instruction: Create a Dockerfile for Nginx with production best practices
output: ```dockerfile
  from a remote repo,
  as long as a kustomization.yaml is present inside. An overlay is a directory with a kustomization.yaml that refers to other
  kustomization directories as its bases. A base has no knowledge of an overlay and can be used in multiple overlays.The kustomization.yaml in an overlay directory may refer to multiple bases, combining all the resources defined
  in these bases into a unified configuration. Additionally, it can apply customizations on top of these resources to meet specific
  requirements.Here is an example of a base:# Create a directory to hold the base
  mkdir base
  # Create a base/deployment.yaml
  cat <<EOF > base/deployment.yaml
  apiVersion: apps/v1
  kind: Deployment
  metadata:
   name: my-nginx
  spec:
   selector:
   matchLabels:
   run: my-nginx
   replicas: 2
   template:
   metadata:
   labels:
   run: my-nginx
   spec:
   containers:
   - name: my-nginx
   image: nginx
  EOF
  
  # Create a base/service.yaml file
  cat <<EOF > base/service.yaml
  apiVersion: v1
  kind: Service
  metadata:
   name: my-nginx
   labels:
   run: my-nginx
  spec:
   ports:
   - port: 80
   protocol: TCP
   selector:
   run: my-nginx
  EOF
  # Create a base/kustomization.yaml
  cat <<EOF > base/kustomization.yaml
  resources:
  - deployment.yaml
  - service.yaml
  EOF
  This base can be used in multiple overlays. You can add different namePrefix or other cross-cutting fields
  in different overlays. Here are two overlays using the same base.mkdir dev
  cat <<EOF > dev/kustomization.yaml
  resources:
  - ../base
  namePrefix: dev-
  EOF
  
  mkdir prod
  cat <<EOF > prod/kustomization.yaml
  resources:
  - ../base
  namePrefix: prod-
  EOF
  How to apply/view/delete objects using KustomizeUse --kustomize or -k in kubectl commands to recognize resources managed by kustomization.yaml.
  Note that -k should point to a kustomization directory, such askubectl apply -k <kustomization directory>/
  Given the following kustomization.yaml,# Create a deployment.yaml file
  cat <<EOF > deployment.yaml
  apiVersion: apps/v1
  kind: Deployment
  metadata:
   name: my-nginx
  spec:
   selector:
   matchLabels:
   run: my-nginx
   replicas: 2
   template:
   metadata:
   labels:
   run: my-nginx
   spec:
   containers:
   - name: my-nginx
   image: nginx
   ports:
   - containerPort: 80
  EOF
  
  # Create a kustomization.yaml
  cat <<EOF >./kustomization.yaml
  namePrefix: dev-
  labels:
   - pairs:
   app: my-nginx
   includeSelectors: true
  resources:
  - deployment.yaml
  EOF
  Run the following command to apply the Deployment object dev-my-nginx:> kubectl apply -k ./
  deployment.apps/dev-my-nginx created
  Run one of the following commands to view the Deployment object dev-my-nginx:kubectl get -k ./
  kubectl describe -k ./
  Run the following command to compare the Deployment object dev-my-nginx against the state
  that the cluster would be in if the manifest was applied:kubectl diff -k ./
  Run the following command to delete the Deployment object dev-my-nginx:> kubectl delete -k ./
  deployment.apps "dev-my-nginx" deleted
  Kustomize Feature ListFieldTypeExplanationbases[]stringEach entry in this list should resolve to a directory containing a kustomization.yaml filecommonAnnotationsmap[string]stringannotations to add to all resourcescommonLabelsmap[string]stringlabels to add to all resources and selectorsconfigMapGenerator[]ConfigMapArgsEach entry in this list generates a ConfigMapconfigurations[]stringEach entry in this list should resolve to a file containing Kustomize transformer configurationscrds[]stringEach entry in this list should resolve to an OpenAPI definition file for Kubernetes typesgeneratorOptionsGeneratorOptionsModify behaviors of all ConfigMap and Secret generatorimages[]ImageEach entry is to modify the name, tags and/or digest for one image without creating patcheslabelsmap[string]stringAdd labels without automically injecting corresponding selectorsnamePrefixstringvalue of this field is prepended to the names of all resourcesnameSuffixstringvalue of this field is appended to the names of all resourcespatchesJson6902[]PatchEach entry in this list should resolve to a Kubernetes object and a Json PatchpatchesStrategicMerge[]stringEach entry in this list should resolve a strategic merge patch of a Kubernetes objectreplacements[]Replacementscopy the value
  ```
  
  ## Production Considerations
  
  ### Security Best Practices
  
  1. **Use non-root user**
  ```dockerfile
  # Create non-root user
  RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
  USER nodejs
  ```
  
  2. **Scan for vulnerabilities**
  ```bash
  # Scan container image
  docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image <image_name>
  ```
  
  3. **Apply security policies**
  ```yaml
  apiVersion: v1
  kind: Pod
  spec:
    securityContext:
      runAsNonRoot: true
      runAsUser: 1001
      fsGroup: 1001
    containers:
    - name: app
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
          - ALL
  ```
  
  ### Performance Optimization
  
  1. **Resource management**
  ```yaml
  resources:
    requests:
      memory: "128Mi"
      cpu: "100m"
    limits:
      memory: "256Mi"
      cpu: "200m"
  ```
  
  2. **Horizontal Pod Autoscaling**
  ```yaml
  apiVersion: autoscaling/v2
  kind: HorizontalPodAutoscaler
  metadata:
    name: app-hpa
  spec:
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: my-app
    minReplicas: 3
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
  ```
  
  ### Backup and Disaster Recovery
  
  1. **Data backup strategy**
  ```bash
  # Automated backup script
  kubectl create job --from=cronjob/backup-job backup-manual-$(date +%Y%m%d-%H%M%S)
  ```
  
  2. **Multi-region deployment**
  ```yaml
  # Anti-affinity rules
  affinity:
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
            - key: app
              operator: In
              values:
              - my-app
          topologyKey: kubernetes.io/zone
  ```