I'd suggest changing this: COPY package.json . RUN npm install to this: COPY package.json package-lock.json . RUN npm ci `npm ci` installs t

I'd suggest changing this: COPY package.json . RUN npm install to this: COPY package.json package-lock.json . RUN npm ci `npm ci` installs the exact dependencies specified in the lockfile. This way, transitive dependencies that were upgraded via `npm audit fix` are guaranteed to be installed. It therefore forces the image to be rebuilt when a transitive dependency changes. Copying only the package.json wouldn't do that. It also errors if the lockfile and the package.json are inconsistent. https://docs.npmjs.com/cli/ci.html https://docs.npmjs.com/cli/ci.html