Convert to multi-stage builds

.dockerignore

@@ -1,4 +1,5 @@
 # Don't send node_modules the daemon - we want the build server to install these.
-node_modules/
+node_modules
+npm-debug.log
 .git
-repo.yml
+.gitignore

Dockerfile.template

@@ -1,20 +1,29 @@
-# base-image for node on any machine using a template variable,
 # see more about dockerfile templates here: https://www.balena.io/docs/learn/develop/dockerfile/#dockerfile-templates
-# and about balena base images here: https://www.balena.io/docs/reference/base-images/base-images/
-FROM node:22-bookworm-slim
+# The image being used to build the application in multi-stage build
+FROM node:22-bookworm-slim AS build
 
 # Defines our working directory in container
-WORKDIR /usr/src/app
+WORKDIR /build
 
 # Copies the package.json first for better cache on later pushes
 COPY package*.json ./
 
-# This install npm dependencies on the balena build server,
-# making sure to clean up the artifacts it creates in order to reduce the image size.
-RUN JOBS=MAX npm install --production --unsafe-perm && npm cache verify && rm -rf /tmp/*
+# Install npm dependencies
+RUN JOBS=MAX npm ci --omit=dev
 
 # This will copy all files in our root to the working directory in the container
 COPY . ./
 
-# server.js will run when container starts up on the device
-CMD ["npm", "start"]
+# Image that will be used to run the application
+FROM node:22-bookworm-slim
+
+ENV NODE_ENV=production
+WORKDIR /usr/src/app
+
+COPY --from=build /build .
+
+# Use node user instead of root for security
+USER node
+
+# Use exec form for better signal handling
+CMD ["node", "server.js"]