# 使用官方OpenJDK運(yùn)行時(shí)作為父鏡像
FROM openjdk:17-jdk-slim


# 設(shè)置維護(hù)者信息
LABEL maintainer="tech-team@company.com"
LABEL versinotallow="1.0"
LABEL descriptinotallow="SpringBoot Application Docker Image"


# 設(shè)置時(shí)區(qū)
RUN ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime


# 創(chuàng)建應(yīng)用目錄
WORKDIR /app


# 將JAR文件復(fù)制到容器中
COPY target/my-application-*.jar app.jar


# 創(chuàng)建非root用戶運(yùn)行應(yīng)用（安全最佳實(shí)踐）
RUN groupadd -r springboot && useradd -r -g springboot springboot
RUN chown -R springboot:springboot /app
USER springboot


# 暴露端口
EXPOSE 8080


# 配置JVM參數(shù)
ENV JAVA_OPTS="-Xmx512m -Xms256m -XX:+UseG1GC -Djava.security.egd=file:/dev/./urandom"


# 配置健康檢查
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD curl -f http://localhost:8080/actuator/health || exit 1


# 啟動(dòng)應(yīng)用
ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -jar app.jar"]

# 第一階段：構(gòu)建階段
FROM maven:3.8.6-openjdk-17 AS builder


# 設(shè)置工作目錄
WORKDIR /build


# 復(fù)制POM文件（利用Docker緩存層）
COPY pom.xml .


# 下載依賴（如果pom.xml未改變，可以復(fù)用這一層）
RUN mvn dependency:go-offline


# 復(fù)制源代碼
COPY src ./src


# 構(gòu)建應(yīng)用
RUN mvn clean package -DskipTests


# 第二階段：運(yùn)行階段
FROM openjdk:17-jdk-slim


# 安裝必要的系統(tǒng)工具（用于調(diào)試和監(jiān)控）
RUN apt-get update && apt-get install -y \
    curl \
    vim \
    && rm -rf /var/lib/apt/lists/*


WORKDIR /app


# 從構(gòu)建階段復(fù)制JAR文件
COPY --from=builder /build/target/my-application-*.jar app.jar


# 復(fù)制啟動(dòng)腳本
COPY docker/startup.sh /app/startup.sh
RUN chmod +x /app/startup.sh


# 創(chuàng)建應(yīng)用用戶
RUN groupadd -r appuser && useradd -r -g appuser appuser
RUN chown -R appuser:appuser /app
USER appuser


# 健康檢查
HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
    CMD curl -f http://localhost:8080/health || exit 1


# 使用啟動(dòng)腳本（可以處理環(huán)境變量等復(fù)雜邏輯）
ENTRYPOINT ["/app/startup.sh"]

#!/bin/bash
# startup.sh


set -e


echo "Starting SpringBoot Application..."


# 設(shè)置默認(rèn)JVM參數(shù)
DEFAULT_JAVA_OPTS="-Xmx512m -Xms256m -XX:+UseG1GC -Djava.security.egd=file:/dev/./urandom"


# 如果設(shè)置了環(huán)境變量，則使用環(huán)境變量的值
JAVA_OPTS=${JAVA_OPTS:-$DEFAULT_JAVA_OPTS}


# 應(yīng)用配置文件處理
if [ -n "$SPRING_PROFILES_ACTIVE" ]; then
    JAVA_OPTS="$JAVA_OPTS -Dspring.profiles.active=$SPRING_PROFILES_ACTIVE"
fi


# 日志配置
if [ -n "$LOG_LEVEL" ]; then
    JAVA_OPTS="$JAVA_OPTS -Dlogging.level.com.yourcompany=$LOG_LEVEL"
fi


# 遠(yuǎn)程調(diào)試支持
if [ "$DEBUG" = "true" ]; then
    JAVA_OPTS="$JAVA_OPTS -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005"
fi


echo "JAVA_OPTS: $JAVA_OPTS"


# 啟動(dòng)應(yīng)用
exec java $JAVA_OPTS -jar app.jar "$@"

<build>
    <plugins>
        <plugin>
            <groupId>com.spotify</groupId>
            <artifactId>dockerfile-maven-plugin</artifactId>
            <version>1.4.13</version>
            <configuration>
                <repository>${docker.image.prefix}/${project.artifactId}</repository>
                <tag>${project.version}</tag>
                <buildArgs>
                    <JAR_FILE>target/${project.build.finalName}.jar</JAR_FILE>
                </buildArgs>
            </configuration>
            <executions>
                <execution>
                    <id>default</id>
                    <goals>
                        <goal>build</goal>
                    </goals>
                </execution>
                <execution>
                    <id>push</id>
                    <goals>
                        <goal>push</goal>
                    </goals>
                    <configuration>
                        <tag>latest</tag>
                    </configuration>
                </execution>
            </executions>
        </plugin>


