Александр Зимин
19 lines
959 B
Docker
19 lines
959 B
Docker
# Multi-stage build для ordinis-read-api. См. ordinis-app/Dockerfile для
|
|
# rationale `COPY . ./` + `.dockerignore` подхода (single-rule, future-proof
|
|
# на новые Maven modules).
|
|
FROM repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21 AS build
|
|
WORKDIR /build
|
|
COPY . ./
|
|
RUN mvn -B -pl ordinis-read-api -am package -DskipTests
|
|
|
|
FROM repo.nstart.cloud/dockerhub/library/eclipse-temurin:21-jre
|
|
# Non-root user — security hardening (CSO report 2026-05-27 finding #1).
|
|
# См. ordinis-app/Dockerfile для rationale (compromise → root в контейнере
|
|
# = escalation surface на ноду). UID 10001 outside system+distro reserved.
|
|
RUN groupadd -r -g 10001 app && useradd -r -u 10001 -g app -s /sbin/nologin app
|
|
WORKDIR /app
|
|
COPY --from=build --chown=app:app /build/ordinis-read-api/target/*.jar /app/app.jar
|
|
USER app
|
|
EXPOSE 8081
|
|
ENTRYPOINT ["java", "-XX:+UseZGC", "-XX:MaxRAMPercentage=75", "-jar", "/app/app.jar"]
|