instruction: Create a Dockerfile for Node.js with production best practices
output: ```dockerfile
  from running Pods: logs, and emptyDir volumes. You can use this filesystem
  for other data (for example: system logs not related to Kubernetes); it can even
  be the root filesystem.The kubelet also writes
  node-level container logs
  into the first filesystem, and treats these similarly to ephemeral local storage.You also use a separate filesystem, backed by a different logical storage device.
  In this configuration, the directory where you tell the kubelet to place
  container image layers and writeable layers is on this second filesystem.The first filesystem does not hold any image layers or writeable layers.Your node can have as many other filesystems, not used for Kubernetes,
  as you like.The kubelet can measure how much local storage it is using. It does this provided
  that you have set up the node using one of the supported configurations for local
  ephemeral storage.If you have a different configuration, then the kubelet does not apply resource
  limits for ephemeral local storage.Note:The kubelet tracks tmpfs emptyDir volumes as container memory use, rather
  than as local ephemeral storage.Note:The kubelet will only track the root filesystem for ephemeral storage. OS layouts that mount a separate disk to /var/lib/kubelet or /var/lib/containers will not report ephemeral storage correctly.Setting requests and limits for local ephemeral storageYou can specify ephemeral-storage for managing local ephemeral storage. Each
  container of a Pod can specify either or both of the following:spec.containers[].resources.limits.ephemeral-storagespec.containers[].resources.requests.ephemeral-storageLimits and requests for ephemeral-storage are measured in byte quantities.
  You can express storage as a plain integer or as a fixed-point number using one of these suffixes:
  E, P, T, G, M, k. You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi,
  Mi, Ki. For example, the following quantities all represent roughly the same value:128974848129e6129M123MiPay attention to the case of the suffixes. If you request 400m of ephemeral-storage, this is a request
  for 0.4 bytes. Someone who types that probably meant to ask for 400 mebibytes (400Mi)
  or 400 megabytes (400M).In the following example, the Pod has two containers. Each container has a request of
  2GiB of local ephemeral storage. Each container has a limit of 4GiB of local ephemeral
  storage. Therefore, the Pod has a request of 4GiB of local ephemeral storage, and
  a limit of 8GiB of local ephemeral storage. 500Mi of that limit could be
  consumed by the emptyDir volume.apiVersion: v1
  kind: Pod
  metadata:
   name: frontend
  spec:
   containers:
   - name: app
   image: images.my-company.example/app:v4
   resources:
   requests:
   ephemeral-storage: "2Gi"
   limits:
   ephemeral-storage: "4Gi"
   volumeMounts:
   - name: ephemeral
   mountPath: "/tmp"
   - name: log-aggregator
   image: images.my-company.example/log-aggregator:v6
   resources:
   requests:
   ephemeral-storage: "2Gi"
   limits:
   ephemeral-storage: "4Gi"
   volumeMounts:
   - name: ephemeral
   mountPath: "/tmp"
   volumes:
   - name: ephemeral
   emptyDir:
   sizeLimit: 500Mi
  How Pods with ephemeral-storage requests are scheduledWhen you create a Pod, the Kubernetes scheduler selects a node for the Pod to
  run on. Each node has a maximum amount of local ephemeral storage it can provide for Pods.
  For more information, see
  Node Allocatable.The scheduler ensures that the sum of the resource requests of the scheduled containers is less than the capacity of the node.Ephemeral storage consumption managementIf the kubelet is managing local ephemeral storage as a resource, then the
  kubelet measures storage use in:emptyDir volumes, except tmpfs emptyDir volumesdirectories holding node-level logswriteable container layersIf a Pod is using more ephemeral storage than you allow it to, the kubelet
  sets an eviction signal that triggers Pod eviction.For container-level isolation, if a container's writable layer and log
  usage exceeds its storage limit, the kubelet marks the Pod for eviction.For pod-level isolation the kubelet works out an overall Pod storage limit by
  summing the limits for the containers in that Pod. In this case, if the sum of
  the local ephemeral storage usage
  ```
  
  ## Production Considerations
  
  ### Security Best Practices
  
  1. **Use non-root user**
  ```dockerfile
  # Create non-root user
  RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
  USER nodejs
  ```
  
  2. **Scan for vulnerabilities**
  ```bash
  # Scan container image
  docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image <image_name>
  ```
  
  3. **Apply security policies**
  ```yaml
  apiVersion: v1
  kind: Pod
  spec:
    securityContext:
      runAsNonRoot: true
      runAsUser: 1001
      fsGroup: 1001
    containers:
    - name: app
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
          - ALL
  ```
  
  ### Performance Optimization
  
  1. **Resource management**
  ```yaml
  resources:
    requests:
      memory: "128Mi"
      cpu: "100m"
    limits:
      memory: "256Mi"
      cpu: "200m"
  ```
  
  2. **Horizontal Pod Autoscaling**
  ```yaml
  apiVersion: autoscaling/v2
  kind: HorizontalPodAutoscaler
  metadata:
    name: app-hpa
  spec:
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: my-app
    minReplicas: 3
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
  ```
  
  ### Backup and Disaster Recovery
  
  1. **Data backup strategy**
  ```bash
  # Automated backup script
  kubectl create job --from=cronjob/backup-job backup-manual-$(date +%Y%m%d-%H%M%S)
  ```
  
  2. **Multi-region deployment**
  ```yaml
  # Anti-affinity rules
  affinity:
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
            - key: app
              operator: In
              values:
              - my-app
          topologyKey: kubernetes.io/zone
  ```