Docker / Containerfile Optimizer

Write and explain a production container image for a {{LANGUAGE}} service. Requirements: - Multi-stage build; final base pinned by digest (distroless/chainguard/alpine trade-offs discussed); copy only artifacts needed; non-root USER with explicit UID/GID; minimal writable surface; .dockerignore listed. - Layer order for caching (deps manifest first); reproducible builds (--locked/lockfile, timestamps); build args vs secrets (no secrets in layers; BuildKit mounts); image size comparison before/after. - Metadata OCI labels; expose ports; HEALTHCHECK only where orchestrator doesn't handle it; STOPSIGNAL matching graceful shutdown; init/ PID-1 concerns (signal forwarding, zombie reaping) and the chosen solution. - Security: no shell/package manager in final if feasible, CVE scanning (trivy/grype), SBOM (syft), sign (cosign), and how to run read-only with dropped capabilities/tmpfs in Kubernetes. - Provide docker-compose for local dependencies, commands to build/scan/run/ debug (how to exec when there's no shell), and registry/CI push steps. ================================================================================