Node.js app (multi-stage)

# --- build ---
# Full node:22 (not -alpine) here on purpose: some native modules and
# build tools expect glibc, and build-stage size never reaches the image
# you ship.
FROM node:22 AS build
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
RUN npm run build

# --- runtime ---
FROM node:22-alpine
WORKDIR /app
ENV NODE_ENV=production
# Only the compiled output and node_modules cross into the final image --
# source files, dev dependencies, and build tooling from the "build"
# stage are left behind.
COPY --from=build /app/dist ./dist
COPY --from=build /app/node_modules ./node_modules
USER node
EXPOSE 3000
CMD ["node", "dist/server.js"]