Hardening Docker Containers: Multi-Stage Builds & Distroless Images

Production container security requires shrinking image sizes and eliminating unnecessary operating system binaries that attackers exploit during container compromises.

**TL;DR:** Secure Docker containers by adopting multi-stage builds, dropping root execution privileges, and shipping production runtimes on Google Distroless base images.

---

Secure Production Node.js Distroless Dockerfile

# Stage 1: Build & Dependencies
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build

# Stage 2: Distroless Minimal Security Runtime
FROM gcr.io/distroless/nodejs20-debian12:nonroot
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
USER nonroot
EXPOSE 3000
CMD ["dist/index.js"]