Production Docker Multi-Stage Builds: Slashing Image Size by 85% & Hardening Container Security

In many software teams, Dockerfiles start simple: COPY . ., npm install, and npm start. While this works in local development, the resulting image is often over 1.2 gigabytes in size. It contains TypeScript compilers, devDependencies, Git history, and package cache files.

Large containers slow down CI/CD deployments, consume massive bandwidth on container registries, and critically, dramatically widen the vulnerability surface for CVE exploits.

By splitting the build into three distinct stages (deps, builder, and runner), the final production image contains only the compiled JavaScript runtime and required public assets.

# Stage 1: Dependency resolution
FROM node:22-alpine AS deps
RUN apk add --no-cache libc6-compat
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --only=production

# Stage 2: Code Compilation & Asset Bundling
FROM node:22-alpine AS builder
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
ENV NEXT_TELEMETRY_DISABLED=1
ENV NODE_ENV=production
RUN npm run build

# Stage 3: Ultra-lean Production Runner
FROM node:22-alpine AS runner
WORKDIR /app
ENV NODE_ENV=production
ENV NEXT_TELEMETRY_DISABLED=1

# Non-root user for security
RUN addgroup --system --gid 1001 nodejs && \
    adduser --system --uid 1001 nextjs

COPY --from=builder /app/public ./public
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static

USER nextjs
EXPOSE 3000
ENV PORT=3000
CMD ["node", "server.js"]

Always mount configuration secrets via Docker secrets or runtime environment injection rather than baking .env files into image layers.

Implement Docker layer caching with BuildKit by placing infrequently changed commands (like package.json copying) at the top of the Dockerfile.