docker/runtime-base/Dockerfile

# BellSoft Liberica JRE 21 on Alpaquita Linux (glibc, minimal, 199 MB).
# Pin by digest in production overlays.
FROM bellsoft/liberica-runtime-container:jre-21-slim-glibc

WORKDIR /app

# Agent is baked in; log appender is embedded in cameleer-core.
# Tenant JAR is delivered at deploy time by cameleer-runtime-loader
# into the RO-mounted /app/jars volume.
COPY agent.jar /app/agent.jar

# No ENTRYPOINT here. cameleer-server's DeploymentExecutor builds the
# per-runtime-type entrypoint (spring-boot/quarkus: -jar; plain-java:
# -cp + main; native: exec) and overrides via withCmd("sh","-c",...).
# Setting one here only creates drift between this image and the actual
# runtime command.
USER nobody
fix: swap Chainguard JRE to BellSoft Liberica JRE 21 Chainguard free tier only offers :latest (currently JDK 26, unpinned); the :openjdk-21 tag requires a paid subscription, breaking CI. Switch both Dockerfiles to bellsoft/liberica-runtime-container:jre-21-slim-glibc: - Pinned to JDK 21 LTS - Smallest image (199 MB vs 441/491 MB) - glibc-based Alpaquita Linux, sh-only (no bash, no pkg manager) - Free, multi-arch (amd64 + arm64) - Has sh — required by cameleer-server's DeploymentExecutor (withCmd "sh -c") Use nobody:nobody (65534) instead of Chainguard's nonroot (65532). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> 2026-04-28 16:52:55 +02:00			`# BellSoft Liberica JRE 21 on Alpaquita Linux (glibc, minimal, 199 MB).`
			`# Pin by digest in production overlays.`
			`FROM bellsoft/liberica-runtime-container:jre-21-slim-glibc`
harden: swap runtime base to Chainguard JRE, remove dead ENTRYPOINT Replace eclipse-temurin:21-jre-alpine (musl) with cgr.dev/chainguard/jre:openjdk-21 (Wolfi/glibc, daily CVE refresh, signed images + SBOM). Remove the dead ENTRYPOINT block — DeploymentExecutor overrides it at container creation anyway. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> 2026-04-28 09:32:49 +02:00
feat: update Docker Compose, CI, and add runtime-base Dockerfile Add jardata volume, CAMELEER_AUTH_TOKEN/CAMELEER3_SERVER_ENDPOINT/CLICKHOUSE_URL env vars to cameleer-saas, CAMELEER_AUTH_TOKEN to cameleer3-server, runtime-base Dockerfile for agent-instrumented customer apps, and expand CI surefire excludes for new integration test classes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-04-04 18:04:42 +02:00			`WORKDIR /app`

fix(ci): remove log-appender from runtime base image The log appender is now embedded in cameleer-core, so it no longer needs to be downloaded separately and baked into the runtime base image. Removes the Maven download step and the Dockerfile COPY. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> 2026-04-28 18:56:29 +02:00			`# Agent is baked in; log appender is embedded in cameleer-core.`
			`# Tenant JAR is delivered at deploy time by cameleer-runtime-loader`
			`# into the RO-mounted /app/jars volume.`
feat: update Docker Compose, CI, and add runtime-base Dockerfile Add jardata volume, CAMELEER_AUTH_TOKEN/CAMELEER3_SERVER_ENDPOINT/CLICKHOUSE_URL env vars to cameleer-saas, CAMELEER_AUTH_TOKEN to cameleer3-server, runtime-base Dockerfile for agent-instrumented customer apps, and expand CI surefire excludes for new integration test classes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-04-04 18:04:42 +02:00			`COPY agent.jar /app/agent.jar`

harden: swap runtime base to Chainguard JRE, remove dead ENTRYPOINT Replace eclipse-temurin:21-jre-alpine (musl) with cgr.dev/chainguard/jre:openjdk-21 (Wolfi/glibc, daily CVE refresh, signed images + SBOM). Remove the dead ENTRYPOINT block — DeploymentExecutor overrides it at container creation anyway. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> 2026-04-28 09:32:49 +02:00			`# No ENTRYPOINT here. cameleer-server's DeploymentExecutor builds the`
			`# per-runtime-type entrypoint (spring-boot/quarkus: -jar; plain-java:`
			`# -cp + main; native: exec) and overrides via withCmd("sh","-c",...).`
			`# Setting one here only creates drift between this image and the actual`
			`# runtime command.`
fix: swap Chainguard JRE to BellSoft Liberica JRE 21 Chainguard free tier only offers :latest (currently JDK 26, unpinned); the :openjdk-21 tag requires a paid subscription, breaking CI. Switch both Dockerfiles to bellsoft/liberica-runtime-container:jre-21-slim-glibc: - Pinned to JDK 21 LTS - Smallest image (199 MB vs 441/491 MB) - glibc-based Alpaquita Linux, sh-only (no bash, no pkg manager) - Free, multi-arch (amd64 + arm64) - Has sh — required by cameleer-server's DeploymentExecutor (withCmd "sh -c") Use nobody:nobody (65534) instead of Chainguard's nonroot (65532). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> 2026-04-28 16:52:55 +02:00			`USER nobody`