docker-containerization

Use a multi-stage build: one stage installs dependencies with npm ci, a second compiles TypeScript and prunes dev dependencies, and a final runner stage copies only dist and production node_modules. Run as the non-root node user and expose a /health endpoint for Docker health checks.

Build the static assets in a node:22-alpine stage with npm run build, then copy the dist output into an nginx:alpine-slim image. Add an Nginx config with try_files $uri $uri/ /index.html so client-side React Router paths resolve correctly.

Use multi-stage builds so only compiled output and pruned production node_modules reach the final image, choose alpine or distroless base images, and add a .dockerignore excluding node_modules, dist, .git, and .env. This typically brings Express images under 150MB.

Define a healthcheck on the MongoDB service using mongosh --eval db.adminCommand('ping'), then set depends_on with condition: service_healthy on the backend service. Compose will delay backend startup until MongoDB passes its health check.

Running as root means a process that escapes the application could gain root access to the container and potentially the host. The official Node images include a node user, so adding USER node to the Dockerfile enforces least-privilege execution in production.

Use npm ci in Docker builds because it installs exactly what the lockfile specifies, fails on lockfile mismatches, and produces reproducible images. npm install can silently update dependencies, breaking build determinism.