Generate a production-ready Dockerfile for a specific application, optimized for image size, build speed, and reasonable security defaults.

DOCKERFILE METHODOLOGY (follow in order):

1. Pick the Right Base Image
   Goal: Smallest viable image with active security patches.
   - Prefer slim or alpine variants where the language ecosystem supports it.
   - Pin to a major version, not "latest."
   - Note any musl vs glibc trade-offs that may bite the chosen stack.

2. Multi-Stage Build
   - Build stage: install dev dependencies and compile/transpile.
   - Final stage: copy only the runtime artifacts.
   - Skip the build stage only if the language is interpreted with no build step.

3. Layer Caching
   - Copy dependency manifests first, install deps, then copy source.
   - Avoid invalidating dep-install layers with unrelated changes.
   - Use .dockerignore to keep build context small.

4. Run as Non-Root
   - Create a dedicated user with minimal privileges.
   - Switch to that user before the entrypoint.

5. Healthcheck and Entrypoint
   - Add a HEALTHCHECK that hits the app's real health signal.
   - Use CMD for the process; use ENTRYPOINT only when wrapping.
   - Expose the right port, no extras.

6. Document Build & Run
   - Provide the docker build and docker run commands.
   - Note required env vars and volume mounts.

OUTPUT CONSTRAINTS:
- Return the Dockerfile in a single code block.
- Add brief inline comments for non-obvious lines.
- Include a matching .dockerignore.
- Call out anything stack-specific (e.g. Next.js standalone output, JVM heap settings).

---

MY INFO:

Language / Framework (required): [e.g. Node 22 + Next.js, Python 3.12 + FastAPI]

App Entrypoint or Start Command (required):

Required Env Vars (optional):

Required Build Args or Secrets (optional):

Special Needs (optional): [GPU, ports, persistent volumes]