Dockerfile

# ── Stage 1: Build ────────────────────────────────────────────────────────────
FROM maven:3.9.6-eclipse-temurin-21-alpine AS builder
WORKDIR /app
# Cache Maven dependencies separately from source code
# This layer only rebuilds when pom.xml changes — not on every code change
COPY pom.xml .
RUN mvn dependency:go-offline -B
COPY src ./src
RUN mvn clean package -DskipTests -B

# ── Stage 2: Runtime ──────────────────────────────────────────────────────────
FROM eclipse-temurin:21-jre-alpine

# WHY NON-ROOT USER:
# Running as root in a container is a security risk — if the container is
# compromised, the attacker has root access to the host. Non-root user
# limits the blast radius.
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser

WORKDIR /app
COPY --from=builder /app/target/*.jar app.jar

EXPOSE 8080

# WHY THESE JVM FLAGS:
# -XX:+UseContainerSupport: Makes JVM respect cgroup memory limits (Docker)
#   Without this, JVM reads host memory and allocates too much heap
# -XX:MaxRAMPercentage=75.0: Use 75% of container memory for heap
# -XX:+UseG1GC: G1 is the best GC for low-latency services (fintech needs this)
# -Djava.security.egd: Faster startup by using /dev/urandom for entropy
ENV JAVA_OPTS="-Xms256m \
  -XX:+UseContainerSupport \
  -XX:MaxRAMPercentage=75.0 \
  -XX:+UseG1GC \
  -XX:MaxGCPauseMillis=100 \
  -Djava.security.egd=file:/dev/./urandom"

ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -jar app.jar"]