Use Docker when an immutable image and consistent runtime improve your release process. Docker is not required for Next.js, but it can make the artifact promoted through environments explicit.
Build one production artifact
Set output: "standalone". In a dependency stage, copy package manifests and install from the lockfile. Build in a separate stage with required build-time values. In the final stage, copy .next/standalone, .next/static, and public when present. Do not copy local node_modules, .env files, or the full source tree into the runtime image.
Keep runtime concerns visible
Run as a non-root user with NODE_ENV=production, HOSTNAME=0.0.0.0, and an explicit port. Give the process write access only to paths that must change. NEXT_PUBLIC_ variables are embedded at build time; changing them at container start does not rewrite the client bundle.
Test the image you will deploy
Build once, tag by commit digest, and run that exact image in validation and production. Request a dynamic page, route handler, optimized image, static asset, and health endpoint. Send the termination signal and confirm in-flight work drains. Retain the previous immutable tag for rollback.