Docker
Dockerfile Generator
Generate a multi-stage Dockerfile with layer caching, a non-root user and a healthcheck.
Runtime
Keeps the compiler, dev dependencies and source out of the final image.
Container
Emitted in exec form, so the process becomes PID 1 and receives SIGTERM.
Skipped automatically for a distroless base, which already does this.
Output · Dockerfile
- CMD uses the exec form (a JSON array), so the process runs as PID 1 and receives SIGTERM directly. The shell form wraps it in /bin/sh, which swallows signals and breaks graceful shutdown.
- The build stage's toolchain and source are not present in the final image, which reduces both size and attack surface.
- Add a .dockerignore covering .git, node_modules and any local env files — otherwise COPY . . bloats the context and can leak secrets into a layer.