instruction: Create a multi-stage Dockerfile for a Node.js application with security best practices
output: Here's a production-ready multi-stage Dockerfile with security best practices:
  
  ```dockerfile
  # Multi-stage build for Node.js application
  # Build stage
  FROM node:18-alpine AS builder
  
  # Create app directory
  WORKDIR /usr/src/app
  
  # Copy package files
  COPY package*.json ./
  
  # Install dependencies (including devDependencies for build)
  RUN npm ci --only=production && npm cache clean --force
  
  # Copy source code
  COPY . .
  
  # Build the application
  RUN npm run build
  
  # Production stage
  FROM node:18-alpine AS production
  
  # Security: Create non-root user
  RUN addgroup -g 1001 -S nodejs && \
   adduser -S nextjs -u 1001
  
  # Install dumb-init for proper signal handling
  RUN apk add --no-cache dumb-init
  
  # Set working directory
  WORKDIR /usr/src/app
  
  # Copy package files
  COPY package*.json ./
  
  # Install only production dependencies
  RUN npm ci --only=production && npm cache clean --force
  
  # Copy built application from builder stage
  COPY --from=builder /usr/src/app/dist ./dist
  COPY --from=builder /usr/src/app/public ./public
  
  # Change ownership to non-root user
  CHOWN -R nextjs:nodejs /usr/src/app
  USER nextjs
  
  # Expose port
  EXPOSE 3000
  
  # Health check
  HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
   CMD node healthcheck.js
  
  # Use dumb-init for proper signal handling
  ENTRYPOINT ["dumb-init", "--"]
  CMD ["node", "dist/server.js"]
  ```
  
  Key security practices:
  - Multi-stage build reduces final image size
  - Non-root user execution
  - Minimal Alpine base image
  - Cache optimization with .dockerignore
  - Proper signal handling with dumb-init
  - Health checks for container orchestration