Dockerfile.30.cache

# ============================================================
# Stage 1: Build Environment
# Purpose: Leverage BuildKit caching to accelerate Maven builds
# ============================================================
FROM maven:3.9.16-eclipse-temurin-25-noble AS stage-build

WORKDIR /app

# ------------------------------------------------------------
# Layer 1: Maven Wrapper and Project Metadata
# ------------------------------------------------------------
# Copying the wrapper and POM first allows Docker to cache the
# dependency resolution layer, skipping downloads if the project
# structure hasn't changed.
COPY .mvn/ .mvn/
COPY mvnw pom.xml ./
RUN chmod +x mvnw

# ------------------------------------------------------------
# Layer 2: Dependency Caching (BuildKit)
# ------------------------------------------------------------
# Using BuildKit's cache mount persists the local M2 repository
# across builds, significantly reducing network overhead.
RUN --mount=type=cache,target=/root/.m2 \
    ./mvnw --batch-mode dependency:go-offline

# ------------------------------------------------------------
# Layer 3: Application Build
# ------------------------------------------------------------
COPY src ./src

# Compile the project using the 'jvm' profile.
# The persistent cache ensures that even if sources change,
# dependencies do not need to be re-downloaded.
RUN --mount=type=cache,target=/root/.m2 \
    ./mvnw --batch-mode clean package -DskipTests -Pjvm


# ============================================================
# Stage 2: Runtime Environment
# ============================================================
# Using a JRE-only base image minimizes the attack surface
# and keeps the final image size optimized for production.
FROM eclipse-temurin:25-jre-noble

LABEL maintainer="Emmanuel Bruno <emmanuel.bruno@univ-tln.fr>"
LABEL description="Java Hello World Application - BuildKit cache optimized"

# Security: Create an unprivileged user/group to adhere to the principle of least privilege
RUN groupadd -r appgroup && useradd -r -g appgroup appuser && \
    mkdir -p /app && chown -R appuser:appgroup /app

# ------------------------------------------------------------
# Deployment: Copy artifacts from builder stage
# ------------------------------------------------------------
# We only copy the thin JAR and external dependencies required at runtime.
COPY --from=stage-build --chown=appuser:appgroup /app/target/libs /app/libs
COPY --from=stage-build --chown=appuser:appgroup /app/target/hello-world-*.jar /app/app.jar

USER appuser

# ------------------------------------------------------------
# Runtime Execution
# ------------------------------------------------------------
# Configure JVM container ergonomics. JAVA_TOOL_OPTIONS is parsed
# natively by the JVM, avoiding the need for shell script wrappers.
ENV JAVA_TOOL_OPTIONS="-XX:+UseContainerSupport -XX:MaxRAMPercentage=75.0"

# Execute the application. The JAR manifest is configured to
# resolve external dependencies from the /app/libs/ directory.
ENTRYPOINT ["java", "-jar", "/app/app.jar"]