instruction: Create a Dockerfile for Node.js with production best practices
output: ```dockerfile
  from highly-permissive to highly-restrictive.
  This guide outlines the requirements of each policy.ProfileDescriptionPrivilegedUnrestricted policy, providing the widest possible level of permissions. This policy allows for known privilege escalations.BaselineMinimally restrictive policy which prevents known privilege escalations. Allows the default (minimally specified) Pod configuration.RestrictedHeavily restricted policy, following current Pod hardening best practices.Profile DetailsPrivilegedThe Privileged policy is purposely-open, and entirely unrestricted. This type of policy is
  typically aimed at system- and infrastructure-level workloads managed by privileged, trusted users.The Privileged policy is defined by an absence of restrictions. If you define a Pod where the Privileged
  security policy applies, the Pod you define is able to bypass typical container isolation mechanisms.
  For example, you can define a Pod that has access to the node's host network.BaselineThe Baseline policy is aimed at ease of adoption for common containerized workloads while
  preventing known privilege escalations. This policy is targeted at application operators and
  developers of non-critical applications. The following listed controls should be
  enforced/disallowed:Note:In this table, wildcards (*) indicate all elements in a list. For example,
  spec.containers[*].securityContext refers to the Security Context object for all defined
  containers. If any of the listed containers fails to meet the requirements, the entire pod will
  fail validation.Baseline policy specificationControlPolicyHostProcessWindows Pods offer the ability to run HostProcess containers which enables privileged access to the Windows host machine. Privileged access to the host is disallowed in the Baseline policy.FEATURE STATE:
  Kubernetes v1.26 [stable]Restricted Fieldsspec.securityContext.windowsOptions.hostProcessspec.containers[*].securityContext.windowsOptions.hostProcessspec.initContainers[*].securityContext.windowsOptions.hostProcessspec.ephemeralContainers[*].securityContext.windowsOptions.hostProcessAllowed Values/nilfalseHost NamespacesSharing the host namespaces must be disallowed.Restricted Fieldsspec.hostNetworkspec.hostPIDspec.hostIPCAllowed Values/nilfalsePrivileged ContainersPrivileged Pods disable most security mechanisms and must be disallowed.Restricted Fieldsspec.containers[*].securityContext.privilegedspec.initContainers[*].securityContext.privilegedspec.ephemeralContainers[*].securityContext.privilegedAllowed Values/nilfalseCapabilitiesAdding additional capabilities beyond those listed below must be disallowed.Restricted Fieldsspec.containers[*].securityContext.capabilities.addspec.initContainers[*].securityContext.capabilities.addspec.ephemeralContainers[*].securityContext.capabilities.addAllowed Values/nilAUDIT_WRITECHOWNDAC_OVERRIDEFOWNERFSETIDKILLMKNODNET_BIND_SERVICESETFCAPSETGIDSETPCAPSETUIDSYS_CHROOTHostPath VolumesHostPath volumes must be forbidden.Restricted Fieldsspec.volumes[*].hostPathAllowed Values/nilHost PortsHostPorts should be disallowed entirely (recommended) or restricted to a known listRestricted Fieldsspec.containers[*].ports[*].hostPortspec.initContainers[*].ports[*].hostPortspec.ephemeralContainers[*].ports[*].hostPortAllowed Values/nilKnown list (not supported by the built-in Pod Security Admission controller)0AppArmorOn supported hosts, the RuntimeDefault AppArmor profile is applied by default. The baseline policy should prevent overriding or disabling the default AppArmor profile, or restrict overrides to an allowed set of profiles.Restricted Fieldsspec.securityContext.appArmorProfile.typespec.containers[*].securityContext.appArmorProfile.typespec.initContainers[*].securityContext.appArmorProfile.typespec.ephemeralContainers[*].securityContext.appArmorProfile.typeAllowed Values/nilRuntimeDefaultLocalhostmetadata.annotations["container.apparmor.security.beta.kubernetes.io/*"]Allowed Values/nilruntime/defaultlocalhost/*SELinuxSetting the SELinux type is restricted, and setting a custom SELinux user or role option is forbidden.Restricted Fieldsspec.securityContext.seLinuxOptions.typespec.containers[*].securityContext.seLinuxOptions.typespec.initContainers[*].securityContext.seLinuxOptions.typespec.ephemeralContainers[*].securityContext.seLinuxOptions.typeAllowed Values/""container_tcontainer_init_tcontainer_kvm_tcontainer_engine_t (since Kubernetes 1.31)Restricted Fieldsspec.securityContext.seLinuxOptions.userspec.containers[*].securityContext.seLinuxOptions.userspec.initContainers[*].securityContext.seLinuxOptions.userspec.ephemeralContainers[*].securityContext.seLinuxOptions.userspec.securityContext.seLinuxOptions.rolespec.containers[*].securityContext.seLinuxOptions.rolespec.initContainers[*].securityContext.seLinuxOptions.rolespec.ephemeralContainers[*].securityContext.seLinuxOptions.roleAllowed Values/""/proc Mount TypeThe default /proc masks are set up to reduce attack surface, and should be required.Restricted Fieldsspec.containers[*].securityContext.procMountspec.initContainers[*].securityContext.procMountspec.ephemeralContainers[*].securityContext.procMountAllowed Values/nilDefaultSeccompSeccomp profile must not be explicitly set to Unconfined.Restricted Fieldsspec.securityContext.seccompProfile.typespec.containers[*].securityContext.seccompProfile.typespec.initContainers[*].securityContext.seccompProfile.typespec.ephemeralContainers[*].securityContext.seccompProfile.typeAllowed Values/nilRuntimeDefaultLocalhostSysctlsSysctls can disable security mechanisms or affect all containers on a host, and should be disallowed except for an allowed "safe" subset. A sysctl is considered safe if it is namespaced in the container or the Pod, and it is isolated
  ```