# --- Build stage -----------------------------------------------------------
FROM maven:3.9-eclipse-temurin-21-alpine AS build
WORKDIR /build

COPY pom.xml ./
RUN mvn -B dependency:go-offline

COPY src ./src
RUN mvn -B clean package -DskipTests

# --- Runtime stage -----------------------------------------------------------
FROM eclipse-temurin:21-jre-alpine

# Run as a non-root, unprivileged user — a compromised JVM process should
# never have write access outside its own working directory.
RUN addgroup -S prudas && adduser -S prudas -G prudas
WORKDIR /app
COPY --from=build /build/target/*.jar app.jar
RUN chown -R prudas:prudas /app
USER prudas

EXPOSE 8080
ENV SPRING_PROFILES_ACTIVE=prod
ENV JAVA_OPTS=""

HEALTHCHECK --interval=30s --timeout=3s --start-period=40s --retries=3 \
  CMD wget -qO- http://localhost:8080/actuator/health || exit 1

ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -jar app.jar"]
