Build for repeatability
A production image should be created from a lockfile and a known base image. Copy dependency manifests first so Docker can reuse the install layer when application source changes.
Use a multi-stage build
Keep compilers and development dependencies in the builder stage, then copy only the runtime output into a smaller final image. This reduces attack surface and makes startup and transfer faster.
Run as a non-root user
The application should not need root privileges. A dedicated user limits the impact of a compromised process and makes the container's permissions easier to reason about.
Configuration belongs outside the image
Use environment variables or a managed secret store for database URLs, API keys, and other deployment-specific values. Never bake credentials into an image or commit them to the repository.