instruction: Create a Dockerfile for Node.js with production best practices
output: ```dockerfile
  from a positive number to a smaller, non-negative
  number.Resource sharing and communicationPods enable data sharing and communication among their constituent
  containers.Storage in PodsA Pod can specify a set of shared storage
  volumes. All containers
  in the Pod can access the shared volumes, allowing those containers to
  share data. Volumes also allow persistent data in a Pod to survive
  in case one of the containers within needs to be restarted. See
  Storage for more information on how
  Kubernetes implements shared storage and makes it available to Pods.Pod networkingEach Pod is assigned a unique IP address for each address family. Every
  container in a Pod shares the network namespace, including the IP address and
  network ports. Inside a Pod (and only then), the containers that belong to the Pod
  can communicate with one another using localhost. When containers in a Pod communicate
  with entities outside the Pod,
  they must coordinate how they use the shared network resources (such as ports).
  Within a Pod, containers share an IP address and port space, and
  can find each other via localhost. The containers in a Pod can also communicate
  with each other using standard inter-process communications like SystemV semaphores
  or POSIX shared memory. Containers in different Pods have distinct IP addresses
  and can not communicate by OS-level IPC without special configuration.
  Containers that want to interact with a container running in a different Pod can
  use IP networking to communicate.Containers within the Pod see the system hostname as being the same as the configured
  name for the Pod. There's more about this in the networking
  section.Pod security settingsTo set security constraints on Pods and containers, you use the
  securityContext field in the Pod specification. This field gives you
  granular control over what a Pod or individual containers can do. For example:Drop specific Linux capabilities to avoid the impact of a CVE.Force all processes in the Pod to run as a non-root user or as a specific
  user or group ID.Set a specific seccomp profile.Set Windows security options, such as whether containers run as HostProcess.Caution:You can also use the Pod securityContext to enable
  privileged mode
  in Linux containers. Privileged mode overrides many of the other security
  settings in the securityContext. Avoid using this setting unless you can't grant
  the equivalent permissions by using other fields in the securityContext.
  In Kubernetes 1.26 and later, you can run Windows containers in a similarly
  privileged mode by setting the windowsOptions.hostProcess flag on the
  security context of the Pod spec. For details and instructions, see
  Create a Windows HostProcess Pod.To learn about kernel-level security constraints that you can use,
  see Linux kernel security constraints for Pods and containers.To learn more about the Pod security context, see
  Configure a Security Context for a Pod or Container.Static PodsStatic Pods are managed directly by the kubelet daemon on a specific node,
  without the API server
  observing them.
  Whereas most Pods are managed by the control plane (for example, a
  Deployment), for static
  Pods, the kubelet directly supervises each static Pod (and restarts it if it fails).Static Pods are always bound to one Kubelet on a specific node.
  The main use for static Pods is to run a self-hosted control plane: in other words,
  using the kubelet to supervise the individual control plane components.The kubelet automatically tries to create a mirror Pod
  on the Kubernetes API server for each static Pod.
  This means that the Pods running on a node are visible on the API server,
  but cannot be controlled
  ```