instruction: Create a Dockerfile for Nginx, Python with production best practices
output: ```dockerfile
  FROM docker.io/library/python:3.12 0.0s
   => [internal] load build context 0.0s
   => => transferring context: 123B 0.0s
   => [2/6] WORKDIR /usr/local/app 0.0s
   => [3/6] RUN useradd app 0.1s
   => [4/6] COPY ./requirements.txt ./requirements.txt 0.0s
   => [5/6] RUN pip install --no-cache-dir --upgrade -r requirements.txt 3.2s
   => [6/6] COPY ./app ./app 0.0s
   => exporting to image 0.1s
   => => exporting layers 0.1s
   => => writing image sha256:9924dfd9350407b3df01d1a0e1033b1e543523ce7d5d5e2c83a724480ebe8f00 0.0s
  With the previous output, you could start a container by using the referenced image:
  
  docker run sha256:9924dfd9350407b3df01d1a0e1033b1e543523ce7d5d5e2c83a724480ebe8f00
  That name certainly isn't memorable, which is where tagging becomes useful.Tagging imagesTagging images is the method to provide an image with a memorable name. However, there is a structure to the name of an image. A full image name has the following structure:
  
  [HOST[:PORT_NUMBER]/]PATH[:TAG]HOST: The optional registry hostname where the image is located. If no host is specified, Docker's public registry at docker.io is used by default.PORT_NUMBER: The registry port number if a hostname is providedPATH: The path of the image, consisting of slash-separated components. For Docker Hub, the format follows [NAMESPACE/]REPOSITORY, where namespace is either a user's or organization's name. If no namespace is specified, library is used, which is the namespace for Docker Official Images.TAG: A custom, human-readable identifier that's typically used to identify different versions or variants of an image. If no tag is specified, latest is used by default.Some examples of image names include:nginx, equivalent to docker.io/library/nginx:latest: this pulls an image
  ```