chore: create docker artifacts

Signed-off-by: Alan Brault <alan.brault@visus.io>
2026-06-05 07:40:10 -04:00
parent 08bc2b8918
commit e9f52fa230
3 changed files with 107 additions and 0 deletions
@@ -0,0 +1,45 @@
+# syntax=docker/dockerfile:1
+
+# ── Stage 1: Builder ──────────────────────────────────────────────────────────
+# eclipse-temurin:21-jdk-noble
+FROM eclipse-temurin@sha256:81cecb98bcca2d5d5c3d496e71779073865db0d0bd776ecf434e017f20dac638 AS builder
+
+WORKDIR /workspace
+
+COPY gradle/ gradle/
+COPY gradlew gradlew
+COPY build.gradle.kts build.gradle.kts
+COPY settings.gradle.kts settings.gradle.kts
+COPY gradle.properties gradle.properties
+
+RUN chmod +x gradlew && ./gradlew dependencies --no-daemon
+
+# Source build
+COPY src/ src/
+RUN ./gradlew bootJar --no-daemon -x test -x ktlintCheck
+
+
+# ── Stage 2: Runtime ─────────────────────────────────────────────────────────
+# gcr.io/distroless/java21-debian12 — no shell, no package manager, minimal attack surface
+# Predefined nonroot user UID/GID: 65532
+FROM gcr.io/distroless/java21-debian12@sha256:f34fd3e4e2d7a246d764d0614f5e6ffb3a735930723fac4cfc25a72798950262 AS runtime
+
+WORKDIR /app
+
+# Glob matches fat jar (kotlin-api-0.0.1-SNAPSHOT.jar) but not -plain.jar
+# --chown uses numeric UID:GID since distroless has no shell to resolve names
+COPY --from=builder --chown=65532:65532 /workspace/build/libs/kotlin-api-*SNAPSHOT.jar app.jar
+
+USER 65532
+
+EXPOSE 8080
+
+# Leave empty so Spring fails fast with a clear error if not provided at runtime.
+ENV MONGODB_URI=""
+ENV JWT_ENCRYPTION_SECRET=""
+
+ENTRYPOINT ["/usr/bin/java", \
+  "-XX:+UseContainerSupport", \
+  "-XX:MaxRAMPercentage=75.0", \
+  "-Djava.security.egd=file:/dev/./urandom", \
+  "-jar", "/app/app.jar"]