# Multi-stage build для ordinis-read-api. См. ordinis-app/Dockerfile для
# rationale `COPY . ./` + `.dockerignore` подхода (single-rule, future-proof
# на новые Maven modules).
FROM repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21 AS build
WORKDIR /build
COPY . ./
RUN mvn -B -pl ordinis-read-api -am package -DskipTests

FROM repo.nstart.cloud/dockerhub/library/eclipse-temurin:21-jre
# Non-root user — security hardening (CSO report 2026-05-27 finding #1).
# См. ordinis-app/Dockerfile для rationale (compromise → root в контейнере
# = escalation surface на ноду). UID 10001 outside system+distro reserved.
RUN groupadd -r -g 10001 app && useradd -r -u 10001 -g app -s /sbin/nologin app
WORKDIR /app
COPY --from=build --chown=app:app /build/ordinis-read-api/target/*.jar /app/app.jar
USER app
EXPOSE 8081
ENTRYPOINT ["java", "-XX:+UseZGC", "-XX:MaxRAMPercentage=75", "-jar", "/app/app.jar"]