        <plugin>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-maven-plugin</artifactId>
            <configuration>
                <excludes>
                    <exclude>
                        <groupId>org.projectlombok</groupId>
                        <artifactId>lombok</artifactId>
                    </exclude>
                </excludes>
            </configuration>
        </plugin>
    </plugins>
</build>


<properties>
    <docker.image.prefix>yourcompany</docker.image.prefix>
</properties>

<plugin>
    <groupId>com.google.cloud.tools</groupId>
    <artifactId>jib-maven-plugin</artifactId>
    <version>3.3.1</version>
    <configuration>
        <from>
            <image>openjdk:17-jdk-slim</image>
        </from>
        <to>
            <image>${docker.image.prefix}/${project.artifactId}:${project.version}</image>
        </to>
        <container>
            <entrypoint>
                <shell>bash</shell>
                <option>-c</option>
                <arg>chmod +x /entrypoint.sh && /entrypoint.sh</arg>
            </entrypoint>
            <ports>
                <port>8080</port>
            </ports>
            <environment>
                <SPRING_PROFILES_ACTIVE>docker</SPRING_PROFILES_ACTIVE>
            </environment>
            <creationTime>USE_CURRENT_TIMESTAMP</creationTime>
        </container>
    </configuration>
    <executions>
        <execution>
            <phase>package</phase>
            <goals>
                <goal>build</goal>
            </goals>
        </execution>
    </executions>
</plugin>

# docker-compose.yml
version: '3.8'


services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
    image: yourcompany/springboot-app:${TAG:-latest}
    environment:
      - SPRING_PROFILES_ACTIVE=${PROFILE:-docker}
      - JAVA_OPTS=-Xmx512m -Xms256m
      - DB_URL=jdbc:mysql://mysql:3306/app
      - DB_USERNAME=appuser
      - DB_PASSWORD=${DB_PASSWORD}
    ports:
      - "8080:8080"
    depends_on:
      - mysql
      - redis
    networks:
      - app-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/actuator/health"]
      interval: 30s
      timeout: 10s
      retries: 3


  mysql:
    image: mysql:8.0
    environment:
      - MYSQL_ROOT_PASSWORD=${DB_ROOT_PASSWORD}
      - MYSQL_DATABASE=app
      - MYSQL_USER=appuser
      - MYSQL_PASSWORD=${DB_PASSWORD}
    volumes:
      - mysql_data:/var/lib/mysql
    networks:
      - app-network


  redis:
    image: redis:7-alpine
    command: redis-server --appendonly yes
    volumes:
      - redis_data:/data
    networks:
      - app-network


volumes:
  mysql_data:
  redis_data:


networks:
  app-network:
    driver: bridge

# docker-compose.prod.yml
version: '3.8'


services:
  app:
    deploy:
      replicas: 3
      resources:
        limits:
          memory: 1G
          cpus: '0.5'
        reservations:
          memory: 512M
          cpus: '0.25'
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    environment:
      - SPRING_PROFILES_ACTIVE=prod
      - JAVA_OPTS=-Xmx1g -Xms512m -XX:+UseG1GC


  mysql:
    deploy:
      resources:
        limits:
          memory: 2G
    command: 
      - --innodb_buffer_pool_size=1G
      - --innodb_log_file_size=256M

# 安全加固版Dockerfile
FROM openjdk:17-jdk-slim AS runtime


# 安全掃描（在CI/CD中執(zhí)行）
# RUN apt-get update && apt-get install -y clamav && freshclam && clamscan /


# 最小化權(quán)限原則
RUN groupadd -g 1000 appuser && \
    useradd -r -u 1000 -g appuser appuser && \
    mkdir -p /app && \
    chown -R appuser:appuser /app


WORKDIR /app


# 復(fù)制JAR文件
COPY --chown=appuser:appuser target/app.jar app.jar


# 設(shè)置不可執(zhí)行權(quán)限（安全最佳實(shí)踐）
RUN chmod 644 app.jar


# 切換到非root用戶
USER appuser


# 安全相關(guān)的JVM參數(shù)
ENV JAVA_OPTS="-XX:+UseContainerSupport \
-XX:MaxRAMPercentage=75.0 \
-XX:+UseG1GC \
-XX:MaxGCPauseMillis=200 \
-XX:InitiatingHeapOccupancyPercent=35 \
-XX:+ExplicitGCInvokesConcurrent \
-Djava.security.egd=file:/dev/./urandom \
-Djava.awt.headless=true \
-Dfile.encoding=UTF-8"


