Docker Configuration

# Used as a base image that other Spring Boot-based
# docker containers can be based off of.
#
# This is an official image with multi-platform support.
# OS is Ubuntu (at the time of writing, there is no multi-platform Alpine image)
# Importantly, this supports 'linux/amd64' and 'linux/arm64/v8'
# See https://hub.docker.com/_/eclipse-temurin
FROM eclipse-temurin:17.0.6_10-jre

VOLUME /tmp

# Expect all consumers of this image to copy their application files to this directory
RUN mkdir "/blc-app" && chown -R 1000:0 "/blc-app" && chmod -R g=u "/blc-app"

ADD ./supporting/run-app.sh run-app.sh
RUN chown 1000:0 "run-app.sh" && chmod ug+x "run-app.sh"

# NOTE - because we aim to be compatible with both OpenShift (runs as random UID) and standard
# Kubernetes, we cannot have any user-specific configuration in our Dockerfile.
# For compatibility with standard Kubernetes, we explicitly switch to a non-root UID. OpenShift
# will ignore these settings and run as an arbitrary UID in the root group.
USER 1000

# Use the 'exec form' of entrypoint to ensure signals like 'KILL' are forwarded to the running process.
# https://docs.docker.com/engine/reference/builder/#exec-form-entrypoint-example
ENTRYPOINT ["./run-app.sh"]

#!/bin/sh

# Used as the 'entrypoint' script in base images to start a Spring Boot application.

if [ "$DEBUG_PORT" ]; then
  export JAVA_OPTS="$JAVA_OPTS -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:$DEBUG_PORT"
fi

export JAVA_OPTS="$JAVA_OPTS -Djava.security.egd=file:/dev/./urandom --add-opens=jdk.management/com.sun.management.internal=ALL-UNNAMED --add-opens=java.base/jdk.internal.misc=ALL-UNNAMED --add-opens=java.base/sun.nio.ch=ALL-UNNAMED --add-opens=java.management/com.sun.jmx.mbeanserver=ALL-UNNAMED --add-opens=jdk.internal.jvmstat/sun.jvmstat.monitor=ALL-UNNAMED --add-opens=java.base/sun.reflect.generics.reflectiveObjects=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/java.nio=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.reflect=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --add-opens=java.base/java.time.format=ALL-UNNAMED"

# Expect the actual application files to be in this directory. Default is '/blc-app', which
# the base image Dockerfiles create. However, if the final image defines it in a separate location,
# they can override the default via this 'ENTRYPOINT_BLC_APP_DIRECTORY' environment variable.
if [ -z "$ENTRYPOINT_BLC_APP_DIRECTORY" ]; then
  echo "ENTRYPOINT_BLC_APP_DIRECTORY was not explicitly provided, using default as launch location: '/blc-app'"
  export ENTRYPOINT_BLC_APP_DIRECTORY="/blc-app"
else
  echo "ENTRYPOINT_BLC_APP_DIRECTORY was explicitly provided, using it as launch location: '$ENTRYPOINT_BLC_APP_DIRECTORY'"
fi
cd "$ENTRYPOINT_BLC_APP_DIRECTORY" || exit 1

# The container will be running either in standard Kubernetes as a consistent user
# (ex: UID 1000), or in OpenShift as a random UID under the root group.
#
# While volume mount configuration is responsible for basic ownership and permission settings, it
# does not guarantee equal file access by all containers, particularly for files _created_ by the
# containers. The default 'umask' setting on many distributions is '022', which grants the owner
# user 'read'/'write', but only grants the owner group 'read'. This would be problematic in OpenShift,
# where the UID is not consistent and only the GID is. We need to ensure that if a container with
# UID 1 creates a file, a container with UID 2 will be able to have the same access ('read'/'write')
# to that file.
#
# By overriding the umask of the entrypoint process to a sensible default of '002', the owner user
# and group will both be given equivalent 'read'/'write' access to the files (and
# 'read'/'write'/'search' on directories). This ensures all files created by the running application
# will be equally accessible by other instances of the application (when targeting a shared volume),
# even when their UIDs differ.
if [ "$DISABLE_ENTRYPOINT_UMASK_OVERRIDE" ]; then
  echo "DISABLE_ENTRYPOINT_UMASK_OVERRIDE was set, so not adjusting umask configuration"
else
  echo "DISABLE_ENTRYPOINT_UMASK_OVERRIDE was not set, so setting umask configuration to '0002'"
  umask 0002
  printf "umask is now '%s'\n" "$(umask)"
fi

# Moved into a shell script because the above 'export' statements cannot be retrieved
# between multiple statements in a Dockerfile
echo "Starting Java with the arguments '$JAVA_OPTS'"

# Use 'exec' to ensure the running process responds to signals like 'KILL'
#
# This command assumes the image will _not_ use a Spring Boot fat JAR and will instead
# run something like 'java -Djarmode=layertools -jar app.jar extract' to pre-explode the JAR
# contents and copy them directly.
exec java $JAVA_OPTS org.springframework.boot.loader.JarLauncher

# Application should have been built as a layered JAR, get the path to it in JAR_FILE
FROM eclipse-temurin:17.0.6_10-jdk as builder
ARG JAR_FILE
ADD ${JAR_FILE} app.jar
RUN java -Djarmode=layertools -jar app.jar extract

# Grant the group the same permissions as the owner user for consistency
# Note that we do this permission change in the builder image to avoid creating large intermediary
# layers in the final runner image.
#
# Note - for the most part, the COPY command below will honor the permissions set for these files in the builder
# image. However, for any leading directories Docker has to create itself, permissions will match
# the default umask for Docker, which is not configurable at the time of writing.
# This is technically not an issue in most cases, since read access is always available and write
# access to these directories is almost never necessary
RUN chmod -R g=u "dependencies/"
RUN chmod -R g=u "spring-boot-loader/"
RUN chmod -R g=u "snapshot-dependencies/"
RUN chmod -R g=u "application/"

# Base image reference
FROM ${YOUR_BASE_IMAGE}

# The base image assumes 1000 UID for standard Kubernetes, and an arbitrary UID + root group (0)
# for OpenShift. Thus, grant both of those ownership here.
# Also, move the application files into the "/blc-app" directory (defined by the base image and used
# by the entrypoint script).
COPY --chown=1000:0 --from=builder dependencies/ /blc-app
COPY --chown=1000:0 --from=builder spring-boot-loader/ /blc-app
COPY --chown=1000:0 --from=builder snapshot-dependencies/ /blc-app
COPY --chown=1000:0 --from=builder application/ /blc-app

# ... expose any ports, etc