instruction: Create a Dockerfile for Node.js, Alpine Linux with production best practices
output: ```dockerfile
  from
  the host, you need to publish the ports.You can start the container with the -P or -p flags to expose its ports:The -P (or --publish-all) flag publishes all the exposed ports to the
  host. Docker binds each exposed port to a random port on the host.The -P flag only publishes port numbers that are explicitly flagged as
  exposed, either using the Dockerfile EXPOSE instruction or the --expose
  flag for the docker run command.The -p (or --publish) flag lets you explicitly map a single port or range
  of ports in the container to the host.The port number inside the container (where the service listens) doesn't need
  to match the port number published on the outside of the container (where
  clients connect). For example, inside the container an HTTP service might be
  listening on port 80. At runtime, the port might be bound to 42800 on the host.
  To find the mapping between the host ports and the exposed ports, use the
  docker port command.Environment variablesDocker automatically sets some environment variables when creating a Linux
  container. Docker doesn't set any environment variables when creating a Windows
  container.The following environment variables are set for Linux containers:VariableValueHOMESet based on the value of USERHOSTNAMEThe hostname associated with the containerPATHIncludes popular directories, such as /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/binTERMxterm if the container is allocated a pseudo-TTYAdditionally, you can set any environment variable in the container by using
  one or more -e flags. You can even override the variables mentioned above, or
  variables defined using a Dockerfile ENV instruction when building the image.If the you name an environment variable without specifying a value, the current
  value of the named variable on the host is propagated into the container's
  environment:
  
  $ export today=Wednesday
  $ docker run -e "deep=purple" -e today --rm alpine env
  
  PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
  HOSTNAME=d2219b854598
  deep=purple
  today=Wednesday
  HOME=/root
  
  PS C:\> docker run --rm -e "foo=bar" microsoft/nanoserver cmd /s /c set
  ALLUSERSPROFILE=C:\ProgramData
  APPDATA=C:\Users\ContainerAdministrator\AppData\Roaming
  CommonProgramFiles=C:\Program Files\Common Files
  CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
  CommonProgramW6432=C:\Program Files\Common Files
  COMPUTERNAME=C2FAEFCC8253
  ComSpec=C:\Windows\system32\cmd.exe
  foo=bar
  LOCALAPPDATA=C:\Users\ContainerAdministrator\AppData\Local
  NUMBER_OF_PROCESSORS=8
  OS=Windows_NT
  Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Users\ContainerAdministrator\AppData\Local\Microsoft\WindowsApps
  PATHEXT=.COM;.EXE;.BAT;.CMD
  PROCESSOR_ARCHITECTURE=AMD64
  PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 62 Stepping 4, GenuineIntel
  PROCESSOR_LEVEL=6
  PROCESSOR_REVISION=3e04
  ProgramData=C:\ProgramData
  ProgramFiles=C:\Program Files
  ProgramFiles(x86)=C:\Program Files (x86)
  ProgramW6432=C:\Program Files
  PROMPT=$P$G
  PUBLIC=C:\Users\Public
  SystemDrive=C:
  SystemRoot=C:\Windows
  TEMP=C:\Users\ContainerAdministrator\AppData\Local\Temp
  TMP=C:\Users\ContainerAdministrator\AppData\Local\Temp
  USERDOMAIN=User Manager
  USERNAME=ContainerAdministrator
  USERPROFILE=C:\Users\ContainerAdministrator
  windir=C:\WindowsHealthchecksThe following flags for the docker run command let you control the parameters
  for container healthchecks:OptionDescription--health-cmdCommand to run to check health--health-intervalTime between running the check--health-retriesConsecutive failures needed to report unhealthy--health-timeoutMaximum time to allow one check to run--health-start-periodStart period for the container to initialize before starting health-retries countdown--health-start-intervalTime between running the check during the start period--no-healthcheckDisable any container-specified HEALTHCHECKExample:
  