# 使用非特權(quán)端口（雖然我們?cè)趦?nèi)部使用8080，但映射時(shí)可以改變）
EXPOSE 8080


# 健康檢查（使用應(yīng)用內(nèi)嵌的健康端點(diǎn)）
HEALTHCHECK --interval=30s --timeout=3s --start-period=60s --retries=3 \
    CMD curl -f http://localhost:8080/actuator/health || exit 1


ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar app.jar"]

# 多階段構(gòu)建 + 鏡像優(yōu)化
FROM maven:3.8.6-openjdk-17 AS build


WORKDIR /workspace/app
COPY pom.xml .
COPY src src


# 優(yōu)化Maven構(gòu)建緩存
RUN mvn dependency:go-offline -B
RUN mvn package -DskipTests -Dmaven.test.skip=true


# 使用Distroless鏡像作為運(yùn)行環(huán)境（極簡(jiǎn)安全）
FROM gcr.io/distroless/java17-debian11


# 或者使用官方slim鏡像（平衡大小和功能）
# FROM openjdk:17-jdk-slim


WORKDIR /app


# 從構(gòu)建階段復(fù)制JAR文件
COPY --from=build /workspace/app/target/*.jar app.jar


# 使用非root用戶
USER nonroot:nonroot


EXPOSE 8080


ENTRYPOINT ["java", "-jar", "/app.jar"]

#!/bin/bash
# build-and-deploy.sh


set -e


# 配置變量
APP_NAME="springboot-app"
VERSION=${1:-"latest"}
ENVIRONMENT=${2:-"dev"}
REGISTRY="your-registry.com"


echo "Building $APP_NAME version $VERSION for $ENVIRONMENT"


# 步驟1: 運(yùn)行測(cè)試
echo "Running tests..."
mvn clean test


# 步驟2: 構(gòu)建JAR
echo "Building application..."
mvn clean package -DskipTests


# 步驟3: 構(gòu)建Docker鏡像
echo "Building Docker image..."
docker build -t $REGISTRY/$APP_NAME:$VERSION .


# 步驟4: 安全掃描（可選）
echo "Running security scan..."
docker scan $REGISTRY/$APP_NAME:$VERSION


# 步驟5: 推送到鏡像倉(cāng)庫(kù)
echo "Pushing to registry..."
docker push $REGISTRY/$APP_NAME:$VERSION


# 步驟6: 部署到環(huán)境
echo "Deploying to $ENVIRONMENT..."
export TAG=$VERSION
export PROFILE=$ENVIRONMENT


docker-compose -f docker-compose.yml -f docker-compose.$ENVIRONMENT.yml up -d


echo "Deployment completed successfully!"

# k8s/deployment.yml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: springboot-app
  labels:
    app: springboot-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: springboot-app
  template:
    metadata:
      labels:
        app: springboot-app
    spec:
      containers:
      - name: app
        image: your-registry.com/springboot-app:latest
        ports:
        - containerPort: 8080
        env:
        - name: SPRING_PROFILES_ACTIVE
          value: "kubernetes"
        - name: JAVA_OPTS
          value: "-Xmx512m -Xms256m"
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        livenessProbe:
          httpGet:
            path: /actuator/health
            port: 8080
          initialDelaySeconds: 60
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /actuator/health
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 5
---
apiVersion: v1
kind: Service
metadata:
  name: springboot-service
spec:
  selector:
    app: springboot-app
  ports:
  - port: 80
    targetPort: 8080
  type: LoadBalancer

logging:
  level:
    com.yourcompany: INFO
  file:
    name: /app/logs/application.log
  pattern:
    console: "%d{yyyy-MM-dd HH:mm:ss} - %logger{36} - %msg%n"
  logback:
    rollingpolicy:
      max-file-size: 10MB
      max-history: 30

@RestController
public class HealthController {


    @GetMapping("/actuator/health")
    public ResponseEntity<Health> health() {
        Health health = Health.up()
            .withDetail("timestamp", Instant.now())
            .withDetail("version", "1.0.0")
            .build();


        return ResponseEntity.ok(health);
    }


    @GetMapping("/actuator/info")
    public ResponseEntity<Map<String, String>> info() {
        Map<String, String> info = Map.of(
            "name", "SpringBoot Application",
            "version", "1.0.0",
            "environment", System.getenv("SPRING_PROFILES_ACTIVE")
        );


        return ResponseEntity.ok(info);
    }
}