DockerFile

# ─── Build stage ─────────────────────────────────────────────
FROM maven:3.9.9-eclipse-temurin-21 AS build

WORKDIR /build

# Copy pom.xml first and download dependencies — this layer caches
# unless pom.xml changes, so subsequent code-only changes rebuild fast
COPY pom.xml .
RUN mvn dependency:go-offline -B

# Now copy source and build
COPY src ./src
RUN mvn clean package -DskipTests -B

# ─── Runtime stage ───────────────────────────────────────────
FROM eclipse-temurin:21-jre-alpine

WORKDIR /app

# Create a non-root user to run the app
RUN addgroup -S verifyhub && adduser -S verifyhub -G verifyhub

# Copy the built jar from the build stage
COPY --from=build /build/target/*.jar app.jar

# Create the storage directory and give ownership to non-root user
RUN mkdir -p /app/storage && chown -R verifyhub:verifyhub /app

USER verifyhub

EXPOSE 8080

# Startup probe — Spring Boot's default health endpoint (Actuator not enabled,
# but we return 401 on /api/* which is enough to prove it's alive)
HEALTHCHECK --interval=30s --timeout=5s --start-period=45s --retries=3 \
  CMD wget --quiet --tries=1 --spider http://localhost:8080/swagger-ui.html || exit 1

ENTRYPOINT ["java", "-jar", "app.jar"]