Write a production-ready, secure Dockerfile

See it in action

What this prompt produces with example details filled in:

Assumption: your app compiles TypeScript to `dist/` and serves HTTP on port 3000 with a `GET /health` route. No native/system dependencies are required, so a `slim` base is sufficient and no build toolchain is carried into the runtime stage.

**Dockerfile**

```dockerfile
# syntax=docker/dockerfile:1

# ---------- Build stage ----------
FROM node:20.18.1-bookworm-slim AS build
WORKDIR /app

# Install dependencies first so this layer stays cached until the lockfile changes
COPY package.json package-lock.json ./
RUN --mount=type=cache,target=/root/.npm npm ci

# Compile the app, then drop dev dependencies from node_modules
COPY . .
RUN npm run build \
 && npm prune --omit=dev

# ---------- Runtime stage ----------
FROM node:20.18.1-bookworm-slim AS runtime
ENV NODE_ENV=production
WORKDIR /app

LABEL org.opencontainers.image.title="my-api" \
      org.opencontainers.image.source="https://github.com/acme/my-api"

# Dedicated unprivileged user
RUN groupadd --system --gid 1001 nodejs \
 && useradd  --system --uid 1001 --gid nodejs appuser

# Copy only runtime artifacts, owned by the app user
COPY --from=build --chown=appuser:nodejs /app/node_modules ./node_modules
COPY --from=build --chown=appuser:nodejs /app/dist         ./dist
COPY --from=build --chown=appuser:nodejs /app/package.json ./package.json

USER appuser
EXPOSE 3000

# Fails the container if /health stops returning 200
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
  CMD node -e "fetch('http://127.0.0.1:3000/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

# Exec form -> node is PID 1 and receives SIGTERM/SIGINT for graceful shutdown
ENTRYPOINT ["node", "dist/server.js"]
```

**.dockerignore**

```gitignore
.git
.gitignore
node_modules
dist
npm-debug.log
.env
.env.*
Dockerfile
.dockerignore
coverage
*.md
```

**Build & run**

```bash
# BuildKit is required for the cache mount and the syntax directive
DOCKER_BUILDKIT=1 docker build -t my-api:1.0.0 .

# Run read-only with an in-memory /tmp, no privilege escalation; --init reaps zombies
docker run --rm -p 3000:3000 \
  --init \
  --read-only --tmpfs /tmp \
  --security-opt no-new-privileges \
  -e NODE_ENV=production \
  my-api:1.0.0
```

**Security & size decisions**
- **Pinned slim base** (`node:20.18.1-bookworm-slim`) — an exact patch tag, not `latest`, so builds are reproducible and you decide when the OS layer moves; slim strips docs and headers that inflate size and attack surface.
- **Multi-stage** — the compiler, dev dependencies, and full source tree stay in the build stage; the runtime image carries only prod `node_modules`, `dist/`, and `package.json`.
- **Non-root by default** — a dedicated `appuser` (uid 1001) owns the app files; paired with `--read-only` and `--security-opt no-new-privileges`, a compromised process cannot write the filesystem or escalate.
- **No secrets in layers** — nothing sensitive lives in `ENV`/`ARG`. A build-time private registry token would be mounted with `RUN --mount=type=secret,id=npm_token ...` so it never lands in image history.
- **Signals & health** — exec-form `ENTRYPOINT` makes Node PID 1 for clean SIGTERM handling, `--init` reaps zombies, and the `HEALTHCHECK` lets the orchestrator restart a wedged container.