Update Dockerfile with secure base image and non-root user

content/get-started/workshop/02_our_app.md

@@ -57,19 +57,29 @@ To build the image, you'll need to use a Dockerfile. A Dockerfile is simply a te
 
    ```dockerfile
    # syntax=docker/dockerfile:1
-
-   FROM node:lts-alpine
+   FROM node:24-alpine
    WORKDIR /app
+   COPY package*.json ./
+   RUN npm install --omit=dev && \
+       rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx && \
+       mkdir -p /etc/todos && chown node:node /etc/todos
    COPY . .
-   RUN yarn install --production
-   CMD ["node", "src/index.js"]
+   USER node
    EXPOSE 3000
+   CMD ["node", "src/index.js"]
    ```
 
-   This Dockerfile starts off with a `node:lts-alpine` base image, a
-   light-weight Linux image that comes with Node.js and the Yarn package
-   manager pre-installed. It copies all of the source code into the image,
-   installs the necessary dependencies, and starts the application.
+   This Dockerfile:
+
+   - Starts with a `node:24-alpine` base image, a lightweight Linux image that comes with Node.js and npm pre-installed
+   - Sets `/app` as the working directory for subsequent instructions
+   - Copies `package.json` and `package-lock.json` first to leverage Docker's layer caching for dependencies
+   - Installs production dependencies only (`--omit=dev`)
+   - Removes npm after installation since it's no longer needed at runtime
+   - Creates the `/etc/todos` directory for the SQLite database with proper ownership
+   - Copies the application source code
+   - Switches to the non-root node user for security
+   - Exposes port `3000` and starts the application
 
 2. Build the image using the following commands: