instruction: Create a Dockerfile for Nginx, Alpine Linux with production best practices
output: ```dockerfile
  from the first step.Remove the service and the config.
  
  docker service rm my-iis
  
  docker config rm homepageExample: Use a templated configTo create a configuration in which the content will be generated using a
  template engine, use the --template-driver parameter and specify the engine
  name as its argument. The template will be rendered when container is created.Save the following into a new file index.html.tmpl.
  
  <html lang="en">
   <head><title>Hello Docker</title></head>
   <body>
   <p>Hello {{ env "HELLO" }}! I'm service {{ .Service.Name }}.</p>
   </body>
  </html>Save the index.html.tmpl file as a swarm config named homepage. Provide
  parameter --template-driver and specify golang as template engine.
  
  $ docker config create --template-driver golang homepage index.html.tmpl
  Create a service that runs Nginx and has access to the environment variable
  HELLO and to the config.
  
  $ docker service create \
   --name hello-template \
   --env HELLO="Docker" \
   --config source=homepage,target=/usr/share/nginx/html/index.html \
   --publish published=3000,target=80 \
   nginx:alpine
  Verify that the service is operational: you can reach the Nginx server, and
  that the correct output is being served.
  
  $ curl http://0.0.0.0:3000
  
  <html lang="en">
   <head><title>Hello Docker</title></head>
   <body>
   <p>Hello Docker! I'm service hello-template.</p>
   </body>
  </html>
  Advanced example: Use configs with a Nginx serviceThis example is divided into two parts.
  The first part is all about generating
  the site certificate and does not directly involve Docker configs at all, but
  it sets up the second part, where you store
  and use the site certificate as a series of secrets and the Nginx configuration
  as a config. The example shows how to set options on the config, such as the
  target location within the container and the file permissions (mode).Generate the site certificateGenerate a root CA and TLS certificate and key for your site. For production
  sites, you may want to use a service such as Letâs Encrypt to generate the
  TLS certificate and key, but this example uses command-line tools. This step
  is a little complicated, but is only a set-up step so that you have
  something to store as a Docker secret. If you want to skip these sub-steps,
  you can use Let's Encrypt to
  generate the site key and certificate, name the files site.key and
  site.crt, and skip to
  Configure the Nginx container.Generate a root key.
  
  $ openssl genrsa -out "root-ca.key" 4096
  Generate a CSR using the root key.
  
  $ openssl req \
   -new -key "root-ca.key" \
   -out "root-ca.csr" -sha256 \
   -subj '/C=US/ST=CA/L=San Francisco/O=Docker/CN=Swarm Secret Example CA'
  Configure the root CA. Edit a new file called root-ca.cnf and paste
  the following contents into it. This constrains the root CA to only sign
  leaf certificates and not intermediate CAs.
  
  [root_ca]
  basicConstraints = critical,CA:TRUE,pathlen:1
  keyUsage = critical, nonRepudiation, cRLSign, keyCertSign
  subjectKeyIdentifier=hashSign the certificate.
  
  $ openssl x509 -req -days 3650 -in "root-ca.csr" \
   -signkey "root-ca.key" -sha256 -out "root-ca.crt" \
   -extfile "root-ca.cnf" -extensions \
   root_ca
  Generate the site key.
  
  $ openssl genrsa -out "site.key" 4096
  Generate the site certificate and sign it with the site key.
  
  $ openssl req -new -key "site.key" -out "site.csr" -sha256 \
   -subj '/C=US/ST=CA/L=San Francisco/O=Docker/CN=localhost'
  Configure the site certificate. Edit a new file called site.cnf and
  paste the following contents into it. This constrains the site
  certificate so that it can only be used to authenticate a server and
  can't be used to sign certificates.
  
  [server]
  authorityKeyIdentifier=keyid,issuer
  basicConstraints = critical,CA:FALSE
  extendedKeyUsage=serverAuth
  keyUsage = critical, digitalSignature, keyEncipherment
  subjectAltName = DNS:localhost, IP:127.0.0.1
  subjectKeyIdentifier=hashSign the site certificate.
  
  $ openssl x509 -req -days 750 -in "site.csr" -sha256 \
   -CA "root-ca.crt" -CAkey "root-ca.key" -CAcreateserial \
   -out "site.crt" -extfile "site.cnf" -extensions server
  The site.csr and site.cnf files are not needed by the Nginx service, but
  you need them if you want to generate a new site certificate. Protect
  the root-ca.key file.Configure the Nginx containerProduce a very basic Nginx configuration that serves static files over HTTPS.
  The TLS certificate and key are stored as Docker secrets so that they
  can be rotated easily.In the current directory, create a new file called site.conf with the
  following contents:
  
  server {
   listen 443 ssl;
   server_name localhost;
   ssl_certificate /run/secrets/site.crt;
   ssl_certificate_key /run/secrets/site.key;
  
   location / {
   root /usr/share/nginx/html;
   index index.html index.htm;
   }
  }Create two secrets, representing the key and the certificate. You can store
  any file as a secret as long as it is smaller than 500 KB. This allows you
  to decouple the key and certificate
  ```