Build in one stage, ship from another
The image that runs the app does not need the compiler, the dev dependencies or the source. A multi-stage build keeps them in a stage that is thrown away.
FROM node:24-slim AS build
WORKDIR /app
COPY package.json pnpm-lock.yaml ./
RUN corepack enable && pnpm install --frozen-lockfile
COPY . .
RUN pnpm build
FROM node:24-slim
WORKDIR /app
COPY --from=build /app/.next/standalone ./
CMD ["node", "server.js"]The final image is a fraction of the size and has a fraction of the attack surface.
docker