Demo: review a Node Dockerfile for common production risks
A Dockerfile may work locally while still being fragile in production. Visualizing the instruction chain helps reviewers see whether the runtime image is pinned, minimal, and running as a non-root user.
- Prefer node:20-bookworm-slim over node:latest for repeatable builds.
- Use multi-stage builds so dev dependencies stay out of the runtime image.
- Add a non-root USER when the application does not need root privileges.
FROM node:20-bookworm-slim AS deps
WORKDIR /app
COPY package*.json ./
RUN npm ci
FROM node:20-bookworm-slim
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
USER node
CMD ["npm", "start"]The visualizer should show the dependency stage, runtime stage, copied artifacts, and non-root runtime decision.