cameleer/cameleer-saas
2
0
Fork 0
Code Issues 24 Pull Requests Actions Packages Projects Releases Wiki Activity

harden: swap cameleer-saas runtime stage to Chainguard JRE
Some checks failed
CI / build (push) Successful in 3m22s
Details
CI / docker (push) Failing after 9s
Details

Browse Source 
Replace eclipse-temurin:21-jre-alpine with cgr.dev/chainguard/jre:openjdk-21
for the SaaS management plane image. Use Chainguard's built-in nonroot user
instead of custom adduser. Build stages unchanged (ephemeral).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
hsiegeln
2026-04-28 09:42:38 +02:00
parent 5f210b76a9
commit c43d7f639f
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
Dockerfile
View File

@@ -20,12 +20,12 @@ COPY src/ src/
COPY --from=frontend /ui/dist/ src/main/resources/static/ COPY --from=frontend /ui/dist/ src/main/resources/static/
RUN --mount=type=cache,target=/root/.m2/repository ./mvnw package -DskipTests -U -B RUN --mount=type=cache,target=/root/.m2/repository ./mvnw package -DskipTests -U -B
# Runtime: target platform (amd64) # Runtime: Chainguard Wolfi-based JRE (glibc, daily CVE refresh, non-root by default)
FROM eclipse-temurin:21-jre-alpine FROM cgr.dev/chainguard/jre:openjdk-21
WORKDIR /app WORKDIR /app
RUN addgroup -S cameleer && adduser -S cameleer -G cameleer \ USER root
&& mkdir -p /data/jars && chown -R cameleer:cameleer /data RUN mkdir -p /data/jars && chown -R nonroot:nonroot /data
COPY --from=build /build/target/*.jar app.jar COPY --chown=nonroot:nonroot --from=build /build/target/*.jar app.jar
USER cameleer USER nonroot
EXPOSE 8080 EXPOSE 8080
ENTRYPOINT ["java", "-jar", "app.jar"] ENTRYPOINT ["java", "-jar", "app.jar"]