The hardening checklist

You have everything in containers, you have a health check, you have CI. Before you actually hit deploy, there is a short list of habits that prevent the avoidable outages. None of them are clever. All of them are boring. All of them matter.

Pin your base image to a specific version, not latest. Use a non-root user in the Dockerfile. Set NODE_ENV=production in the runtime stage. Keep secrets out of source, inject them as environment variables at runtime. Add a health check endpoint and wire it into the orchestrator. Set a sensible memory limit on each container. Test that the image runs on a fresh machine before you ship it.