feat: deprecate embedded postgres ahead of v4

[dkrizan]

What

Two changes, both preparing for v4 dropping the bundled postgres from tolgee/tolgee:

1. Deprecation warning — the app logs a WARN on startup when it's actually running the bundled postgres, pointing at the external-database docs.
2. Internal slim image — Dockerfile.slim + the dockerSlim Gradle task. Not published. Built on demand by the EE image build and by the smoke test.

Why

In v4, tolgee/tolgee loses the embedded postgres. Self-hosters running the bundled database have to move to an external one before upgrading.

They can already do that today on the current image by setting postgres-autostart.enabled=false (this is what the external-database docs section has always described). So the warning gives them a full release cycle of notice, on every boot, for a migration that needs nothing new from us.

The slim image is deliberately not published: a public :slim tag would only advertise a name that goes obsolete the moment v4 makes it the default, and it buys users nothing they can't already do. It exists so the internal EE image can drop the postgres layers now.

Notes for review

• No behavior change for existing users beyond the log line. The default Dockerfile and the tolgee/tolgee tag are untouched.
• The warning is guarded on enabled=true and mode=EMBEDDED, so it stays silent for external-database setups and for Java + DOCKER autostart (that mode isn't going away).
• docker-slim-smoke boots the slim image against a postgres service and waits for /actuator/health.
• Docs: docs: warn that v4 removes the bundled postgres and document the migration documentation#1121 · EE image switch: tolgee/billing#274
• Revives feat: Optimize Dockerfile #3193 (stale). Thanks @transparentChange for the original work.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds a slim Docker image variant with Alpine Java 21, OpenTelemetry support, and health checks. Gradle tasks and release automation build and publish it, CI smoke-tests it against PostgreSQL, and startup logging warns when embedded PostgreSQL remains enabled.

Changes

Slim image and release flow

Layer / File(s)	Summary
Slim Dockerfile definition docker/app/Dockerfile.slim	Defines the Alpine Java 21 runtime, application files, required OpenTelemetry agent, startup entrypoint, and /actuator/health check.
Gradle build and publish tasks gradle/docker.gradle	Adds local and multi-platform slim image build tasks with OpenTelemetry configuration, cache support, and versioned or floating slim tags.
CI smoke test and release integration .github/workflows/test.yml, .github/workflows/release.yml	Builds and runs the slim image against PostgreSQL, polls health until UP, reports logs on failure, gates everything-passed, and publishes release and latest slim tags.
Embedded PostgreSQL warning backend/app/src/main/kotlin/io/tolgee/commandLineRunners/EmbeddedPostgresDeprecationCommandLineRunner.kt	Logs a warning when embedded PostgreSQL autostart is configured in EMBEDDED mode.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• tolgee/tolgee-platform#3411: Both changes modify the Gradle Docker publishing flow and related release workflow integration.

Suggested reviewers: jancizmar

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main theme: deprecating embedded PostgreSQL and steering users toward the new slim image path.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dkrizan/docker-slim-image

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (2)

gradle/docker.gradle (1)

95-123: Consider extracting shared publish logic to reduce duplication.

dockerPublishSlim is nearly identical to dockerPublish — the only differences are the tag mapping and the -f Dockerfile.slim flag. If a third variant is ever added, the duplication will compound. A small helper (e.g., a closure taking dockerfile and a tagResolver) would DRY this up without changing behavior.

♻️ Sketch

def buildxPublish = { String dockerfile, Closure<String> tagResolver ->
    def version = System.getenv('VERSION') ?: 'latest'
    def imageName = System.getenv('DOCKER_IMAGE') ?: 'tolgee/tolgee'
    def tag = tagResolver(imageName, version)
    def cacheFrom = System.getenv('DOCKER_CACHE_FROM')
    def cacheTo = System.getenv('DOCKER_CACHE_TO')

    def cmd = ["docker", "buildx", "build", "."]
    if (dockerfile) cmd += ["-f", dockerfile]
    cmd += ["-t", tag,
            "--build-arg", "OTEL_AGENT_VERSION=${opentelemetryJavaagentVersion}",
            "--platform", "linux/arm64,linux/amd64",
            "--push"]
    if (cacheFrom) cmd += ["--cache-from", cacheFrom]
    if (cacheTo)   cmd += ["--cache-to", cacheTo]

