instruction: Create a Dockerfile for Node.js with production best practices
output: ```dockerfile
  from there to the desired target of the secret within
  the container. The default target is C:\ProgramData\Docker\secrets.When creating a service which uses Windows containers, the options to specify
  UID, GID, and mode are not supported for secrets. Secrets are currently only
  accessible by administrators and users with system access within the
  container.How Docker manages secretsWhen you add a secret to the swarm, Docker sends the secret to the swarm manager
  over a mutual TLS connection. The secret is stored in the Raft log, which is
  encrypted. The entire Raft log is replicated across the other managers, ensuring
  the same high availability guarantees for secrets as for the rest of the swarm
  management data.When you grant a newly-created or running service access to a secret, the
  decrypted secret is mounted into the container in an in-memory filesystem. The
  location of the mount point within the container defaults to
  /run/secrets/<secret_name> in Linux containers, or
  C:\ProgramData\Docker\secrets in Windows containers. You can also specify a
  custom location.You can update a service to grant it access to additional secrets or revoke its
  access to a given secret at any time.A node only has access to (encrypted) secrets if the node is a swarm manager or
  if it is running service tasks which have been granted access to the secret.
  When a container task stops running, the decrypted secrets shared to it are
  unmounted
  ```