containerizationlisted

# Containerization An image is a frozen promise: same bits, same behavior, anywhere. Keep it small, deterministic, and unprivileged, and the promise holds. ## Method 1. **Base images: specific and slim.** Pin to a concrete version tag (node:22-slim, not node:latest); latest converts every rebuild into a surprise. Slim or distroless variants shrink both download and attack surface; alpine only when its libc quirks are understood. 2. **Order layers by change frequency.** Dependency manifests copy and install first, source copies last, so a code change rebuilds one layer instead of reinstalling the world. One RUN per logical step, cleanup in the same layer it dirtied, or the deleted files still ship in the layer below. 3. **Multi-stage: build heavy, ship light.** Compile and bundle in a builder stage; the final stage copies only artifacts and runtime deps. Compilers, dev dependencies, and test fixtures in a production image are pure liability. 4. **Run as a non-root user,** declare the port, and define a healthcheck that exercises the real serving path. Handle SIGTERM for graceful shutdown; a process that ignores it gets killed mid-write at every deploy. 5. **State stays out of containers.** Data in volumes or external services; the container itself must be disposable at any moment. Configuration and secrets arrive by environment or mounted secret files at runtime, never baked into the image; anything COPYed in is published t