instruction: Create a Dockerfile for Nginx, Alpine Linux with production best practices
output: ```dockerfile
  from the alpine image with the
  sha256:9cacb71397b640eca97488cf08582ae4e4068513101088e9f96c9814bfda95e0 digest:
  
  $ docker run alpine@sha256:9cacb71397b640eca97488cf08582ae4e4068513101088e9f96c9814bfda95e0 date
  Options[OPTIONS] let you configure options for the container. For example, you can
  give the container a name (--name), or run it as a background process (-d).
  You can also set options to control things like resource constraints and
  networking.Commands and argumentsYou can use the [COMMAND] and [ARG...] positional arguments to specify
  commands and arguments for the container to run when it starts up. For example,
  you can specify sh as the [COMMAND], combined with the -i and -t flags,
  to start an interactive shell in the container (if the image you select has an
  sh executable on PATH).
  
  $ docker run -it IMAGE sh
  
  NoteDepending on your Docker system configuration, you may be
  required to preface the docker run command with sudo. To avoid
  having to use sudo with the docker command, your system
  administrator can create a Unix group called docker and add users to
  it. For more information about this configuration, refer to the Docker
  installation documentation for your operating system.Foreground and backgroundWhen you start a container, the container runs in the foreground by default.
  If you want to run the container in the background instead, you can use the
  --detach (or -d) flag. This starts the container without occupying your
  terminal window.
  
  $ docker run -d <IMAGE>
  While the container runs in the background, you can interact with the container
  using other CLI commands. For example, docker logs lets you view the logs for
  the container, and docker attach brings it to the foreground.
  
  $ docker run -d nginx
  0246aa4d1448a401cabd2ce8f242192b6e7af721527e48a810463366c7ff54f1
  $ docker ps
  CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
  0246aa4d1448 nginx "/docker-entrypoint.â¦" 2 seconds ago Up 1 second 80/tcp pedantic_liskov
  $ docker logs -n 5 0246aa4d1448
  2023/11/06 15:58:23 [notice] 1#1: start worker process 33
  2023/11/06 15:58:23 [notice] 1#1: start worker process 34
  2023/11/06 15:58:23 [notice] 1#1: start worker process 35
  2023/11/06 15:58:23 [notice] 1#1: start worker process 36
  2023/11/06 15:58:23 [notice] 1#1: start worker process 37
  $ docker attach 0246aa4d1448
  ^C
  2023/11/06 15:58:40 [notice] 1#1: signal 2 (SIGINT) received, exiting
  ...
  For more information about docker run flags related to foreground and
  background modes, see:docker run --detach: run container in backgrounddocker run --attach: attach to stdin, stdout, and stderrdocker run --tty: allocate a pseudo-ttydocker run --interactive: keep stdin open even if not attachedFor more information about re-attaching to a background container, see
  docker attach.Container identificationYou can identify a container in three ways:Identifier typeExample valueUUID long identifierf78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778UUID short identifierf78375b1c487Nameevil_ptolemyThe UUID identifier is a random ID assigned to the container by the daemon.The daemon generates a random string name for containers automatically. You can
  also define a custom name using the --name flag.
  Defining a name can be a handy way to add meaning to a container. If you
  specify a name, you can use it when referring to the container in a
  user-defined network. This works for both background and foreground Docker
  containers.A container identifier is not the same thing as an image reference. The image
  reference specifies which image to use when you run a container. You can't run
  docker exec nginx:alpine sh to open a shell in a container based on the
  nginx:alpine image, because docker exec expects a container identifier
  (name or ID), not an image.While the image used by a container is not an identifier for the container, you
  find out the IDs of containers using an image by using the --filter flag. For
  example, the following docker ps command gets the IDs of all running
  containers based on the nginx:alpine image:
  
  $ docker ps -q --filter ancestor=nginx:alpine
  For more information about using filters, see
  Filtering.Container networkingContainers have networking enabled by default, and they can make outgoing
  connections. If you're running multiple containers that need to communicate
  with each other, you can create a custom network and attach the containers to
  the network.When multiple containers are attached to the same custom network, they can
  communicate with each other using the container names as a DNS hostname. The
  following example creates a custom network named my-net, and runs two
  containers that attach to the network.
  
  $ docker network create my-net
  $ docker run -d --name web --network my-net nginx:alpine
  $ docker run --rm -it --network my-net busybox
  / # ping web
  PING web (172.18.0.2): 56 data bytes
  64 bytes
  ```
  
  ## Production Considerations
  
  ### Security Best Practices
  
  1. **Use non-root user**
  ```dockerfile
  # Create non-root user
  RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
  USER nodejs
  ```
  
  2. **Scan for vulnerabilities**
  ```bash
  # Scan container image
  docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image <image_name>
  ```
  
  3. **Apply security policies**
  ```yaml
  apiVersion: v1
  kind: Pod
  spec:
    securityContext:
      runAsNonRoot: true
      runAsUser: 1001
      fsGroup: 1001
    containers:
    - name: app
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
          - ALL
  ```
  
  ### Performance Optimization
  
  1. **Resource management**
  ```yaml
  resources:
    requests:
      memory: "128Mi"
      cpu: "100m"
    limits:
      memory: "256Mi"
      cpu: "200m"
  ```
  
  2. **Horizontal Pod Autoscaling**
  ```yaml
  apiVersion: autoscaling/v2
  kind: HorizontalPodAutoscaler
  metadata:
    name: app-hpa
  spec:
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: my-app
    minReplicas: 3
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
  ```
  
  ### Backup and Disaster Recovery
  
  1. **Data backup strategy**
  ```bash
  # Automated backup script
  kubectl create job --from=cronjob/backup-job backup-manual-$(date +%Y%m%d-%H%M%S)
  ```
  
  2. **Multi-region deployment**
  ```yaml
  # Anti-affinity rules
  affinity:
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
            - key: app
              operator: In
              values:
              - my-app
          topologyKey: kubernetes.io/zone
  ```