    exec { workingDir dockerPath; commandLine cmd }
}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@gradle/docker.gradle` around lines 95 - 123, dockerPublishSlim duplicates
dockerPublish; extract the shared logic into a reusable closure (e.g.,
buildxPublish) that accepts a dockerfile name and a tag-resolver closure, move
the environment reads (VERSION, DOCKER_IMAGE, DOCKER_CACHE_FROM,
DOCKER_CACHE_TO) and common args (buildx build, OTEL_AGENT_VERSION build-arg,
platforms, push) into that closure, then replace the dockerPublishSlim task body
to call buildxPublish("Dockerfile.slim", { imageName, version -> /* slim tag
logic */ }) and likewise call it from dockerPublish with the default Dockerfile
and tag resolver, preserving the existing tag mapping and cache-from/cache-to
handling.

docker/app/Dockerfile.slim (1)

34-35: Pin the OTEL agent JAR by checksum (optional hardening).

The agent JAR is fetched over HTTPS from GitHub Releases without integrity verification. A checksum check (the project publishes .sha256/.asc alongside the jar) protects the image build from upstream tampering or transient corruption. Same concern applies to the non-slim Dockerfile; feel free to track separately and apply uniformly.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@docker/app/Dockerfile.slim` around lines 34 - 35, The Dockerfile.slim RUN
step that downloads opentelemetry-javaagent.jar using OTEL_AGENT_VERSION must be
hardened by verifying the artifact checksum: fetch the corresponding .sha256 (or
.sha256sum/.asc) published alongside the jar (using the same
OTEL_AGENT_VERSION), validate the downloaded /app/opentelemetry-javaagent.jar
with sha256sum (or gpg verify if using .asc), and fail the build if the
verification fails; update the RUN instruction that does wget to also wget the
checksum (or signature) and perform the verification before keeping the jar, and
apply the same change to the non-slim Dockerfile equivalent so both images are
protected from tampered or corrupted releases.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@docker/app/Dockerfile.slim`:
- Around line 1-3: The Dockerfile runs as root by default; create and switch to
a non-root user (e.g., user name "tolgee") by adding a user/group creation step,
ensure ownership of runtime directories like /data is changed (chown) so the new
user can write, copy application files as that non-root user (or adjust
ownership after copy), and set USER tolgee before the ENTRYPOINT to run the
container non-root; update any steps that assume root accordingly.

---

Nitpick comments:
In `@docker/app/Dockerfile.slim`:
- Around line 34-35: The Dockerfile.slim RUN step that downloads
opentelemetry-javaagent.jar using OTEL_AGENT_VERSION must be hardened by
verifying the artifact checksum: fetch the corresponding .sha256 (or
.sha256sum/.asc) published alongside the jar (using the same
OTEL_AGENT_VERSION), validate the downloaded /app/opentelemetry-javaagent.jar
with sha256sum (or gpg verify if using .asc), and fail the build if the
verification fails; update the RUN instruction that does wget to also wget the
checksum (or signature) and perform the verification before keeping the jar, and
apply the same change to the non-slim Dockerfile equivalent so both images are
protected from tampered or corrupted releases.

In `@gradle/docker.gradle`:
- Around line 95-123: dockerPublishSlim duplicates dockerPublish; extract the
shared logic into a reusable closure (e.g., buildxPublish) that accepts a
dockerfile name and a tag-resolver closure, move the environment reads (VERSION,
DOCKER_IMAGE, DOCKER_CACHE_FROM, DOCKER_CACHE_TO) and common args (buildx build,
OTEL_AGENT_VERSION build-arg, platforms, push) into that closure, then replace
the dockerPublishSlim task body to call buildxPublish("Dockerfile.slim", {
imageName, version -> /* slim tag logic */ }) and likewise call it from
dockerPublish with the default Dockerfile and tag resolver, preserving the
existing tag mapping and cache-from/cache-to handling.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: bae4c2b4-b78c-46bb-821a-5f6e662feb93

📥 Commits

Reviewing files that changed from the base of the PR and between ff89c7b and 615ddf6.

