Best practices & security

This is the checklist that separates "it runs on my machine" from "it runs safely in production."

• Use small, specific base images (-slim, -alpine, or distroless) — smaller image, smaller attack surface.
• Pin versions (node:20.11-slim, not node:latest) — reproducible builds, no surprises.
• Order Dockerfile instructions least → most frequently changing, to maximize layer cache hits.
• Add a .dockerignore so .git, node_modules, and secrets never enter the build context.
• Don't run as root inside the container — add USER app in the Dockerfile.
• Never bake secrets into an image layer; pass them at runtime as env vars or mounted secrets, and use BuildKit's --secret for build-time ones.
• Use multi-stage builds to keep build tooling out of the final, shipped image.
• Scan images for known CVEs (docker scout, Trivy, Grype) as part of CI.