instruction: Create a Dockerfile for Node.js, Alpine Linux with production best practices
output: ```dockerfile
  from attestation
   â Image stored for indexing
   â Indexed 79 packages
   â No vulnerable package detected
  
   ## Overview
  
   â Analyzed Image
   âââââââââââââââââââââ¼âââââââââââââââââââââââââââââââââââââââââââââââââââ
   Target â mobywhale/scout-demo:v2
   digest â ef68417b2866
   platform â linux/arm64
   provenance â https://github.com/docker/scout-demo-service.git
   â 7c3a06793fc8f97961b4a40c73e0f7ed85501857
   vulnerabilities â 0C 0H 0M 0L
   size â 19 MB
   packages â 1
  
   ## Packages and Vulnerabilities
  
   No vulnerable packages detected
  Step 5: Evaluate policy complianceWhile inspecting vulnerabilities based on specific packages can be useful,
  it isn't the most effective way to improve your supply chain conduct.Docker Scout also supports policy evaluation,
  a higher-level concept for detecting and fixing issues in your images.
  Policies are a set of customizable rules that let organizations track whether
  images are compliant with their supply chain requirements.Because policy rules are specific to each organization,
  you must specify which organization's policy you're evaluating against.
  Use the docker scout config command to configure your Docker organization.
  
  $ docker scout config organization <ORG_NAME>
   â Successfully set organization to <ORG_NAME>
  Now you can run the quickview command to get an overview
  of the compliance status for the image you just built.
  The image is evaluated against the default policy configurations. You'll see output similar to the following:
  
  $ docker scout quickview
  
  ...
  Policy status FAILED (2/6 policies met, 2 missing data)
  
   Status â Policy â Results
  ââââââââââ¼âââââââââââââââââââââââââââââââââââââââââââââââ¼ââââââââââââââââââââââââââââââ
   â â No copyleft licenses â 0 packages
   ! â Default non-root user â
   ! â No fixable critical or high vulnerabilities â 2C 16H 0M 0L
   â â No high-profile vulnerabilities â 0C 0H 0M 0L
   ? â No outdated base images â No data
   ? â Supply chain attestations â No data
  Exclamation marks in the status column indicate a violated policy.
  Question marks indicate that there isn't enough metadata to complete the evaluation.
  A check mark indicates compliance.Step 6: Improve complianceThe output of the quickview command shows that there's room for improvement.
  Some of the policies couldn't evaluate successfully (No data)
  because the image lacks provenance and SBOM attestations.
  The image also failed the check on a few of the evaluations.Policy evaluation does more than just check for vulnerabilities.
  Take the Default non-root user policy for example.
  This policy helps improve runtime security by ensuring that
  images aren't set to run as the root superuser by default.To address this policy violation, edit the Dockerfile by adding a USER
  instruction, specifying a non-root user:
  
   CMD ["node","/app/app.js"]
   EXPOSE 3000
  + USER appuser
  Additionally, to get a more complete policy evaluation result,
  your image should have SBOM and provenance attestations attached to it.
  Docker Scout uses the provenance attestations to determine how the image was
  built so that it can provide a better evaluation result.Before you can build an image with attestations,
  you must enable the
  containerd image store
  (or create a custom builder using the docker-container driver).
  The classic image store doesn't support manifest lists,
  which is how the provenance attestations are attached to an image.Open Settings in Docker Desktop. Under the General section, make sure
  that the Use containerd for pulling and storing images option is checked, then select Apply.
  Note that changing image stores temporarily hides images and containers of the
  inactive image store until you switch back.With the containerd image store enabled, rebuild the image with a new v3 tag.
  This time, add the --provenance=true and --sbom=true flags.
  
  $ docker build --provenance=true --sbom=true --push -t <ORG_NAME>/scout-demo:v3 .
  Step 7: View in DashboardAfter pushing the updated image with attestations, it's time to view the
  results through a different lens: the Docker Scout Dashboard.Open the Docker Scout Dashboard.Sign in with your Docker account.Select Images in the left-hand navigation.The images page lists your Scout-enabled repositories.Select the row for the image you want to view, anywhere in the row except on a link, to open the Image details sidebar.The sidebar shows a compliance overview for the last pushed tag of a repository.
  NoteIf policy results haven't appeared yet, try refreshing the page.
  It might take a few minutes before the results appear if this is your
  first time using the Docker Scout Dashboard.Go back to the image list and select the image version, available in the Most recent image column.
  Then, at the top right of the page, select the Update base image button to inspect the policy.This policy checks whether base images you use are up-to-date.
  It currently has a non-compliant status,
  because the example image uses an old version alpine as a base image.Close the Recommended fixes for base image modal. In the policy listing, select View fixes button, next to the policy name for details about the violation, and recommendations on how to address it.In this case, the recommended action is to enable
  Docker Scout's GitHub integration,
  which helps keep your base images up-to-date automatically.
  TipYou can't enable this integration for the demo app used in this guide.
  Feel free to push the code to a GitHub repository that you own,
  and try out the integration there!SummaryThis quickstart guide has scratched the surface on some of the ways
  Docker Scout can support software supply chain management:How to enable Docker Scout for your repositoriesAnalyzing images for vulnerabilitiesPolicy and complianceFixing vulnerabilities and improving complianceWhat's next?There's lots more to discover,
  ```