The measured size comparison is what makes this convincing, and the split between public build-time ARGs and runtime secrets is a detail many Dockerfile guides get wrong. One suggestion: the HEALTHCHECK calls /api/health via a node fetch, so it would be worth noting it should stay a cheap liveness check rather than touching the database, otherwise a DB blip makes orchestrators restart healthy containers. Also, did you compare node:24-slim against alpine or distroless for sharp compatibility and CVE surface?