platform-java/Dockerfile.alpine at main · FlossWare/platform-java · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
# Multi-stage build for platform-java Alpine variant
# Lightweight image using Alpine Linux - optimized for minimal footprint

# Build stage
FROM maven:3.9-eclipse-temurin-21 AS builder

WORKDIR /build

# Copy the entire project source (filtered by .dockerignore)
COPY . .

# Build the project with minimal output, skipping tests and quality checks
# -DskipTests: skip test execution
# -Dcheckstyle.skip: skip checkstyle validation
# -Dspotless.check.skip: skip spotless format check
# -Ddependency-check.skip: skip OWASP dependency-check (requires NVD API key)
RUN mvn clean install -DskipTests \
    -Dcheckstyle.skip=true \
    -Dspotless.check.skip=true \
    -Ddependency-check.skip=true \
    -q && \
    ls -lh platform-launcher/target/*.jar

# Runtime stage - Alpine-based platform image (lightweight)
FROM eclipse-temurin:21-jre-alpine

LABEL org.opencontainers.image.title="Platform-Java (Alpine)"
LABEL org.opencontainers.image.description="Java Application Platform - Alpine variant for minimal footprint"
LABEL org.opencontainers.image.version="1.1"
LABEL org.opencontainers.image.vendor="FlossWare"
LABEL org.opencontainers.image.url="https://github.com/FlossWare/platform-java"
LABEL org.opencontainers.image.documentation="https://github.com/FlossWare/platform-java/blob/main/README.md"
LABEL org.opencontainers.image.source="https://github.com/FlossWare/platform-java"
LABEL maintainer="FlossWare <info@flossware.org>"

# Install minimal required packages (curl for health checks, ca-certificates for HTTPS)
RUN apk add --no-cache \
    curl \
    ca-certificates && \
    rm -rf /var/cache/apk/*

# Create non-root user for running the platform (security best practice)
RUN addgroup -g 1000 platform && \
    adduser -D -u 1000 -G platform -s /bin/sh platform

# Create app directory with proper permissions
WORKDIR /app
RUN mkdir -p /app/config /app/apps /app/logs && \
    chown -R platform:platform /app && \
    chmod 755 /app/config /app/apps /app/logs

# Copy the launcher JAR from builder
COPY --from=builder --chown=platform:platform /build/platform-launcher/target/platform-java-launcher-*.jar /app/platform-java.jar

# Copy entrypoint script
COPY --chown=platform:platform docker-entrypoint.sh /app/docker-entrypoint.sh
RUN chmod +x /app/docker-entrypoint.sh

# Create default platform configuration (owned by platform user)
RUN cat > /app/config/platform.yaml.example << 'EOF'
api:
  enabled: true
  port: 8080
  bind-address: 0.0.0.0
  auth-enabled: true

metrics:
  jmx:
    enabled: false
    port: 9999
  prometheus:
    enabled: false
    port: 9090
  opentelemetry:
    enabled: false
    endpoint: "http://localhost:4317"

watcher:
  enabled: true
  watch-directory: "/app/apps"
  auto-start: true
  auto-deploy: true

logging:
  level: INFO
  format: json
EOF

# Switch to non-root user
USER platform

# Environment variables for platform configuration (smaller heap for Alpine)
ENV JAVA_OPTS="-Xms256m -Xmx512m -XX:+UseG1GC -XX:MaxGCPauseMillis=200"
ENV PLATFORM_CONFIG=/app/config/platform.yaml
ENV PLATFORM_APPS_DIR=/app/apps
ENV PLATFORM_LOGS_DIR=/app/logs

# Expose ports
# 8080: REST API and Web Console
# 9090: Prometheus metrics
# 9999: JMX metrics
EXPOSE 8080 9090 9999

# Health check: test REST API availability
HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
    CMD curl -f http://localhost:8080/api/health || exit 1

# Use entrypoint script that correctly passes JAVA_OPTS to the JVM
ENTRYPOINT ["/app/docker-entrypoint.sh"]