Checkpoint: Production-Grade Images

Question 1 of 5

• TypeScript, which must be installed in the runtime stage.
• package.json, whose "type": "module" tells Node to treat .js files as ES modules.
• The src/ folder, which Node reads at startup.
• An ENTRYPOINT instruction.

Question 2 of 5

• Use COPY --chown=node:node for all files so the app owns them.
• Run as root but mount the filesystem read-only.
• Use the full node:24 image so system tools can verify file integrity.
• Leave the copied files owned by root and switch to USER node at the end, so the app can read but not write them.

Question 3 of 5

• Build with docker buildx build --platform linux/amd64,linux/arm64 and push, so the tag points to an index with both architectures.
• Pin the base image by digest.
• Change the base image to node:24-alpine.
• Add imagePullPolicy: Always.

Question 4 of 5

• 1.4.0 again, so the manifests don’t need to change.
• latest, since it’s the newest build.
• 1.4.1 plus a sha-<commit> tag, and update the manifest (ideally to the new digest).
• 1.4.0-fixed, overwriting it if another fix comes.

Question 5 of 5

• Switch the base image to distroless.
• Bump the dependency to the fixed version, rebuild, rescan, and keep the CVE gate in CI.
• Add the CVE to an ignore list so the build passes.
• Rebuild with --no-cache so the scanner sees fresh layers.