instruction: Create a Dockerfile for Python with production best practices
output: ```dockerfile
  from the subset of indexes specified in the succeededIndexes reaches the succeededCount,
  the job controller marks the Job as succeeded.
  
  Note that when you specify multiple rules in the .spec.successPolicy.rules,
  the job controller evaluates the rules in order. Once the Job meets a rule, the job controller ignores remaining rules.
  Here is a manifest for a Job with successPolicy:
  
  /controllers/job-success-policy.yaml
  
  apiVersion: batch/v1
  kind: Job
  metadata:
   name: job-success
  spec:
   parallelism: 10
   completions: 10
   completionMode: Indexed # Required for the success policy
   successPolicy:
   rules:
   - succeededIndexes: 0,2-3
   succeededCount: 1
   template:
   spec:
   containers:
   - name: main
   image: python
   command: # Provided that at least one of the Pods with 0, 2, and 3 indexes has succeeded,
   # the overall Job is a success.
   - python3
   - -c
   - |
   import os, sys
   if os.environ.get("JOB_COMPLETION_INDEX") == "2":
   sys.exit(0)
   else:
   sys.exit(1)
   restartPolicy: Never
  
  In the example above, both succeededIndexes and succeededCount have been specified.
  Therefore, the job controller will mark the Job as succeeded and terminate the lingering Pods
  when either of the specified indexes, 0, 2, or 3, succeed.
  The Job that meets the success policy gets the SuccessCriteriaMet condition with a SuccessPolicy reason.
  After the removal of the lingering Pods is issued, the Job gets the Complete condition.
  Note that the succeededIndexes is represented as intervals separated by a hyphen.
  The number are listed in represented by the first and last element of the series, separated by a hyphen.
  Note:When you specify both a success policy and some terminating policies such as .spec.backoffLimit and .spec.podFailurePolicy,
  once the Job meets either policy, the job controller respects the terminating policy and ignores the success policy.
  Job termination and cleanup
  When a Job completes, no more Pods are created, but the Pods are usually not deleted either.
  Keeping them around allows you to still view the logs of completed pods to check for errors, warnings, or other diagnostic output.
  The job object also remains after it is completed so that you can view its status. It is up to the user to delete
  old jobs after noting their status. Delete the job with kubectl (e.g. kubectl delete jobs/pi or kubectl delete -f ./job.yaml).
  When you delete the job using kubectl, all the pods it created are deleted too.
  By default, a Job will run uninterrupted unless a Pod fails (restartPolicy=Never)
  or a Container exits in error (restartPolicy=OnFailure), at which point the Job defers to the
  .spec.backoffLimit described above. Once .spec.backoffLimit has been reached the Job will
  be marked as failed and any running Pods will be terminated.
  Another way to terminate a Job is by setting an active deadline.
  Do this by setting the .spec.activeDeadlineSeconds field of the Job to a number of seconds.
  The activeDeadlineSeconds applies to the duration of the job, no matter how many Pods are created.
  Once a Job reaches activeDeadlineSeconds, all of its running Pods are terminated and the Job status
  will become type: Failed with reason: DeadlineExceeded.
  Note that a Job's .spec.activeDeadlineSeconds takes precedence over its .spec.backoffLimit.
  Therefore, a Job that is retrying one or more failed Pods will not deploy additional Pods once
  it reaches the time limit specified by activeDeadlineSeconds, even if the backoffLimit is not yet reached.
  Example:
  apiVersion: batch/v1
  kind: Job
  metadata:
   name: pi-with-timeout
  spec:
   backoffLimit: 5
   activeDeadlineSeconds: 100
   template:
   spec:
   containers:
   - name: pi
   image: perl:5.34.0
   command: ["perl", "-Mbignum=bpi", "-wle", "print bpi(2000)"]
   restartPolicy: Never
  Note that both the Job spec and the Pod template spec
  within the Job have an activeDeadlineSeconds field. Ensure that you set this field at the proper level.
  Keep in mind that the restartPolicy applies to the Pod, and not to the Job itself:
  there is no automatic Job restart once the Job status is type: Failed.
  That is, the Job termination mechanisms activated with .spec.activeDeadlineSeconds
  and .spec.backoffLimit result in a permanent Job failure that requires manual intervention to resolve.
  Terminal Job conditions
  A Job has two possible terminal states, each of which has a corresponding Job
  condition:
  
