instruction: Create a Dockerfile for Node.js with production best practices
output: ```dockerfile
  from there to the desired target of the config within
  the container. The default target is C:\ProgramData\Docker\configs.When creating a service which uses Windows containers, the options to specify
  UID, GID, and mode are not supported for configs. Configs are currently only
  accessible by administrators and users with system access within the
  container.On Windows, create or update a service using --credential-spec with the
  config://<config-name> format. This passes the gMSA credentials file
  directly to nodes before a container starts. No gMSA credentials are written
  to disk on worker nodes. For more information, refer to
  Deploy services to a swarm.How Docker manages configsWhen you add a config to the swarm, Docker sends the config to the swarm manager
  over a mutual TLS connection. The config is stored in the Raft log, which is
  encrypted. The entire Raft log is replicated across the other managers, ensuring
  the same high availability guarantees for configs as for the rest of the swarm
  management data.When you grant a newly-created or running service access to a config, the config
  is mounted as a file in the container. The location of the mount point within
  the container defaults to /<config-name> in Linux containers. In Windows
  containers, configs are all mounted into C:\ProgramData\Docker\configs and
  symbolic links are created to the desired location, which defaults to
  C:\<config-name>.You can set the ownership (uid and gid) for the config, using either the
  numerical ID or the name of the user or group. You can also specify the file
  permissions (mode). These settings are ignored for Windows containers.If not set, the config is owned by the user running the container
  command (often root) and that user's default group (also often root).If not set, the config has world-readable permissions (mode 0444), unless a
  umask is set within the container, in which case the mode is impacted by
  that umask value.You can update a service to grant it access to additional configs or revoke its
  access to a given config at any time.A node only has access to configs if the node is a swarm manager or if it is
  running service tasks which have been granted access to the config. When a
  container task stops running, the configs shared to it are unmounted
  ```