  $ docker run --name=test -d \
   --health-cmd='stat /etc/passwd || exit 1' \
   --health-interval=2s \
   busybox sleep 1d
  $ sleep 2; docker inspect --format='{{.State.Health.Status}}' test
  healthy
  $ docker exec test rm /etc/passwd
  $ sleep 2; docker inspect --format='{{json .State.Health}}' test
  {
   "Status": "unhealthy",
   "FailingStreak": 3,
   "Log": [
   {
   "Start": "2016-05-25T17:22:04.635478668Z",
   "End": "2016-05-25T17:22:04.7272552Z",
   "ExitCode": 0,
   "Output": " File: /etc/passwd\n Size: 334 \tBlocks: 8 IO Block: 4096 regular file\nDevice: 32h/50d\tInode: 12 Links: 1\nAccess: (0664/-rw-rw-r--) Uid: ( 0/ root) Gid: ( 0/ root)\nAccess: 2015-12-05 22:05:32.000000000\nModify: 2015..."
   },
   {
   "Start": "2016-05-25T17:22:06.732900633Z",
   "End": "2016-05-25T17:22:06.822168935Z",
   "ExitCode": 0,
   "Output": " File: /etc/passwd\n Size: 334 \tBlocks: 8 IO Block: 4096 regular file\nDevice: 32h/50d\tInode: 12 Links: 1\nAccess: (0664/-rw-rw-r--) Uid: ( 0/ root) Gid: ( 0/ root)\nAccess: 2015-12-05 22:05:32.000000000\nModify: 2015..."
   },
   {
   "Start": "2016-05-25T17:22:08.823956535Z",
   "End": "2016-05-25T17:22:08.897359124Z",
   "ExitCode": 1,
   "Output": "stat: can't stat '/etc/passwd': No such file or directory\n"
   },
   {
   "Start": "2016-05-25T17:22:10.898802931Z",
   "End": "2016-05-25T17:22:10.969631866Z",
   "ExitCode": 1,
   "Output": "stat: can't stat '/etc/passwd': No such file or directory\n"
   },
   {
   "Start": "2016-05-25T17:22:12.971033523Z",
   "End": "2016-05-25T17:22:13.082015516Z",
   "ExitCode": 1,
   "Output": "stat: can't stat '/etc/passwd': No such file or directory\n"
   }
   ]
  }
  The health status is also displayed in the docker ps output.UserThe default user within a container is root (uid = 0). You can set a default
  user to run the first process with the Dockerfile USER instruction. When
  starting a container, you can override the USER instruction by passing the
  -u option.
  
  -u="", --user="": Sets the username or UID used and optionally the groupname or GID for the specified command.The followings examples are all valid:
  
  --user=[ user | user:group | uid | uid:gid | user:gid | uid:group ]
  NoteIf you pass a numeric user ID, it must be in the range of 0-2147483647. If
  you pass a username, the user must exist in the container.Working directoryThe default working directory for running binaries within a container is the
  root directory (/). The default working directory of an image is set using
  the Dockerfile WORKDIR command. You can override the default working
  directory for an image using the -w (or --workdir) flag for the docker run command:
  
  $ docker run --rm -w /my/workdir alpine pwd
  /my/workdirIf the directory doesn't already exist in the container, it's created.
  Request changesTable of contentsGeneral formImage referencesOptionsCommands and argumentsForeground and backgroundContainer identificationContainer networkingFilesystem mountsVolume mountsBind mountsExit status125126127Other exit codesRuntime constraints on resourcesUser memory constraintsKernel memory constraintsSwappiness constraintCPU share constraintCPU period constraintCpuset constraintCPU quota constraintBlock IO bandwidth (Blkio) constraintAdditional groupsRuntime privilege and Linux capabilitiesOverriding image defaultsDefault command and optionsDefault entrypointExposed portsEnvironment variablesHealthchecksUserWorking directory
  
  Product offerings
  Pricing
  About us
  Contribute
  Read llms.txt
  Cookies Settings
  
  Status
  Legal```
  
  ## Production Considerations
  
  ### Security Best Practices
  
  1. **Use non-root user**
  ```dockerfile
  # Create non-root user
  RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
  USER nodejs
  ```
  
  2. **Scan for vulnerabilities**
  ```bash
  # Scan container image
  docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image <image_name>
  ```
  
  3. **Apply security policies**
  ```yaml
  apiVersion: v1
  kind: Pod
  spec:
    securityContext:
      runAsNonRoot: true
      runAsUser: 1001
      fsGroup: 1001
    containers:
    - name: app
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
          - ALL
  ```
  
  ### Performance Optimization
  
  1. **Resource management**
  ```yaml
  resources:
    requests:
      memory: "128Mi"
      cpu: "100m"
    limits:
      memory: "256Mi"
      cpu: "200m"
  ```
  
  2. **Horizontal Pod Autoscaling**
  ```yaml
  apiVersion: autoscaling/v2
  kind: HorizontalPodAutoscaler
  metadata:
    name: app-hpa
  spec:
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: my-app
    minReplicas: 3
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
  ```
  
  ### Backup and Disaster Recovery
  
  1. **Data backup strategy**
  ```bash
  # Automated backup script
  kubectl create job --from=cronjob/backup-job backup-manual-$(date +%Y%m%d-%H%M%S)
  ```
  
  2. **Multi-region deployment**
  ```yaml
  # Anti-affinity rules
  affinity:
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
            - key: app
              operator: In
              values:
              - my-app
          topologyKey: kubernetes.io/zone
  ```