Dockerfile.40.manual

# ============================================================
# Stage 1: Build Environment (Manual SDKMAN Toolchain)
# Purpose: Demonstrate manual environment provisioning and
#          fixed-UID/GID file ownership for high-security CI.
# ============================================================
FROM ubuntu:noble AS stage-build

# Toolchain versioning for reproducible builds
ARG JAVA_VERSION="25.0.3-tem"
ARG MAVEN_VERSION="3.9.16"
ARG BUILDER_UID=2000
ARG BUILDER_GID=2000

LABEL maintainer="Emmanuel Bruno <emmanuel.bruno@univ-tln.fr>"
LABEL description="Java Hello World Application - SDKMAN build"

# ------------------------------------------------------------
# OS Layer: Provision essential tools for SDKMAN
# ------------------------------------------------------------
RUN apt-get update && \
    apt-get install --yes --quiet --no-install-recommends \
      ca-certificates curl unzip zip bash && \
    rm -rf /var/lib/apt/lists/*

# ------------------------------------------------------------
# Security: Create dedicated builder user with deterministic UID/GID
# ------------------------------------------------------------
RUN groupadd -g ${BUILDER_GID} builder \
    && useradd -m -u ${BUILDER_UID} -g builder -s /bin/bash builder

USER builder
ENV HOME=/home/builder
ENV SDKMAN_DIR="$HOME/.sdkman"
ENV PATH="$SDKMAN_DIR/bin:$SDKMAN_DIR/candidates/java/current/bin:$SDKMAN_DIR/candidates/maven/current/bin:$PATH"

SHELL ["/bin/bash", "-c"]

# ------------------------------------------------------------
# Provisioning: Install Java/Maven via SDKMAN
# ------------------------------------------------------------
RUN curl -s "https://get.sdkman.io" | bash && \
    source "$SDKMAN_DIR/bin/sdkman-init.sh" && \
    sdk install java "$JAVA_VERSION" && \
    sdk install maven "$MAVEN_VERSION" && \
    rm -rf "$SDKMAN_DIR/archives/*" "$SDKMAN_DIR/tmp/*"

WORKDIR /app

# ------------------------------------------------------------
# Layer: Dependency Resolution (BuildKit Cached)
# ------------------------------------------------------------
COPY --chown=builder:builder mvnw ./
COPY --chown=builder:builder .mvn .mvn
COPY --chown=builder:builder pom.xml ./

RUN --mount=type=cache,target=/home/builder/.m2,uid=${BUILDER_UID},gid=${BUILDER_GID} \
    source "$SDKMAN_DIR/bin/sdkman-init.sh" && \
    ./mvnw --batch-mode dependency:resolve

# ------------------------------------------------------------
# Layer: Build
# ------------------------------------------------------------
COPY --chown=builder:builder src ./src

RUN --mount=type=cache,target=/home/builder/.m2,uid=${BUILDER_UID},gid=${BUILDER_GID} \
    source "$SDKMAN_DIR/bin/sdkman-init.sh" && \
    ./mvnw --batch-mode -Pjvm -DskipTests clean verify

# ============================================================
# Stage 2: Runtime Environment
# ============================================================
# Distribute using a slim JRE-only image. Note: We do not require
# the UID to match the builder; we only need a non-root user.
FROM eclipse-temurin:25-jre-noble AS stage-runtime

LABEL maintainer="Emmanuel Bruno <emmanuel.bruno@univ-tln.fr>"
LABEL description="Java Hello World Application - multi-stage runtime"

RUN groupadd -r appgroup && useradd -r -g appgroup appuser && \
    mkdir -p /app && chown -R appuser:appgroup /app

# Deploy minimal runtime artifacts from the build stage
COPY --from=stage-build --chown=appuser:appgroup /app/target/hello-world-*-SNAPSHOT.jar /app/app.jar
COPY --from=stage-build --chown=appuser:appgroup /app/target/libs /app/libs

USER appuser
ENV HOME=/home/appuser

# JVM Container Ergonomics: JAVA_TOOL_OPTIONS is natively parsed by the
# JVM, enabling container-aware resource management.
ENV JAVA_TOOL_OPTIONS="-XX:+UseContainerSupport -XX:MaxRAMPercentage=75.0"

ENTRYPOINT ["java", "-jar", "/app/app.jar"]