Public Access
lobo
9f56742ff6
A10 A11 A12 A13 A14 A15 X10 X11 X12: role check denies outside a request, no API versioning, open-in-view off, no passwords in toString, X-Forwarded-For only from private peers, CORS from APP_FRONTEND_URL, non-root image.
44 lines
1.3 KiB
Docker
44 lines
1.3 KiB
Docker
# ------------------------------------------------------------------
|
|
# STAGE 1: Build the application using Maven Wrapper
|
|
# ------------------------------------------------------------------
|
|
FROM eclipse-temurin:25-jdk-alpine AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy the Maven wrapper and pom.xml first to cache dependencies
|
|
COPY .mvn/ .mvn
|
|
COPY mvnw pom.xml ./
|
|
|
|
# Make the wrapper executable (just in case) and download dependencies
|
|
RUN chmod +x mvnw
|
|
RUN ./mvnw dependency:go-offline
|
|
|
|
# Copy the actual source code and build the application (skip tests in Docker,
|
|
# as they will be run by the Gitea Action before the build)
|
|
COPY src ./src
|
|
RUN ./mvnw clean package -DskipTests
|
|
|
|
# ------------------------------------------------------------------
|
|
# STAGE 2: Create the minimal runtime image
|
|
# ------------------------------------------------------------------
|
|
FROM eclipse-temurin:25-jre-alpine
|
|
|
|
WORKDIR /app
|
|
|
|
# Passed by the CI workflow; shown by GET /api/version
|
|
ARG GIT_SHA=dev
|
|
ARG BUILD_TIME=
|
|
ENV APP_BUILD_COMMIT=$GIT_SHA APP_BUILD_TIME=$BUILD_TIME
|
|
|
|
# Expose the port your Spring Boot app runs on
|
|
EXPOSE 8080
|
|
|
|
# Copy the compiled jar file from the builder stage
|
|
COPY --from=builder /app/target/*.jar app.jar
|
|
|
|
# No root in the container
|
|
RUN addgroup -S app && adduser -S app -G app
|
|
USER app
|
|
|
|
# Run the application
|
|
ENTRYPOINT ["java", "-jar", "app.jar"] |