  Succeeded: Job condition Complete
  Failed: Job condition Failed
  
  Jobs fail for the following reasons:
  
  The number of Pod failures exceeded the specified .spec.backoffLimit in the Job
  specification. For details, see Pod backoff failure policy.
  The Job runtime exceeded the specified .spec.activeDeadlineSeconds
  An indexed Job that used .spec.backoffLimitPerIndex has failed indexes.
  For details, see Backoff limit per index.
  The number of failed indexes in the Job exceeded the specified
  spec.maxFailedIndexes. For details, see Backoff limit per index
  A failed Pod matches a rule in .spec.podFailurePolicy that has the FailJob
  action. For details about how Pod failure policy rules might affect failure
  evaluation, see Pod failure policy.
  
  Jobs succeed for the following reasons:
  
  The number of succeeded Pods reached the specified .spec.completions
  The criteria specified in .spec.successPolicy are met. For details, see
  Success policy.
  
  In Kubernetes v1.31 and later the Job controller delays the addition of the
  terminal conditions,Failed or Complete, until all of the Job Pods are terminated.
  In Kubernetes v1.30 and earlier, the Job controller added the Complete or the
  Failed Job terminal conditions as soon as the Job termination process was
  triggered and all Pod finalizers were removed. However, some Pods would still
  be running or terminating at the moment that the terminal condition was added.
  In Kubernetes v1.31 and later, the controller only adds the Job terminal conditions
  after all of the Pods are terminated. You can enable this behavior by using the
  JobManagedBy or the JobPodReplacementPolicy (enabled by default)
  feature gates.
  Termination of Job pods
  The Job controller adds the FailureTarget condition or the SuccessCriteriaMet
  condition to the Job to trigger Pod termination after a Job meets either the
  success or failure criteria.
  Factors like terminationGracePeriodSeconds might increase the amount of time
  ```
  
  ## Production Considerations
  
  ### Security Best Practices
  
  1. **Use non-root user**
  ```dockerfile
  # Create non-root user
  RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
  USER nodejs
  ```
  
  2. **Scan for vulnerabilities**
  ```bash
  # Scan container image
  docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image <image_name>
  ```
  
  3. **Apply security policies**
  ```yaml
  apiVersion: v1
  kind: Pod
  spec:
    securityContext:
      runAsNonRoot: true
      runAsUser: 1001
      fsGroup: 1001
    containers:
    - name: app
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
          - ALL
  ```
  
  ### Performance Optimization
  
  1. **Resource management**
  ```yaml
  resources:
    requests:
      memory: "128Mi"
      cpu: "100m"
    limits:
      memory: "256Mi"
      cpu: "200m"
  ```
  
  2. **Horizontal Pod Autoscaling**
  ```yaml
  apiVersion: autoscaling/v2
  kind: HorizontalPodAutoscaler
  metadata:
    name: app-hpa
  spec:
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: my-app
    minReplicas: 3
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
  ```
  
  ### Backup and Disaster Recovery
  
  1. **Data backup strategy**
  ```bash
  # Automated backup script
  kubectl create job --from=cronjob/backup-job backup-manual-$(date +%Y%m%d-%H%M%S)
  ```
  
  2. **Multi-region deployment**
  ```yaml
  # Anti-affinity rules
  affinity:
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
            - key: app
              operator: In
              values:
              - my-app
          topologyKey: kubernetes.io/zone
  ```