instruction: Create a Dockerfile for multi-stage build with production best practices
output: ```dockerfile
  from Docker HubRun a DHIUse a DHI in CI/CD pipelinesUse a static image for compiled executablesUse dev variants for framework-based applicationsSubscription:
  Docker Hardened Images
  You can use a Docker Hardened Image (DHI) just like any other image on Docker
  Hub. DHIs follow the same familiar usage patterns. Pull them with docker pull,
  reference them in your Dockerfile, and run containers with docker run.The key difference is that DHIs are security-focused and intentionally minimal
  to reduce the attack surface. This means some variants don't include a shell or
  package manager, and may run as a nonroot user by default.
  NoteYou don't need to change your existing workflows. Whether you're pulling
  images manually, referencing them in your Dockerfiles, or integrating them
  into CI pipelines, DHIs work just like the images you already use.After mirroring a DHI to your organization's namespace, the image
  becomes available for use. To find your mirrored repository, go to the original
  image's page in the Hardened Images catalog and select View in repository,
  to show a list of mirrored repositories.Considerations when adopting DHIsDocker Hardened Images are intentionally minimal to improve security. If you're updating existing Dockerfiles or frameworks to use DHIs, keep the following considerations in mind:FeatureDetailsNo shell or package managerRuntime images donât include a shell or package manager. Use -dev or -sdk variants in build stages to run shell commands or install packages, and then copy artifacts to a minimal runtime image.Non-root runtimeRuntime DHIs default to running as a non-root user. Ensure your application doesn't require privileged access and that all needed files are readable and executable by a non-root user.PortsApplications running as non-root users can't bind to ports below 1024 in older versions of Docker or in some Kubernetes configurations. Use ports above 1024 for compatibility.Entry pointDHIs may not include a default entrypoint or might use a different one than the original image you're familiar with. Check the image configuration and update your CMD or ENTRYPOINT directives accordingly.Multi-stage buildsAlways use multi-stage builds for frameworks: a -dev image for building or installing dependencies, and a minimal runtime image for the final stage.TLS certificatesDHIs include standard TLS certificates. You do not need to manually install CA certs.If you're migrating an existing application, see Migrate an existing
  application to use Docker Hardened Images.Use a DHI in a DockerfileTo use a DHI as the base image for your container, specify it in the
  ```