nestjs-deployment

Use a three-stage build: a builder stage that installs all dependencies and runs nx build, a deps stage that installs only production dependencies plus webpack externals, and a runtime stage on node:20-alpine with a non-root user, health check, and a CMD that runs prisma migrate deploy before starting node main.js.

Packages with native binaries or ESM-only distributions break when webpack bundles them. Mark them as webpack externals using the 'commonjs package-name' format, then explicitly install them in the Docker deps stage since they are excluded from the generated package.json.

Run prisma migrate deploy as part of the container startup command, for example CMD ["sh", "-c", "npx prisma migrate deploy && node main.js"]. This applies pending migrations before the app accepts traffic and never use migrate dev in production.

Yes, the same Dockerfile works across DigitalOcean App Platform, AWS ECS/Fargate, Google Cloud Run, and Railway. Build the image, push to a container registry, set environment variables like DATABASE_URL as secrets, and configure the health check path to /api.

Set NODE_OPTIONS with --max-old-space-size to about 85-90% of the container memory limit, such as 450 for a 512MB container. Node.js otherwise sizes its heap against host memory rather than the container limit, causing OOM kills.

Apply a global ValidationPipe with whitelist and forbidNonWhitelisted, restrict CORS to the frontend URL, add rate limiting with @nestjs/throttler, use helmet for security headers, and limit production log levels to log, error, and warn.