diff --git a/template/node-arm64/.dockerignore b/template/node-arm64/.dockerignore
new file mode 100644
index 00000000..e84c3fba
--- /dev/null
+++ b/template/node-arm64/.dockerignore
@@ -0,0 +1 @@
+*/node_modules
diff --git a/template/node-arm64/Dockerfile b/template/node-arm64/Dockerfile
index 2218f54e..a40643ec 100644
--- a/template/node-arm64/Dockerfile
+++ b/template/node-arm64/Dockerfile
@@ -5,30 +5,44 @@ FROM node:12.13.0-alpine as ship
 COPY --from=watchdog /fwatchdog /usr/bin/fwatchdog
 RUN chmod +x /usr/bin/fwatchdog
 
+RUN addgroup -S app && adduser app -S -G app
+
 WORKDIR /root/
 
 # Turn down the verbosity to default level.
 ENV NPM_CONFIG_LOGLEVEL warn
 
+RUN mkdir -p /home/app
+
 # Wrapper/boot-strapper
-COPY package.json       .
-RUN npm i
+WORKDIR /home/app
+COPY package.json ./
 
-# Function
-COPY index.js           .
-RUN mkdir -p ./root/function
+# This ordering means the npm installation is cached for the outer function handler.
+RUN npm i --production
 
-COPY function/*.json    ./function/
-WORKDIR /root/function
-RUN npm i || :
-WORKDIR /root/
-COPY function           function
-WORKDIR /root/function
+# Copy outer function handler
+COPY index.js ./
 
-WORKDIR /root/
+# COPY function node packages and install, adding this as a separate
+# entry allows caching of npm install runtime dependencies
+WORKDIR /home/app/function
+COPY function/*.json ./
+RUN npm i --production || :
 
-ENV cgi_headers="true"
+# Copy in additional function files and folders
+COPY --chown=app:app function/ .
 
+WORKDIR /home/app/
+
+# chmod for tmp is for a buildkit issue (@alexellis)
+RUN chmod +rx -R ./function \
+    && chown app:app -R /home/app \
+    && chmod 777 /tmp
+
+USER app
+
+ENV cgi_headers="true"
 ENV fprocess="node index.js"
 EXPOSE 8080
 
diff --git a/template/node-arm64/template.yml b/template/node-arm64/template.yml
index 97e25c5f..18ac1372 100644
--- a/template/node-arm64/template.yml
+++ b/template/node-arm64/template.yml
@@ -1,2 +1,13 @@
 language: node-arm64
 fprocess: node index.js
+welcome_message: |
+  This template is designed for 64-bit ARM.
+
+  You have created a new function which uses Node.js 12 (LTS) and the OpenFaaS
+  Classic Watchdog.
+
+  npm i --save can be used to add third-party packages like request or cheerio
+  npm documentation: https://docs.npmjs.com/
+
+  For high-throughput services, we recommend you use the node12 template which
+  uses a different version of the OpenFaaS watchdog.