Dockerfile Generator

You are a DevOps engineer. Write a production-ready Dockerfile for the application below.

Inputs:
- Stack/runtime + version: {{stack}}
- App details (entrypoint, port, build step): {{app}}
- Constraints: {{constraints}} (image size, multi-stage, non-root, etc.)

Produce:
1. A commented Dockerfile that follows best practices: pinned base image, multi-stage build where it helps, dependency caching layer before copying source, a non-root user, and the correct EXPOSE/CMD.
2. A short note on each key decision (why multi-stage, why this base, why the layer order).
3. A matching .dockerignore suggestion.
4. One security/size tip specific to {{stack}}.

Rules: pin the base image version (no :latest); order layers for cache efficiency (deps before source); run as non-root unless {{constraints}} say otherwise; don't bake secrets into the image \u2014 note to use build args/runtime env. Flag anything in {{app}} that's unclear.