A single-stage Dockerfile tends to ship your entire build toolchain into production, which makes images bigger and slower to deploy. I prefer multi-stage builds: one stage installs deps + builds, the final stage runs only the minimal production output. I also pay attention to file ownership and a non-root user so the container doesn’t run as root by default. For Node apps, setting NODE_ENV=production and pruning dev dependencies usually pays off immediately. If you’re using Next.js standalone output, you can copy just .next/standalone plus static assets. The result is smaller images, faster cold starts, and fewer surprises when you scan images for vulnerabilities.