I have been trying to load the skeleton of express with npm install express. It outputs the following line:
npm install express
npm notice created a lockfil
If this is output from a Dockerfile then you don't want / need to commit it.
However you will want to tag the base image and any other contributing images / applications.
E.g.
FROM node:12.18.1