containerization

Containerization for Node and NestJS services with Docker and OCI images - multi-stage Dockerfiles, slim pinned base images, non-root users, .dockerignore, layer caching, lockfile-based pnpm installs, health checks, signal handling and graceful shutdown, one process per container, image scanning and SBOMs, small images, compose for local development, resource limits, and read-only filesystems. Load when writing or reviewing a Dockerfile or compose file, shrinking or hardening an image, debugging container startup or shutdown, or preparing a service for deployment.