instruction: Create a Dockerfile for Node.js with production best practices
output: ```dockerfile
  from this speedup, all these conditions must be met:The feature gate
  SELinuxMountReadWriteOncePod must be enabled.Pod must use PersistentVolumeClaim with applicable accessModes and feature gates:Either the volume has accessModes: ["ReadWriteOncePod"], and feature gate SELinuxMountReadWriteOncePod is enabled.Or the volume can use any other access modes and all feature gates
  SELinuxMountReadWriteOncePod, SELinuxChangePolicy and SELinuxMount must be enabled
  and the Pod has spec.securityContext.seLinuxChangePolicy either nil (default) or MountOption.Pod (or all its Containers that use the PersistentVolumeClaim) must
  have seLinuxOptions set.The corresponding PersistentVolume must be either:A volume that uses the legacy in-tree iscsi, rbd or fc volume type.Or a volume that uses a CSI driver.
  The CSI driver must announce that it supports mounting with -o context by setting
  spec.seLinuxMount: true in its CSIDriver instance.When any of these conditions is not met, SELinux relabelling happens another way: the container
  runtime recursively changes the SELinux label for all inodes (files and directories)
  in the volume. Calling out explicitly, this applies to Kubernetes ephemeral volumes like
  secret, configMap and projected, and all volumes whose CSIDriver instance does not
  explicitly announce mounting with -o context.When this speedup is used, all Pods that use the same applicable volume concurrently on the same node
  must have the same SELinux label. A Pod with a different SELinux label will fail to start and will be
  ContainerCreating until all Pods with other SELinux labels that use the volume are deleted.FEATURE STATE:
  Kubernetes v1.33 [beta] (enabled by default: true)For Pods that want to opt-out
  ```