How do I build a small production Docker image for a Next.js or Node.js app?

Build in one stage, copy only what you need into a slim runtime stage.

# syntax=docker/dockerfile:1
FROM node:22-alpine AS deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci

FROM node:22-alpine AS build
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN npm run build
RUN npm prune --omit=dev

FROM node:22-alpine AS runtime
ENV NODE_ENV=production
WORKDIR /app
COPY --from=build --chown=node:node /app/package.json ./
COPY --from=build --chown=node:node /app/node_modules ./node_modules
COPY --from=build --chown=node:node /app/dist ./dist
USER node
EXPOSE 3000
CMD ["node", "dist/server.js"]

For Next.js, set output: 'standalone' in next.config and copy .next/standalone, .next/static and public into the runtime stage; start with node server.js. The standalone output includes only the traced dependencies and is much smaller.

Why it works

• The runtime stage never sees compilers, tests, or source maps unless you copy them.
• Copying package*.json first lets Docker cache the npm ci layer until dependencies change.
• USER node stops the process running as root.

Also add a .dockerignore:

node_modules
.git
.env*
.next
dist
Dockerfile

Without it, COPY . . sends your local node_modules and secrets into the build context.

Pitfalls

• Alpine uses musl; native modules (sharp, bcrypt) may need the matching platform binaries. If you hit errors, use node:22-slim instead.
• Pin versions by tag or digest for reproducible builds.
• Never bake secrets into image layers; pass them at runtime.