instruction: Create a Dockerfile for Node.js with production best practices
output: ```dockerfile
  from that new Secret and decode the
  data:
  kubectl get secret secret-tiger-docker -o jsonpath='{.data.*}' | base64 -d
  The output is equivalent to the following JSON document (which is also a valid
  Docker configuration file):
  {
   "auths": {
   "my-registry.example:5000": {
   "username": "tiger",
   "password": "pass1234",
   "email": "tiger@acme.example",
   "auth": "dGlnZXI6cGFzczEyMzQ="
   }
   }
  }
  Caution:The auth value there is base64 encoded; it is obscured but not secret.
  Anyone who can read that Secret can learn the registry access bearer token.
  It is suggested to use credential providers to dynamically and securely provide pull secrets on-demand.
  
  Basic authentication Secret
  The kubernetes.io/basic-auth type is provided for storing credentials needed
  for basic authentication. When using this Secret type, the data field of the
  Secret must contain one of the following two keys:
  
  username: the user name for authentication
  password: the password or token for authentication
  
  Both values for the above two keys are base64 encoded strings. You can
  alternatively provide the clear text content using the stringData field in the
  Secret manifest.
  The following manifest is an example of a basic authentication Secret:
  
  secret/basicauth-secret.yaml
  
  apiVersion: v1
  kind: Secret
  metadata:
   name: secret-basic-auth
  type: kubernetes.io/basic-auth
  stringData:
   username: admin # required field for kubernetes.io/basic-auth
   password: t0p-Secret # required field for kubernetes.io/basic-auth
  
  Note:The stringData field for a Secret does not work well with server-side apply.
  The basic authentication Secret type is provided only for convenience.
  You can create an Opaque type for credentials used for basic authentication.
  However, using the defined and public Secret type (kubernetes.io/basic-auth) helps other
  people to understand the purpose of your Secret, and sets a convention for what key names
  to expect.
  SSH authentication Secrets
  The builtin type kubernetes.io/ssh-auth is provided for storing data used in
  SSH authentication. When using this Secret type, you will have to specify a
  ssh-privatekey key-value pair in the data (or stringData) field
  as the SSH credential to use.
  The following manifest is an example of a Secret used for SSH public/private
  key authentication:
  
  secret/ssh-auth-secret.yaml
  
  apiVersion: v1
  kind: Secret
  metadata:
   name: secret-ssh-auth
  type: kubernetes.io/ssh-auth
  data:
   # the data is abbreviated in this example
   ssh-privatekey: |
   UG91cmluZzYlRW1vdGljb24lU2N1YmE=
  
  The SSH authentication Secret type is provided only for convenience.
  You can create an Opaque type for credentials used for SSH authentication.
  However, using the defined and public Secret type (kubernetes.io/ssh-auth) helps other
  people to understand the purpose of your Secret, and sets a convention for what key names
  to expect.
  The Kubernetes API verifies that the required keys are set for a Secret of this type.
  Caution:SSH private keys do not establish trusted communication between an SSH client and
  host server on their own. A secondary means of establishing trust is needed to
  mitigate "man in the middle" attacks, such as a known_hosts file added to a ConfigMap.
  TLS Secrets
  The kubernetes.io/tls Secret type is for storing
  a certificate and its associated key that are typically used for TLS.
  One common use for TLS Secrets is to configure encryption in transit for
  an Ingress, but you can also use it
  with other resources or directly in your workload.
  When using this type of Secret, the tls.key and the tls.crt key must be provided
  in the data (or stringData) field of the Secret configuration, although the API
  server doesn't actually validate the values for each key.
  As an alternative to using stringData, you can use the data field to provide
  the base64 encoded certificate and private key. For details, see
  Constraints on Secret names and data.
  The following YAML contains an example config for a TLS Secret:
  
