# Multi-stage build для ordinis-projection-writer. См. ordinis-app/Dockerfile
# для rationale `COPY . ./` + `.dockerignore` подхода (single-rule,
# future-proof на новые Maven modules).
FROM repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21 AS build
WORKDIR /build
COPY . ./
RUN mvn -B -pl ordinis-projection-writer -am package -DskipTests

FROM repo.nstart.cloud/dockerhub/library/eclipse-temurin:21-jre
# Non-root user — security hardening (CSO report 2026-05-27 finding #1).
# См. ordinis-app/Dockerfile для rationale.
RUN groupadd -r -g 10001 app && useradd -r -u 10001 -g app -s /sbin/nologin app
WORKDIR /app
COPY --from=build --chown=app:app /build/ordinis-projection-writer/target/*.jar /app/app.jar
USER app
EXPOSE 8082
ENTRYPOINT ["java", "-XX:+UseZGC", "-XX:MaxRAMPercentage=75", "-jar", "/app/app.jar"]