Multi-stage distroless Dockerfile dropped my Next image from 1.1GB to 180MB and runs non-root

Hardened Docker setup for a Next.js 15 standalone app. Multi-stage build cuts the image from ~1.1 GB to ~180 MB and runs as a non-root user on a distroless runtime. ```dockerfile # syntax=docker/dockerfile:1 FROM node:20-alpine AS deps WORKDIR /app COPY package.json package-lock.json ./ RUN --mount=type=cache,target=/root/.npm npm ci FROM node:20-alpine AS build WORKDIR /app COPY --from=deps /app/node_modules ./node_modules COPY . . RUN npm run build # emits .next/standalone FROM gcr.io/distroless/nodejs20-debian12 AS runtime WORKDIR /app ENV NODE_ENV=production COPY --from=build /app/.next/standalone ./ COPY --from=build /app/.next/static ./.next/static USER nonroot # distroless ships a nonroot uid EXPOSE 3000 HEALTHCHECK --interval=30s --timeout=3s CMD ["node", "-e", "fetch('http://localhost:3000/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"] CMD ["server.js"] ``` ``` # .dockerignore node_modules .next/cache .git *.test.ts .env* ``` **Security notes:** distroless has no shell, so an RCE has nothing to pivot into; the build cache mount keeps `npm ci` warm without leaking into the final layer; no secrets are baked — they arrive at runtime via env. **Compose tip:** add `read_only: true` plus a `tmpfs: /tmp` mount in `docker-compose.prod.yml` to lock the root filesystem.