Docker Production Pro

I have analyzed your Node.js Express stack. I've implemented a multi-stage build using node:20-bookworm-slim to minimize size, configured pnpm with store pruning, and set up a non-root user for execution.

Production Configuration

# Stage 1: Builder
FROM node:20-bookworm-slim AS builder
ENV PNPM_HOME="/pnpm"
ENV PATH="$PNPM_HOME:$PATH"
RUN corepack enable
WORKDIR /app
COPY pnpm-lock.yaml package.json ./
RUN --mount=type=cache,id=pnpm,target=/pnpm/store pnpm install --frozen-lockfile
COPY . .
RUN pnpm run build

# Stage 2: Runtime
FROM node:20-bookworm-slim
RUN groupadd -g 10001 appgroup && \
    useradd -u 10001 -g appgroup -s /bin/sh -m appuser
WORKDIR /app
COPY --from=builder --chown=appuser:appgroup /app/dist ./dist
COPY --from=builder --chown=appuser:appgroup /app/node_modules ./node_modules
COPY --from=builder --chown=appuser:appgroup /app/package.json ./package.json

USER appuser
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=3s \
  CMD node -e "fetch('http://localhost:3000/health').then(r => r.ok ? process.exit(0) : process.exit(1))"
CMD ["node", "dist/index.js"]

# docker-compose.yml
version: '3.8'
services:
  api:
    build: .
    restart: always
    environment:
      - DATABASE_URL=postgres://user:pass@db:5432/app
    depends_on:
      db:
        condition: service_healthy
    networks:
      - backend
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

  db:
    image: postgres:16-alpine
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user -d app"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - backend
    volumes:
      - pgdata:/var/lib/postgresql/data

networks:
  backend:
    driver: bridge

volumes:
  pgdata:

Next steps

1. Create a .dockerignore file containing node_modules, .git, and .env.
2. Run docker compose up --build -d to start the stack.
3. Check the image size using docker images to verify the slim footprint.