime uses libuv, kernel pollers, worker threads, a threadpool, and native libraries.
What is nonblocking IO?	The JS thread asks the runtime to start work, returns to the event loop, and later receives completion callbacks or promise reactions.
What blocks Node.js?	Long JavaScript CPU work, synchronous APIs, saturated libuv threadpool work, slow native bindings, process startup, GC pauses, and backpressure ignored by code.
What is a file descriptor?	A per-process integer handle to kernel resources such as files, sockets, pipes, eventfds, and terminals.

Phase 2: JavaScript and V8 Execution

Read:

Experiments:

node --trace-gc alloc.js
node --trace-opt --trace-deopt hot-path.js
node --cpu-prof server.js
node --heap-prof leak.js

Interpretation discipline:

Signal	Meaning	Trap
Optimization log	V8 optimized or deoptimized a function under current assumptions	Treating one microbenchmark as a production truth
GC log	Heap pressure, allocation rate, pause pattern, promotion behavior	Assuming every pause is a leak
CPU profile	Time sampled on CPU	Missing blocked IO, queue wait, or off-CPU latency
Heap snapshot	Retaining paths among live objects	Snapshot collection itself affects the process

Phase 3: Modules, Packages, and Build Boundaries

Read:

Commands:

npm ci
npm explain lodash
npm query ':attr(scripts, [postinstall])'
npm audit --omit=dev
node --conditions=development app.mjs

Design rule: package format is an API contract. The type, main, exports, imports, generated declaration files, source maps, and TypeScript moduleResolution setting decide what consumers can load and what failures they see at runtime.

Phase 4: IO, Streams, Processes, and Networking

Read:

Production exercises:

ulimit -n
lsof -p "$PID" | wc -l
ss -tanp | grep node | head
curl -v --http1.1 https://example.com/
NODE_DEBUG=http,net,tls,dns node client.js

Failure questions:

Incident	Think about
`EMFILE`	File descriptor leak, too much concurrency, missing `close`, process limits
`EADDRINUSE`	Port still bound, duplicate process, crashed supervisor loop, container port conflict
`ECONNRESET`	Peer closed, proxy reset, timeout, keep-alive reuse, server aborted stream
`ENOTFOUND`	DNS resolution path, search domains, resolver config, CoreDNS, network policy
Slow uploads	missing backpressure, body buffering, proxy limits, stream error handling

Phase 5: Native, WASM, and Runtime Boundaries

Read:

Boundary rule: crossing from JavaScript to native code trades implementation power for memory ownership, ABI, build, portability, observability, and crash risk. N-API reduces ABI churn. It does not make unsafe C++ safe, make Rust lifetimes visible to JavaScript, or remove the need for backpressure and cancellation.

Phase 6: Observability and Performance

Read:

Baseline instrumentation:

import { monitorEventLoopDelay, performance } from 'node:perf_hooks';

const h = monitorEventLoopDelay({ resolution: 20 });
h.enable();

setInterval(() => {
  const elu = performance.eventLoopUtilization();
  console.log({
    event_loop_utilization: elu.utilization,
    event_loop_delay_p99_ms: h.percentile(99) / 1e6,
    memory: process.memoryUsage(),
    resource: process.resourceUsage()
  });
  h.reset();
}, 10_000).unref();

Measurement checklist:

Define the workload and success metric before tuning.
Warm up enough to include JIT behavior.
Record p50, p95, p99, error rate, RSS, GC, event loop delay, socket counts, and CPU throttling.
Compare against a baseline commit or image.
Keep one change per benchmark run.
Do not ship a micro-optimization that worsens readability without production evidence.

Phase 7: Security and Operations

Read:

Minimum production checklist:

Active LTS or Maintenance LTS Node line unless a deliberate Current feature is required.
Reproducible installs with committed lockfiles and pinned package manager behavior.
Non-root runtime user in containers.
Readiness endpoint that checks dependencies carefully and cheaply.
Graceful shutdown on SIGTERM with bounded drain.
Timeouts on inbound requests, outbound requests, DNS, database calls, and queues.
Structured logs with request IDs and no secrets.
Event loop delay, RSS, heap, external memory, error rate, latency, and saturation alerts.
Incident commands documented before the incident.

Capstone Projects

Project	Notes to use	What it proves
HTTP streaming proxy	09 Streams Buffers Backpressure and Binary Data, 11 Networking HTTP TLS DNS Sockets Undici and Fetch	Backpressure, aborts, timeouts, socket reuse
Memory leak lab	04 V8 Memory Heap Garbage Collection Shapes and Performance, 14 Observability Diagnostics Inspector Tracing Profiling and Core Dumps	Heap snapshots, retaining paths, external memory
Native hash addon	13 Native Addons N-API WASM FFI and Embedding, 16 Security Permissions Crypto Secrets Sandboxing and Dependency Risk	N-API, build portability, memory ownership
Production service skeleton	17 Production Operations Deployment Containers Scaling and Runbooks, 18 Node.js Ecosystem Frameworks Tooling and Learning Projects	Health checks, graceful shutdown, telemetry, Docker
Package dual-format lab	06 Modules CommonJS ESM Resolution Package Exports and TypeScript Interop, 07 npm pnpm yarn Packages Lockfiles Supply Chain and Monorepos	ESM, CJS, exports, TypeScript declarations, lockfile control

Review Cadence

Weekly:

Re-read one runtime note and reproduce one experiment.
Inspect one real service flamegraph or profile.
Review one package diff for supply chain and module boundary risk.
Run one incident drill against a local service with production-like limits.

Quarterly:

Re-check Node release lines, production runtime version, and container base image support.
Re-run dependency audit with human triage.
Re-baseline event loop delay and memory usage under representative load.
Revisit runbooks after actual incidents and near misses.