Multi-stage Dockerfile

# Build stage
FROM node:14-alpine AS builder

# Set working directory
WORKDIR /app

# Copy package.json and package-lock.json for better layer caching
COPY package*.json ./

# Install dependencies
RUN npm ci

# Copy application code
COPY . .

# Build the application
RUN npm run build

# Production stage
FROM node:14-alpine

# Set working directory
WORKDIR /app

# Create non-root user
RUN addgroup -g 1001 -S nodejs && \
    adduser -S nodejs -G nodejs -u 1001

# Copy package files
COPY package*.json ./

# Install only production dependencies
RUN npm ci --only=production

# Copy built application from builder stage
COPY --from=builder /app/dist /app/dist

# Set proper permissions
RUN chown -R nodejs:nodejs /app

# Switch to non-root user
USER nodejs

# Expose the port the app runs on
EXPOSE 3000

# Command to run the application
CMD ["npm", "start"]

950 MB

Original Size

→

145 MB

New Size

85%

Size Reduction

Key Improvements

Multi-stage Build Pattern

Separate build and runtime stages allow for a much smaller final image. The build stage contains all necessary tools to compile the application, while the runtime stage only includes what's needed to run it.

Alpine Base Image

Using the Alpine variant of Node.js significantly reduces the base image size compared to the full Debian-based image.

Production Dependencies Only

Installing only production dependencies in the runtime stage removes development dependencies like testing frameworks, build tools, and debug utilities.

Non-root User

Running the container as a non-root user improves security by reducing the potential impact of container breakout vulnerabilities.

Optimized Layer Caching

Copying package files before the full source code ensures that dependencies are only reinstalled when package files change, not when source code changes.

Multi-stage Builder

Multi-stage Build Pattern

Alpine Base Image

Production Dependencies Only

Non-root User

Optimized Layer Caching

Want to Learn More About Multi-stage Builds?