mediumSystem Design

How do you containerize a Node.js app with a small, secure Docker image (multi-stage, distroless)?

Q: How do you containerize a Node.js app with a small, secure Docker image (multi-stage, distroless)?

**TL;DR.** Use a **multi-stage** Dockerfile: install/build in a full image, then copy only **production artifacts** into a slim or **distroless** base. Run as a **non-root** user, install with npm ci --omit=dev , leverage **layer caching**, and add a .dockerignore — keeping the image small and the attack surface low. build stage deps + tsc/bundle copy dist runtime (distro

694 views

Understand the problem

Multi-stage builds, non-root users, and minimal base images.

nodejsdockerdeploymentsecurity

Attempt it yourself

Sketch your approach before reading the solution — that's what interviews test.

Stuck? AI Nudge Available

Get a conceptual hint to guide your logic without spoiling the final implementation.

Study the solution

The solution is waiting

Give it an honest attempt first — then compare your thinking with the full walkthrough.

Read the code

Multi-stage Dockerfile

# --- build stage ---
FROM node:20-slim AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci                      # cached unless deps change
COPY . .
RUN npm run build && npm prune --omit=dev

# --- runtime stage ---
FROM gcr.io/distroless/nodejs20
WORKDIR /app
COPY --from=build /app/node_modules ./node_modules
COPY --from=build /app/dist ./dist
USER nonroot                    # least privilege
CMD ["dist/index.js"]

Join the discussion

Discussion (0)

No responses yet. Be the first to share what you think.

How do you monitor a Node.js application's memory usage in production?

How do you implement retries with exponential backoff and jitter?