  secret/tls-auth-secret.yaml
  
  apiVersion: v1
  kind: Secret
  metadata:
   name: secret-tls
  type: kubernetes.io/tls
  data:
   # values are base64 encoded, which obscures them but does NOT provide
   # any useful level of confidentiality
   tls.crt: |
   LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNVakNDQWJzQ0FnMytNQTBHQ1NxR1NJYjNE
   UUVCQlFVQU1JR2JNUXN3Q1FZRFZRUUdFd0pLVURFT01Bd0cKQTFVRUNCTUZWRzlyZVc4eEVEQU9C
   Z05WQkFjVEIwTm9kVzh0YTNVeEVUQVBCZ05WQkFvVENFWnlZVzVyTkVSRQpNUmd3RmdZRFZRUUxF
   dzlYWldKRFpYSjBJRk4xY0hCdmNuUXhHREFXQmdOVkJBTVREMFp5WVc1ck5FUkVJRmRsCllpQkRR
   VEVqTUNFR0NTcUdTSWIzRFFFSkFSWVVjM1Z3Y0c5eWRFQm1jbUZ1YXpSa1pDNWpiMjB3SGhjTk1U
   TXcKTVRFeE1EUTFNVE01V2hjTk1UZ3dNVEV3TURRMU1UTTVXakJMTVFzd0NRWURWUVFHREFKS1VE
   RVBNQTBHQTFVRQpDQXdHWEZSdmEzbHZNUkV3RHdZRFZRUUtEQWhHY21GdWF6UkVSREVZTUJZR0Ex
   VUVBd3dQZDNkM0xtVjRZVzF3CmJHVXVZMjl0TUlHYU1BMEdDU3FHU0liM0RRRUJBUVVBQTRHSUFE
   Q0JoQUo5WThFaUhmeHhNL25PbjJTbkkxWHgKRHdPdEJEVDFKRjBReTliMVlKanV2YjdjaTEwZjVN
   Vm1UQllqMUZTVWZNOU1vejJDVVFZdW4yRFljV29IcFA4ZQpqSG1BUFVrNVd5cDJRN1ArMjh1bklI
   QkphVGZlQ09PekZSUFY2MEdTWWUzNmFScG04L3dVVm16eGFLOGtCOWVaCmhPN3F1TjdtSWQxL2pW
   cTNKODhDQXdFQUFUQU5CZ2txaGtpRzl3MEJBUVVGQUFPQmdRQU1meTQzeE15OHh3QTUKVjF2T2NS
   OEtyNWNaSXdtbFhCUU8xeFEzazlxSGtyNFlUY1JxTVQ5WjVKTm1rWHYxK2VSaGcwTi9WMW5NUTRZ
   RgpnWXcxbnlESnBnOTduZUV4VzQyeXVlMFlHSDYyV1hYUUhyOVNVREgrRlowVnQvRGZsdklVTWRj
   UUFEZjM4aU9zCjlQbG1kb3YrcE0vNCs5a1h5aDhSUEkzZXZ6OS9NQT09Ci0tLS0tRU5EIENFUlRJ
   RklDQVRFLS0tLS0K
   # In this example, the key data is not a real PEM-encoded private key
   tls.key: |
   RXhhbXBsZSBkYXRhIGZvciB0aGUgVExTIGNydCBmaWVsZA==
  
  The TLS Secret type is provided only for convenience.
  You can create an Opaque type for credentials used for TLS authentication.
  However, using the defined and public Secret type (kubernetes.io/tls)
  helps ensure the consistency of Secret format in your project. The API server
  verifies if the required keys are set for a Secret of this type.
  To create a TLS Secret using kubectl, use the tls subcommand:
  kubectl create secret tls my-tls-secret \
   --cert=path/to/cert/file \
   --key=path/to/key/file
  The public/private key pair must exist before hand. The public key certificate for --cert must be .PEM encoded
  and must match the given private key for --key.
  Bootstrap token Secrets
  The bootstrap.kubernetes.io/token Secret type is for
  tokens used during the node bootstrap process. It stores tokens used to sign
  well-known ConfigMaps.
  A bootstrap token Secret is usually created in the kube-system namespace and
  named in the form bootstrap-token-<token-id> where <token-id> is a 6 character
  string of the token ID.
  As a Kubernetes manifest, a bootstrap token Secret might look like the
  following:
  
  secret/bootstrap-token-secret-base64.yaml
  
  apiVersion: v1
  kind: Secret
  metadata:
   name: bootstrap-token-5emitj
   namespace: kube-system
  type: bootstrap.kubernetes.io/token
  data:
   auth-extra-groups: c3lzdGVtOmJvb3RzdHJhcHBlcnM6a3ViZWFkbTpkZWZhdWx0LW5vZGUtdG9rZW4=
   expiration: MjAyMC0wOS0xM1QwNDozOToxMFo=
   token-id: NWVtaXRq
   token-secret: a3E0Z2lodnN6emduMXAwcg==
   usage-bootstrap-authentication: dHJ1ZQ==
   usage-bootstrap-signing: dHJ1ZQ==
  
  A bootstrap token Secret has the following keys specified under data:
  
  token-id: A random 6 character string as the token identifier. Required.
  token-secret: A random 16 character string as the actual token Secret. Required.
  description: A human-readable string that describes what the token is
  used for. Optional.
  expiration: An absolute UTC time using RFC3339 specifying when the token
  should be expired. Optional.
  usage-bootstrap-<usage>: A boolean flag indicating additional usage for
  the bootstrap token.
  auth-extra-groups: A comma-separated list of group names that will be
  authenticated as in addition to the system:bootstrappers group.
  
