Dockerfile

# Build stage (always target linux/amd64 for production servers)
FROM --platform=linux/amd64 eclipse-temurin:17-jdk-alpine AS builder
WORKDIR /app

# Install bash for gradlew
RUN apk add --no-cache bash

# Jmix premium repository credentials (user is not sensitive, pass comes from secret)
ARG JMIX_PREMIUM_USER

# Copy gradle wrapper and config first (better caching)
COPY gradle gradle
COPY gradlew build.gradle settings.gradle gradle.properties ./
RUN chmod +x gradlew

# Download dependencies (cached layer) - using secret mount for password
RUN --mount=type=cache,target=/root/.gradle \
    --mount=type=secret,id=JMIX_PREMIUM_PASS \
    JMIX_PASS=$(cat /run/secrets/JMIX_PREMIUM_PASS) && \
    ./gradlew dependencies --no-daemon \
    -PpremiumRepoUser=${JMIX_PREMIUM_USER} \
    -PpremiumRepoPass="$JMIX_PASS" || true

# Copy source code
COPY src src
COPY frontend frontend
COPY package.json pnpm-lock.yaml* ./

# Build the application with cached Gradle - using secret mount for password
RUN --mount=type=cache,target=/root/.gradle \
    --mount=type=cache,target=/app/.gradle \
    --mount=type=cache,target=/app/frontend/node_modules \
    --mount=type=secret,id=JMIX_PREMIUM_PASS \
    JMIX_PASS=$(cat /run/secrets/JMIX_PREMIUM_PASS) && \
    ./gradlew build -x test --no-daemon -Pvaadin.productionMode=true \
    -PpremiumRepoUser=${JMIX_PREMIUM_USER} \
    -PpremiumRepoPass="$JMIX_PASS"

# Runtime stage
FROM --platform=linux/amd64 eclipse-temurin:17-jre-alpine
WORKDIR /app

# Labels for OCI metadata
LABEL service="stablemanager" \
      maintainer="torbenmerrald"

# Create non-root user (Alpine syntax)
RUN addgroup -g 1000 appgroup && \
    adduser -u 1000 -G appgroup -D appuser

# Copy the built jar
COPY --from=builder /app/build/libs/*.jar app.jar

# Set ownership
RUN chown -R appuser:appgroup /app
USER appuser

# Expose port
EXPOSE 8080

# Health check (using wget, available in Alpine)
HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
    CMD wget -q --spider http://localhost:8080/ || exit 1

# Container-aware JVM configuration
# Note: Quartz PostgreSQL delegate must be set here because env var binding doesn't work correctly
ENTRYPOINT ["java", \
    "-XX:+UseContainerSupport", \
    "-XX:MaxRAMPercentage=75.0", \
    "-XX:InitialRAMPercentage=50.0", \
    "-XX:+UseG1GC", \
    "-XX:+UseStringDeduplication", \
    "-Djava.security.egd=file:/dev/./urandom", \
    "-Dspring.quartz.properties.org.quartz.jobStore.driverDelegateClass=org.quartz.impl.jdbcjobstore.PostgreSQLDelegate", \
    "-jar", "app.jar"]