Advanced AI Prompt for Automated Dockerfile Vulnerability Patching

Act as a Container Security Automation Expert. Design a highly secure Dockerfile for a [NODE_OR_PYTHON] application utilizing [BASE_OS_IMAGE] as the foundation. Integrate a mandatory, non-interactive build step that executes [PATCH_COMMAND] (e.g., `apt-get upgrade -y` or `apk upgrade`) to automatically update system packages and mitigate critical CVEs immediately upon build, acting as a defense against vulnerabilities discovered by [SCANNER_TOOL]. Use a multi-stage approach to ensure the final image cache is clean. Include comprehensive metadata labels for OCI compliance and explain the critical importance of `RUN` layer ordering in zero-day vulnerability mitigation.