Tool

Dockerfile Generator

Pick a language. Set the port, unless it is the static site, which listens on 80. Copy the file and read the comments before you build it.

Port

# Node.js. Commit package-lock.json. The build should write ./dist.
FROM node:20-alpine AS build
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM node:20-alpine
WORKDIR /app
ENV NODE_ENV=production
RUN addgroup -g 1001 -S app && adduser -S app -u 1001 -G app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev && npm cache clean --force
COPY --from=build /app/dist ./dist
USER app
EXPOSE 3000
CMD ["node", "dist/index.js"]

Expects package-lock.json and a build that writes dist/. Dev dependencies install in the build stage. The runtime stage installs production dependencies only.

What the file is doing

Dependencies before source. Lockfiles change less often than your last commit. That is the cache.
A second stage when there is a compiler. Go, Rust, Java, Node, and the static build leave the toolchain behind. Python does not, because the interpreter stays.
Not root, on the app images. The static nginx image is the exception. It listens on 80.
A pinned tag. node:20-alpine is a decision. node:latest is a surprise during an incident.