There was no .dockerignore, so node_modules and build/ were copied into the build context on every build. Add one, install from the lockfile with npm ci, prune the dev dependencies out of the runtime layer and run as the node user.
