Dockerfile and Compose Review: Size, Cache, Security

PRODUCTION DOCKERFILE: OPTIMIZED MULTI-STAGE BUILD

→ STAGE 1: BUILDER (dependencies + compilation)
  FROM node:20-alpine AS builder
  WORKDIR /app
  COPY package*.json ./
  RUN npm ci --only=production \  # Only prod deps (excludes dev tooling)
    && npm cache clean --force
  COPY . .
  RUN npm run build  # Compile TypeScript/assets
  
  Size after stage 1: 450MB (includes build tools, temp files – doesn't matter)
  Trap: Avoid RUN npm install (reinstalls dev deps); use npm ci for locked versions

→ STAGE 2: RUNTIME (final production image)
  FROM node:20-alpine  # Slim base (140MB vs 900MB with ubuntu)
  
  # Security: Create non-root user
  RUN addgroup -g 1001 -S nodejs
  RUN adduser -S nodejs -u 1001
  
  WORKDIR /app
  COPY --from=builder --chown=nodejs:nodejs /app/node_modules ./node_modules
  COPY --from=builder --chown=nodejs:nodejs /app/dist ./dist
  COPY --from=builder --chown=nodejs:nodejs /app/package*.json ./
  
  USER nodejs  # Switch to non-root (prevents container breakout)
  EXPOSE 3000
  CMD ["node", "dist/server.js"]
  
  Final size: ~220MB (node_modules + dist + base image)
  Reduction: 75% smaller than single-stage (900MB → 220MB)

→ LAYER CACHING STRATEGY (speeds up rebuilds)
  Order matters: Copy package.json BEFORE source code
  Logic: package changes infrequently; source changes often
  If source changes: Skip npm ci rebuild (cache hit)
  If package changes: Only rebuild node_modules (cache miss on layer 3)
  Example rebuild time: 45s with cache vs. 4min without

→ SECURITY HARDENING
  ✓ Non-root user (USER nodejs, uid 1001 – prevents root exploits)
  ✓ Alpine base (smaller attack surface, fewer packages)
  ✓ No secrets in Dockerfile (use Docker secrets or env vars at runtime)
  ✓ Scan image: docker scout cves (catches known vulnerabilities in base image)
  ✓ Read-only root: Add --read-only flag in orchestrator (Kubernetes, etc.)
  ✓ Pin base image version: node:20.8-alpine not node:20-alpine (fixed point-in-time)
  Trap: Running as root in production is #1 vulnerability – don't skip USER line

→ RUNTIME OPTIMIZATIONS
  Environment: NODE_ENV=production (skips dev dependencies in app startup)
  Memory: Set JVM/Node heap if needed (--memory=512m in docker run)
  Health check: Add HEALTHCHECK instruction (orchestrator knows container status)

→ DEPLOYMENT CHECKLIST
  ✓ Build locally: docker build -t myapp:latest .
  ✓ Test: docker run -u 1001 myapp:latest (verify non-root works)
  ✓ Scan: docker scout cves myapp:latest (zero critical vulns)
  ✓ Size check: docker images | grep myapp (should be <300MB)
  ✓ Push to registry: docker push myregistry.com/myapp:v1.0.0
  ✓ Verify in prod: k logs pod/myapp (confirm app starts, no permission errors)