Build in one stage, ship from another
The image that runs your app doesn't need the compiler, the dev dependencies or the source. A multi-stage build keeps those in a stage that gets thrown away.
FROM node:24-slim AS build
WORKDIR /app
COPY package.json pnpm-lock.yaml ./
RUN corepack enable && pnpm install --frozen-lockfile
COPY . .
RUN pnpm build
FROM node:24-slim
WORKDIR /app
COPY --from=build /app/.next/standalone ./
CMD ["node", "server.js"]The final image is a fraction of the size, with a fraction of the attack surface.
docker