📒 Files selected for processing (3)

• .github/workflows/release.yml
• docker/app/Dockerfile.slim
• gradle/docker.gradle

[github-actions]

This PR is stale because it has been open for 30 days with no activity.

[coderabbitai]

♻️ Duplicate comments (1)

docker/app/Dockerfile.slim (1)

1-3: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Run the slim image as non-root before startup.

This Dockerfile still defaults to root at runtime. Please create a dedicated user, fix ownership for /app and /data, and set USER before ENTRYPOINT.

Suggested patch

 FROM eclipse-temurin:21-jre-alpine
 
 RUN apk --no-cache add bash
+RUN addgroup -S tolgee \
+    && adduser -S -G tolgee tolgee \
+    && mkdir -p /app /data \
+    && chown -R tolgee:tolgee /app /data
@@
-COPY BOOT-INF/lib /app/lib
-COPY META-INF /app/META-INF
-COPY BOOT-INF/classes /app
-COPY --chmod=755 cmd.sh /app
+COPY --chown=tolgee:tolgee BOOT-INF/lib /app/lib
+COPY --chown=tolgee:tolgee META-INF /app/META-INF
+COPY --chown=tolgee:tolgee BOOT-INF/classes /app
+COPY --chown=tolgee:tolgee --chmod=755 cmd.sh /app
@@
 # Define the startup command
+USER tolgee
 ENTRYPOINT ["/app/cmd.sh"]

Also applies to: 13-13, 23-27, 41-42

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docker/app/Dockerfile.slim` around lines 1 - 3, Create a non-root runtime
user and ensure app directories are owned by it: add steps after the base image
and package install (FROM eclipse-temurin:21-jre-alpine and RUN apk --no-cache
add bash) to create a dedicated user/group (e.g., appuser), create or ensure
/app and /data exist, chown them to that user, and finally set USER appuser
before the ENTRYPOINT so the container runs non-root; apply the same pattern to
the other Dockerfile variants referenced (lines 13, 23-27, 41-42).

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In `@docker/app/Dockerfile.slim`:
- Around line 1-3: Create a non-root runtime user and ensure app directories are
owned by it: add steps after the base image and package install (FROM
eclipse-temurin:21-jre-alpine and RUN apk --no-cache add bash) to create a
dedicated user/group (e.g., appuser), create or ensure /app and /data exist,
chown them to that user, and finally set USER appuser before the ENTRYPOINT so
the container runs non-root; apply the same pattern to the other Dockerfile
variants referenced (lines 13, 23-27, 41-42).

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 12f35f0d-701b-4dfd-a25c-14ebe36dd39b

📥 Commits

Reviewing files that changed from the base of the PR and between 615ddf6 and 448a8be.

📒 Files selected for processing (2)

• .github/workflows/release.yml
• docker/app/Dockerfile.slim

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/release.yml

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/test.yml:
- Around line 545-548: Replace the fragile sed-based JSON parsing that sets the
status variable from the curl output with a jq-based extraction so the top-level
"status" is returned deterministically; change the command that assigns status
(the curl ... | sed ... pipeline) to use jq -r '.status' (or equivalent jq
expression) to pull the root status, preserving the existing loop and condition
that checks if "$status" = "UP".

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: fc708a9f-ada6-40ad-9741-a538ebaddd82

📥 Commits

Reviewing files that changed from the base of the PR and between 448a8be and 9e5051f.

📒 Files selected for processing (1)

• .github/workflows/test.yml

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/test.yml:
- Around line 499-503: The docker-slim-smoke job currently inherits default
GITHUB_TOKEN permissions; update the job definition for docker-slim-smoke to
declare explicit least-privilege permissions (e.g., add a permissions block with
contents: read) so the job only has read access to repository contents for
checkout/build/run and does not inherit broader default scopes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 29c59737-c937-41f0-a448-093000e83c80

📥 Commits

Reviewing files that changed from the base of the PR and between 448a8be and 52ecf79.

📒 Files selected for processing (1)

• .github/workflows/test.yml