Container and Deployment Security

AI-generated Dockerfiles run everything as root, use `latest` tags, embed secrets in environment variables, install unnecessary tools, and skip health checks. The container runs your application in production — every shortcut in the Dockerfile is a vulnerability on your infrastructure.

## Key Points

- `latest` tag — unpredictable builds
- `COPY . .` — includes `.git`, `.env`, `node_modules`, and everything else
- `npm install` — includes devDependencies
- Secrets in ENV — visible in image layers, `docker inspect`, and logs
- Running as root
- Full base image with unnecessary tools (curl, wget, apt — useful for attackers)
- to: # Allow DNS