instruction: Create a Dockerfile for Node.js with production best practices
output: ```dockerfile
  from highly-permissive to highly-restrictive.
  This guide outlines the requirements of each policy.
  
  Profile
  Description
  
  Privileged
  Unrestricted policy, providing the widest possible level of permissions. This policy allows for known privilege escalations.
  
  Baseline
  Minimally restrictive policy which prevents known privilege escalations. Allows the default (minimally specified) Pod configuration.
  
  Restricted
  Heavily restricted policy, following current Pod hardening best practices.
  
  Profile Details
  Privileged
  The Privileged policy is purposely-open, and entirely unrestricted. This type of policy is
  typically aimed at system- and infrastructure-level workloads managed by privileged, trusted users.
  The Privileged policy is defined by an absence of restrictions. Allow-by-default
  mechanisms (such as gatekeeper) may be Privileged by default. In contrast, for a deny-by-default mechanism (such as Pod
  Security Policy) the Privileged policy should disable all restrictions.
  Baseline
  The Baseline policy is aimed at ease of adoption for common containerized workloads while
  preventing known privilege escalations. This policy is targeted at application operators and
  developers of non-critical applications. The following listed controls should be
  enforced/disallowed:
  
  Note: In this table, wildcards (*) indicate all elements in a list. For example,
  spec.containers[*].securityContext refers to the Security Context object for all defined
  containers. If any of the listed containers fails to meet the requirements, the entire pod will
  fail validation.
  
  Baseline policy specification
  
  Control
  Policy
  
  HostProcess
  
  Windows pods offer the ability to run HostProcess containers which enables privileged access to the Windows node. Privileged access to the host is disallowed in the baseline policy.
  
  FEATURE STATE: Kubernetes v1.26 [stable]
  
  Restricted Fields
  
  spec.securityContext.windowsOptions.hostProcess
  spec.containers[*].securityContext.windowsOptions.hostProcess
  spec.initContainers[*].securityContext.windowsOptions.hostProcess
  spec.ephemeralContainers[*].securityContext.windowsOptions.hostProcess
  
  Allowed Values
  
  /nil
  false
  
  Host Namespaces
  
  Sharing the host namespaces must be disallowed.
  Restricted Fields
  
  spec.hostNetwork
  spec.hostPID
  spec.hostIPC
  
  Allowed Values
  
  /nil
  false
  
  Privileged Containers
  
  Privileged Pods disable most security mechanisms and must be disallowed.
  Restricted Fields
  
  spec.containers[*].securityContext.privileged
  spec.initContainers[*].securityContext.privileged
  spec.ephemeralContainers[*].securityContext.privileged
  
  Allowed Values
  
  /nil
  false
  
  Capabilities
  
  Adding additional capabilities beyond those listed below must be disallowed.
  Restricted Fields
  
  spec.containers[*].securityContext.capabilities.add
  spec.initContainers[*].securityContext.capabilities.add
  spec.ephemeralContainers[*].securityContext.capabilities.add
  
  Allowed Values
  
  /nil
  AUDIT_WRITE
  CHOWN
  DAC_OVERRIDE
  FOWNER
  FSETID
  KILL
  MKNOD
  NET_BIND_SERVICE
  SETFCAP
  SETGID
  SETPCAP
  SETUID
  SYS_CHROOT
  
  HostPath Volumes
  
  HostPath volumes must be forbidden.
  Restricted Fields
  
  spec.volumes[*].hostPath
  
  Allowed Values
  
  /nil
  
  Host Ports
  
  HostPorts should be disallowed entirely (recommended) or restricted to a known list
  Restricted Fields
  
  spec.containers[*].ports[*].hostPort
  spec.initContainers[*].ports[*].hostPort
  spec.ephemeralContainers[*].ports[*].hostPort
  
  Allowed Values
  
  /nil
  Known list (not supported by the built-in Pod Security Admission controller)
  0
  
  AppArmor
  
  On supported hosts, the runtime/default AppArmor profile is applied by default. The baseline policy should prevent overriding or disabling the default AppArmor profile, or restrict overrides to an allowed set of profiles.
  Restricted Fields
  
  metadata.annotations["container.apparmor.security.beta.kubernetes.io/*"]
  
  Allowed Values
  
  /nil
  runtime/default
  localhost/*
  
  SELinux
  
  Setting the SELinux type is restricted, and setting a custom SELinux user or role option is forbidden.
  Restricted Fields
  
  spec.securityContext.seLinuxOptions.type
  spec.containers[*].securityContext.seLinuxOptions.type
  spec.initContainers[*].securityContext.seLinuxOptions.type
  spec.ephemeralContainers[*].securityContext.seLinuxOptions.type
  
  Allowed Values
  
  /""
  container_t
  container_init_t
  container_kvm_t
  
  Restricted Fields
  
  spec.securityContext.seLinuxOptions.user
  spec.containers[*].securityContext.seLinuxOptions.user
  spec.initContainers[*].securityContext.seLinuxOptions.user
  spec.ephemeralContainers[*].securityContext.seLinuxOptions.user
  spec.securityContext.seLinuxOptions.role
  spec.containers[*].securityContext.seLinuxOptions.role
  spec.initContainers[*].securityContext.seLinuxOptions.role
  spec.ephemeralContainers[*].securityContext.seLinuxOptions.role
  
  Allowed Values
  
  /""
  
  /proc Mount Type
  
  The default /proc masks are set up to reduce attack surface, and should be required.
  Restricted Fields
  
  spec.containers[*].securityContext.procMount
  spec.initContainers[*].securityContext.procMount
  spec.ephemeralContainers[*].securityContext.procMount
  
  Allowed Values
  
  /nil
  Default
  
  Seccomp
  
  Seccomp profile must not be explicitly set to Unconfined.
  Restricted Fields
  
  spec.securityContext.seccompProfile.type
  spec.containers[*].securityContext.seccompProfile.type
  spec.initContainers[*].securityContext.seccompProfile.type
  spec.ephemeralContainers[*].securityContext.seccompProfile.type
  
  Allowed Values
  
  /nil
  RuntimeDefault
  Localhost
  
  Sysctls
  
  Sysctls can disable security mechanisms or affect all containers on a host, and should be disallowed except for an allowed "safe" subset. A sysctl is considered safe if it is namespaced in the container or the Pod, and it is isolated
  ```