instruction: Create a Dockerfile for Nginx with production best practices
output: ```dockerfile
  from daemon: oci runtime error: container_linux.go:262:
  starting container process caused "exec: \"nginx\": executable file not found in $PATH".
  The container is created but does not start. Remove it:
  
  $ docker container rm broken-container
  Use a read-only bind mountFor some development applications, the container needs to
  write into the bind mount, so changes are propagated back to the
  Docker host. At other times, the container only needs read access.This example modifies the previous one, but mounts the directory as a read-only
  bind mount, by adding ro to the (empty by default) list of options, after the
  mount point within the container. Where multiple options are present, separate
  them by commas.The --mount and -v examples have the same result.
  --mount
  
  -v
  
  $ docker run -d \
   -it \
   --name devtest \
   --mount type=bind,source="$(pwd)"/target,target=/app,readonly \
   nginx:latest
  
  $ docker run -d \
   -it \
   --name devtest \
   -v "$(pwd)"/target:/app:ro \
   nginx:latest
  Use docker inspect devtest to verify that the bind mount was created
  correctly. Look for the Mounts section:
  
  "Mounts": [
   {
   "Type": "bind",
   "Source": "/tmp/source/target",
   "Destination": "/app",
   "Mode": "ro",
   "RW": false,
   "Propagation": "rprivate"
   }
  ],Stop and remove the container:
  
  $ docker container rm -fv devtest
  Recursive mountsWhen you bind mount a path that itself contains mounts, those submounts are
  also included in the bind mount by default. This behavior is configurable,
  using the bind-recursive option for --mount. This option is only supported
  with the --mount flag, not with -v or --volume.If the bind mount is read-only, the Docker Engine makes a best-effort attempt
  at making the submounts read-only as well. This is referred to as recursive
  read-only mounts. Recursive read-only mounts require Linux kernel version 5.12
  or later. If you're running an older kernel version, submounts are
  automatically mounted as read-write by default. Attempting to set submounts to
  be read-only on a kernel version earlier than 5.12, using the
  bind-recursive=readonly option, results in an error.Supported values for the bind-recursive option are:ValueDescriptionenabled (default)Read-only mounts are made recursively read-only if kernel is v5.12 or later. Otherwise, submounts are read-write.disabledSubmounts are ignored (not included in the bind mount).writableSubmounts are read-write.readonlySubmounts are read-only. Requires kernel v5.12 or later.Configure bind propagationBind propagation defaults to rprivate for both bind mounts and volumes. It is
  only configurable for bind mounts, and only on Linux host machines. Bind
  propagation is an advanced topic and many users never need to configure it.Bind propagation refers to whether or not mounts created within a given
  bind-mount can be propagated to replicas of that mount. Consider
  a mount point /mnt, which is also mounted on /tmp. The propagation settings
  control whether a mount on /tmp/a would also be available on /mnt/a. Each
  propagation setting has a recursive counterpoint. In the case of recursion,
  consider that /tmp/a is also mounted as /foo. The propagation settings
  control whether /mnt/a and/or /tmp/a would exist.
  NoteMount propagation doesn't work with Docker Desktop.Propagation settingDescriptionsharedSub-mounts of the original mount are exposed to replica mounts, and sub-mounts of replica mounts are also propagated to the original mount.slavesimilar to a shared mount, but only in one direction. If the original mount exposes a sub-mount, the replica mount can see it. However, if the replica mount exposes a sub-mount, the original mount cannot see it.privateThe mount is private. Sub-mounts within it are not exposed to replica mounts, and sub-mounts of replica mounts are not exposed to the original mount.rsharedThe same as shared, but the propagation also extends to and
  ```