instruction: Create a Dockerfile for Node.js with production best practices
output: ```dockerfile
  from the GitHub Container Registry, the dockersamples namespace, the example-voting-app-vote image repository, and the pr-311 tagTo tag an image during a build, add the -t or --tag flag:
  
  docker build -t my-username/my-image .
  If you've already built an image, you can add another tag to the image by using the docker image tag command:
  
  docker image tag my-username/my-image another-username/another-image:v1
  Publishing imagesOnce you have an image built and tagged, you're ready to push it to a registry. To do so, use the docker push command:
  
  docker push my-username/my-image
  Within a few seconds, all of the layers for your image will be pushed to the registry.Requiring authenticationBefore you're able to push an image to a repository, you will need to be authenticated.
  To do so, simply use the docker login command.Try it outIn this hands-on guide, you will build a simple image using a provided Dockerfile and push it to Docker Hub.Set upGet the sample application.If you have Git, you can clone the repository for the sample application. Otherwise, you can download the sample application. Choose one of the following options.
  Clone with git
  
  DownloadUse the following command in a terminal to clone the sample application repository.
  
  $ git clone https://github.com/docker/getting-started-todo-app
  Download the source and extract it.Download the sourceDownload and install Docker Desktop.If you don't have a Docker account yet, create one now. Once you've done that, sign in to Docker Desktop using that account.Build an imageNow that you have a repository on Docker Hub, it's time for you to build an image and push it to the repository.Using a terminal in the root of the sample app repository, run the following command. Replace YOUR_DOCKER_USERNAME with your Docker Hub username:
  
  $ docker build -t <YOUR_DOCKER_USERNAME>/concepts-build-image-demo .
  As an example, if your username is mobywhale, you would run the command:
  
  $ docker build -t mobywhale/concepts-build-image-demo .
  Once the build has completed, you can view the image by using the following command:
  
  $ docker image ls
  The command will produce output similar to the following:
  
  REPOSITORY TAG IMAGE ID CREATED SIZE
  mobywhale/concepts-build-image-demo latest 746c7e06537f 24 seconds ago 354MBYou can actually view the history (or how the image was created) by using the
  docker image history command:
  
  $ docker image history mobywhale/concepts-build-image-demo
  You'll then see output similar to the following:
  
  IMAGE CREATED CREATED BY SIZE COMMENT
  f279389d5f01 8 seconds ago CMD ["node" "./src/index.js"] 0B buildkit.dockerfile.v0
  <missing> 8 seconds ago EXPOSE map[3000/tcp:{}] 0B buildkit.dockerfile.v0
  <missing> 8 seconds ago WORKDIR /app 8.19kB buildkit.dockerfile.v0
  <missing> 4 days ago /bin/sh -c #(nop) CMD ["node"] 0B
  <missing> 4 days ago /bin/sh -c #(nop) ENTRYPOINT ["docker-entryâ¦ 0B
  <missing> 4 days ago /bin/sh -c #(nop) COPY file:4d192565a7220e13â¦ 20.5kB
  <missing> 4 days ago /bin/sh -c apk add --no-cache --virtual .buiâ¦ 7.92MB
  <missing> 4 days ago /bin/sh -c #(nop) ENV YARN_VERSION=1.22.19 0B
  <missing> 4 days ago /bin/sh -c addgroup -g 1000 node && adduâ¦ 126MB
  <missing> 4 days ago /bin/sh -c #(nop) ENV NODE_VERSION=20.12.0 0B
  <missing> 2 months ago /bin/sh -c #(nop) CMD ["/bin/sh"] 0B
  <missing> 2 months ago /bin/sh -c #(nop) ADD file:d0764a717d1e9d0afâ¦ 8.42MBThis output shows the layers of the image, highlighting the layers you added and those that were inherited
  ```
  
  ## Production Considerations
  
  ### Security Best Practices
  
  1. **Use non-root user**
  ```dockerfile
  # Create non-root user
  RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
  USER nodejs
  ```
  
  2. **Scan for vulnerabilities**
  ```bash
  # Scan container image
  docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image <image_name>
  ```
  
  3. **Apply security policies**
  ```yaml
  apiVersion: v1
  kind: Pod
  spec:
    securityContext:
      runAsNonRoot: true
      runAsUser: 1001
      fsGroup: 1001
    containers:
    - name: app
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
          - ALL
  ```
  
  ### Performance Optimization
  
  1. **Resource management**
  ```yaml
  resources:
    requests:
      memory: "128Mi"
      cpu: "100m"
    limits:
      memory: "256Mi"
      cpu: "200m"
  ```
  
  2. **Horizontal Pod Autoscaling**
  ```yaml
  apiVersion: autoscaling/v2
  kind: HorizontalPodAutoscaler
  metadata:
    name: app-hpa
  spec:
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: my-app
    minReplicas: 3
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
  ```
  
  ### Backup and Disaster Recovery
  
  1. **Data backup strategy**
  ```bash
  # Automated backup script
  kubectl create job --from=cronjob/backup-job backup-manual-$(date +%Y%m%d-%H%M%S)
  ```
  
  2. **Multi-region deployment**
  ```yaml
  # Anti-affinity rules
  affinity:
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
            - key: app
              operator: In
              values:
              - my-app
          topologyKey: kubernetes.io/zone
  ```