  You can alternatively provide the values in the stringData field of the Secret
  without base64 encoding them:
  
  secret/bootstrap-token-secret-literal.yaml
  
  apiVersion: v1
  kind: Secret
  metadata:
   # Note how the Secret is named
   name: bootstrap-token-5emitj
   # A bootstrap token Secret usually resides in the kube-system namespace
   namespace: kube-system
  type: bootstrap.kubernetes.io/token
  stringData:
   auth-extra-groups: "system:bootstrappers:kubeadm:default-node-token"
   expiration: "2020-09-13T04:39:10Z"
   # This token ID is used in the name
   token-id: "5emitj"
   token-secret: "kq4gihvszzgn1p0r"
   # This token can be used for authentication
   usage-bootstrap-authentication: "true"
   # and it can be used for signing
   usage-bootstrap-signing: "true"
  
  Note:The stringData field for a Secret does not work well with server-side apply.
  Working with Secrets
  Creating a Secret
  There are several options to create a Secret:
  
  Use kubectl
  Use a configuration file
  Use the Kustomize tool
  
  Constraints on Secret names and data
  The name of a Secret object must be a valid
  DNS subdomain name.
  You can specify the data and/or the stringData field when creating a
  configuration file for a Secret. The data and the stringData fields are optional.
  The values for all keys in the data field have to be base64-encoded strings.
  If the conversion to base64 string is not desirable, you can choose to specify
  the stringData field instead, which accepts arbitrary strings as values.
  The keys of data and stringData must consist of alphanumeric characters,
  -, _ or .. All key-value pairs in the stringData field are internally
  merged into the data field. If a key appears in both the data and the
  stringData field, the value specified in the stringData field takes
  precedence.
  Size limit
  Individual Secrets are limited to 1MiB in size. This is to discourage creation
  of very large Secrets that could exhaust the API server and kubelet memory.
  However, creation of many smaller Secrets could also exhaust memory. You can
  use a resource quota to limit the
  number of Secrets (or other resources) in a namespace.
  Editing a Secret
  You can edit an existing Secret unless it is immutable. To
  edit a Secret, use one of the following methods:
  
  Use kubectl
  Use a configuration file
  
  You can also edit the data in a Secret using the Kustomize tool. However, this
  method creates a new Secret object with the edited data.
  Depending on how you created the Secret, as well as how the Secret is used in
  your Pods, updates to existing Secret objects are propagated automatically to
  Pods that use the data. For more information, refer to <a href="#using-secrets-as-files-
  ```
  
  ## Production Considerations
  
  ### Security Best Practices
  
  1. **Use non-root user**
  ```dockerfile
  # Create non-root user
  RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
  USER nodejs
  ```
  
  2. **Scan for vulnerabilities**
  ```bash
  # Scan container image
  docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image <image_name>
  ```
  
  3. **Apply security policies**
  ```yaml
  apiVersion: v1
  kind: Pod
  spec:
    securityContext:
      runAsNonRoot: true
      runAsUser: 1001
      fsGroup: 1001
    containers:
    - name: app
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
          - ALL
  ```
  
  ### Performance Optimization
  
  1. **Resource management**
  ```yaml
  resources:
    requests:
      memory: "128Mi"
      cpu: "100m"
    limits:
      memory: "256Mi"
      cpu: "200m"
  ```
  
  2. **Horizontal Pod Autoscaling**
  ```yaml
  apiVersion: autoscaling/v2
  kind: HorizontalPodAutoscaler
  metadata:
    name: app-hpa
  spec:
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: my-app
    minReplicas: 3
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
  ```
  
  ### Backup and Disaster Recovery
  
  1. **Data backup strategy**
  ```bash
  # Automated backup script
  kubectl create job --from=cronjob/backup-job backup-manual-$(date +%Y%m%d-%H%M%S)
  ```
  
  2. **Multi-region deployment**
  ```yaml
  # Anti-affinity rules
  affinity:
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
            - key: app
              operator: In
              values:
              - my-app
          topologyKey: kubernetes.io/zone
  ```