A better Dockerfile for "SSR / Node.js server app"

[silvenon]

The orange note below the Dockerfile claims that vp install --prod won't prune, but considering that we're operating with pnpm under the hood we already have access to pruning via vp pm prune, so let's use all of Docker caching and avoid installing dependencies twice:

# syntax=docker/dockerfile:1

# --- deps stage: all dependencies ---
FROM ghcr.io/voidzero-dev/vite-plus:latest AS all_deps
WORKDIR /app
# Install dependencies first so this layer is cached across source changes.
COPY --chown=vp:vp package.json pnpm-lock.yaml pnpm-workspace.yaml .node-version* ./
RUN vp install --frozen-lockfile

# --- deps stage: production dependencies ---
FROM all_deps AS prod_deps
# Delete development dependencies.
RUN vp pm prune --prod

# --- build stage: the official Vite+ toolchain image ---
FROM all_deps AS build

# Build. vp reads .node-version and provisions that exact Node.js automatically.
COPY --chown=vp:vp . .
RUN vp build

# Export the exact resolved Node.js binary for the runtime stage.
RUN cp "$(vp env which node | head -1)" /tmp/node

# --- runtime stage: small, glibc, no vp ---
FROM debian:bookworm-slim AS runtime
WORKDIR /app
ENV NODE_ENV=production

# The exact Node.js from .node-version (official, signature-verified build).
COPY --from=build /tmp/node /usr/local/bin/node

COPY --from=build /app/dist ./dist
COPY --from=prod_deps /app/node_modules ./node_modules
COPY --from=build /app/package.json ./

USER nobody
EXPOSE 3000
CMD ["node", "dist/server.js"]

What do you think?