Create your Dockerfile

# Dockerfile
# ═══ Stage 1: Install production deps ═══
FROM node:20-alpine AS deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev && npm cache clean --force

# ═══ Stage 2: Production runtime ═══
FROM node:20-alpine AS runtime

# Security: non-root user
RUN addgroup -g 1001 -S app && adduser -S app -u 1001 -G app
WORKDIR /app

# Copy deps from stage 1
COPY --from=deps /app/node_modules ./node_modules
COPY src/ ./src/
COPY package.json ./

# Own the files
RUN chown -R app:app /app
USER app

EXPOSE 3000

HEALTHCHECK --interval=30s --timeout=3s \
  CMD wget --spider -q http://localhost:3000/health || exit 1

ENV NODE_ENV=production
CMD ["node", "src/server.js"]

Create .dockerignore

node_modules
.git
.github
coverage
reports
tests
*.md
.eslintrc*

Test locally

docker build -t cicd-mastery:local .
docker run -p 3000:3000 cicd-mastery:local
# Visit http://localhost:3000/health

Create ACR (one-time setup)

ACR_NAME="acrcicdmastery$(openssl rand -hex 3)"

az acr create \
  --name $ACR_NAME \
  --resource-group rg-cicd-mastery \
  --sku Basic

# Grant your GitHub Actions SP the AcrPush role
ACR_ID=$(az acr show --name $ACR_NAME --query id -o tsv)
az role assignment create \
  --assignee $APP_ID \
  --role "AcrPush" \
  --scope $ACR_ID

# Add as GitHub variables:
# ACR_NAME = acrcicdmasteryXXX
# ACR_LOGIN_SERVER = acrcicdmasteryXXX.azurecr.io

The workflow

# .github/workflows/container.yml
name: Container Build

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  id-token: write
  contents: read

env:
  IMAGE: cicd-mastery-api

jobs:
  build-push:
    name: 🐳 Build & Push
    runs-on: ubuntu-latest
    outputs:
      image-tag: ${{ steps.tag.outputs.value }}
    steps:
      - uses: actions/checkout@v4

      - name: Set image tag
        id: tag
        run: echo "value=sha-$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Azure Login
        if: github.event_name == 'push'
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Login to ACR
        if: github.event_name == 'push'
        run: az acr login --name ${{ vars.ACR_NAME }}

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: ${{ github.event_name == 'push' }}  # Only push on main
          tags: |
            ${{ vars.ACR_LOGIN_SERVER }}/${{ env.IMAGE }}:${{ steps.tag.outputs.value }}
            ${{ vars.ACR_LOGIN_SERVER }}/${{ env.IMAGE }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

  scan:
    name: 🔍 Vulnerability Scan
    needs: build-push
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    steps:
      - name: Azure Login
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      - run: az acr login --name ${{ vars.ACR_NAME }}
      - name: Trivy scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ vars.ACR_LOGIN_SERVER }}/${{ env.IMAGE }}:${{ needs.build-push.outputs.image-tag }}
          severity: 'HIGH,CRITICAL'
          exit-code: '1'