instruction: Create a Dockerfile for Node.js with production best practices
output: ```dockerfile
  from relabeling using mount options, they can set
  spec.securityContext.seLinuxChangePolicy to Recursive. This is required
  when multiple pods share a single volume on the same node, but they run with
  different SELinux labels that allows simultaneous access to the volume. For example, a privileged pod
  running with label spc_t and an unprivileged pod running with the default label container_file_t.
  With unset spec.securityContext.seLinuxChangePolicy (or with the default value MountOption),
  only one of such pods is able to run on a node, the other one gets ContainerCreating with error
  conflicting SELinux labels of volume <name of the volume>: <label of the running pod> and <label of the pod that can't start>.SELinuxWarningControllerTo make it easier to identify Pods that are affected by the change in SELinux volume relabeling,
  a new controller called SELinuxWarningController has been introduced in kube-controller-manager.
  It is disabled by default and can be enabled by either setting the --controllers=*,selinux-warning-controller
  command line flag,
  or by setting genericControllerManagerConfiguration.controllers
  field in KubeControllerManagerConfiguration.
  This controller requires SELinuxChangePolicy feature gate to be enabled.When enabled, the controller observes running Pods and when it detects that two Pods use the same volume
  with different SELinux labels:It emits an event to both of the Pods. kubectl describe pod <pod-name> the shows
  SELinuxLabel "<label on the pod>" conflicts with pod <the other pod name> that uses the same volume as this pod with SELinuxLabel "<the other pod label>". If both pods land on the same node, only one of them may access the volume.Raise selinux_warning_controller_selinux_volume_conflict metric. The metric has both pod
  names + namespaces as labels to identify the affected pods easily.A cluster admin can use this information to identify pods affected by the planning change and
  proactively opt-out Pods
  ```