Rocky
405a2cfc0f
Enforce mTLS and least-privilege runtime boundaries while adding repeatable MySQL 8.4 and Docker smoke checks that require no production secrets.
30 lines
963 B
Docker
30 lines
963 B
Docker
FROM gradle:9.6.1-jdk21-alpine AS build
|
|
RUN apk add --no-cache nodejs npm \
|
|
&& mkdir -p /workspace \
|
|
&& chown gradle:gradle /workspace
|
|
WORKDIR /workspace
|
|
|
|
COPY --chown=gradle:gradle . .
|
|
USER gradle
|
|
RUN --mount=type=cache,target=/home/gradle/.gradle,uid=1000,gid=1000 \
|
|
./gradlew --no-daemon --no-configuration-cache --stacktrace installDist
|
|
|
|
FROM eclipse-temurin:21-jre-alpine
|
|
RUN addgroup -S -g 10001 app \
|
|
&& adduser -S -D -H -u 10001 -G app -h /app app
|
|
WORKDIR /app
|
|
|
|
COPY --from=build --chown=app:app /workspace/build/install/OSGAccountServer/ /app/
|
|
|
|
ENV HOME=/tmp \
|
|
JAVA_TOOL_OPTIONS="-Djava.io.tmpdir=/tmp -XX:+UseG1GC -XX:MaxGCPauseMillis=100 -XX:MaxRAMPercentage=75.0 -XX:+ExitOnOutOfMemoryError"
|
|
|
|
USER 10001:10001
|
|
EXPOSE 8080
|
|
STOPSIGNAL SIGTERM
|
|
|
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=30s --retries=3 \
|
|
CMD wget -q -O /dev/null http://127.0.0.1:8080/health/ready || exit 1
|
|
|
|
ENTRYPOINT ["/app/bin/OSGAccountServer"]
|