Dockerfile

# STAGE 1: Build & Compile (Isolated Build Environment)
FROM eclipse-temurin:21-jdk-alpine AS builder
WORKDIR /build

# Copy dependency files first to leverage Docker layer caching
COPY pom.xml .
RUN apk add --no-cache maven && mvn dependency:go-offline -B

# Copy source code and compile the artifact without running tests
COPY src ./src
RUN mvn clean package -DskipTests -Djava.net.preferIPv4Stack=true


# STAGE 2: Production Runtime (Security Image)
FROM eclipse-temurin:21-jre-alpine AS runtime
WORKDIR /app

# Create a non-root user for security practices
RUN addgroup -S dataguard && adduser -S dataguard -G dataguard
USER dataguard

# Copy only the compiled JAR from the build stage
COPY --from=builder /build/target/java-anonimo-engine-1.0-SNAPSHOT.jar ./dataguard-engine.jar

# Mount points for external data processing and license injection
VOLUME ["/data", "/etc/dataguard"]

# Default JVM performance options (G1GC and RAM limit awareness)
ENV JAVA_OPTS="-XX:+UseG1GC -XX:MaxRAMPercentage=75.0"

# Immutable entrypoint
ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -jar dataguard-engine.jar $0 $@"]
CMD ["--help"]