Images and Dockerfiles

📘What it really is

• A Dockerfile is the recipe for an image. For your Node.js API:

# ---- build stage ----
FROM node:22-slim AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# ---- run stage ----
FROM node:22-slim
WORKDIR /app
ENV NODE_ENV=production
COPY package*.json ./
RUN npm ci --omit=dev
COPY --from=build /app/dist ./dist
USER node
EXPOSE 3001
CMD ["node", "dist/server.js"]

• Good practices shown here:
• official, slim base images, with a pinned version;
• multi-stage builds: build tools stay in the first stage; the final image contains only what's needed to run;
• copy package*.json first and install, then copy the code: Docker caches layers, so dependencies are only reinstalled when they change, making rebuilds fast;
• run as a non-root user (USER node);
• a .dockerignore file excluding node_modules, .git, .env and test files, so they're never copied into the image.

• Never put secrets in an image (no .env, no keys in ENV lines). Anyone with the image can read them. Pass them at run time (Lesson 5).

• Build and run:

docker build -t crm-api:1.0 .
docker run --rm -p 127.0.0.1:3001:3001 --env-file .env crm-api:1.0