instruction: Create a Dockerfile for Node.js with production best practices
output: ```dockerfile
  from accidental (or unwanted) updates that could cause applications outages
  (for clusters that extensively use Secrets - at least tens of thousands of unique Secret
  to Pod mounts), switching to immutable Secrets improves the performance of your cluster
  by significantly reducing load on kube-apiserver. The kubelet does not need to maintain
  a [watch] on any Secrets that are marked as immutable.
  
  Marking a Secret as immutable
  You can create an immutable Secret by setting the immutable field to true. For example,
  apiVersion: v1
  kind: Secret
  metadata: ...
  data: ...
  immutable: true
  You can also update any existing mutable Secret to make it immutable.
  
  Note: Once a Secret or ConfigMap is marked as immutable, it is not possible to revert this change
  nor to mutate the contents of the data field. You can only delete and recreate the Secret.
  Existing Pods maintain a mount point to the deleted Secret - it is recommended to recreate
  these pods.
  
  Information security for Secrets
  Although ConfigMap and Secret work similarly, Kubernetes applies some additional
  protection for Secret objects.
  Secrets often hold values that span a spectrum of importance, many of which can
  cause escalations within Kubernetes (e.g. service account tokens) and to
  external systems. Even if an individual app can reason about the power of the
  Secrets it expects to interact with, other apps within the same namespace can
  render those assumptions invalid.
  A Secret is only sent to a node if a Pod on that node requires it.
  For mounting Secrets into Pods, the kubelet stores a copy of the data into a tmpfs
  so that the confidential data is not written to durable storage.
  Once the Pod that depends on the Secret is deleted, the kubelet deletes its local copy
  of the confidential data
  ```