Multi-Stage Secure Dockerfile for Node.js Production Microservices

This multi-stage Dockerfile optimizes Node.js container builds by separating build-time dependencies from the runtime execution environment. It utilizes minimal Alpine images, leverages build caching for npm dependencies, strips non-production packages, and sets explicit permission boundaries for execution.

Utilize this container setup when building Docker or Kubernetes images for Node.js microservices. It is suited for CI/CD pipelines aiming to minimize image vulnerability surface area, reduce container storage registry bandwidth, and accelerate deployment rollout speeds across containerized clusters.

Running as a non-root user prevents container breakout vulnerabilities from gaining host root access. Explicitly setting NODE_ENV to production disables development-only middleware and optimizes runtime V8 engine optimizations. A common mistake is omitting dumb-init or tini, which leads to zombie process accumulation because Node.js does not handle PID 1 signal forwarding by default.

> System.Execute()

FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production && npm cache clean --force
COPY . .
RUN npm run build

FROM node:20-alpine AS runner
RUN apk add --no-cache dumb-init
ENV NODE_ENV=production
WORKDIR /app
COPY --chown=node:node --from=builder /app/node_modules ./node_modules
COPY --chown=node:node --from=builder /app/dist ./dist
COPY --chown=node:node package*.json ./

USER node
EXPOSE 3000
CMD ["dumb-init", "node", "dist/server.js"]

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-DF28A826D584