instruction: Create a Dockerfile for Node.js with production best practices
output: ```dockerfile
  from Linux-based
  workloads. Specifically, many of the Pod securityContext fields
  have no effect on Windows.
  
  Note: Kubelets prior to v1.24 don't enforce the pod OS field, and if a cluster has nodes on versions earlier than v1.24 the restricted policies should be pinned to a version prior to v1.25.
  
  Restricted Pod Security Standard changes
  Another important change, made in Kubernetes v1.25 is that the restricted Pod security
  has been updated to use the pod.spec.os.name field. Based on the OS name, certain policies that are specific
  to a particular OS can be relaxed for the other OS.
  OS-specific policy controls
  Restrictions on the following controls are only required if .spec.os.name is not windows:
  
  Privilege Escalation
  Seccomp
  Linux Capabilities
  
  User namespaces
  User Namespaces are a Linux-only feature to run workloads with increased
  isolation. How they work together with Pod Security Standards is described in
  the documentation for Pods that use user namespaces.
  FAQ
  Why isn't there a profile between privileged and baseline?
  The three profiles defined here have a clear linear progression
  ```