2fa8ba07de
Chainguard free tier only offers :latest (currently JDK 26, unpinned); the :openjdk-21 tag requires a paid subscription, breaking CI. Switch both Dockerfiles to bellsoft/liberica-runtime-container:jre-21-slim-glibc: - Pinned to JDK 21 LTS - Smallest image (199 MB vs 441/491 MB) - glibc-based Alpaquita Linux, sh-only (no bash, no pkg manager) - Free, multi-arch (amd64 + arm64) - Has sh — required by cameleer-server's DeploymentExecutor (withCmd "sh -c") Use nobody:nobody (65534) instead of Chainguard's nonroot (65532). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
18 lines
735 B
Docker
18 lines
735 B
Docker
# BellSoft Liberica JRE 21 on Alpaquita Linux (glibc, minimal, 199 MB).
|
|
# Pin by digest in production overlays.
|
|
FROM bellsoft/liberica-runtime-container:jre-21-slim-glibc
|
|
|
|
WORKDIR /app
|
|
|
|
# Agent + log appender are baked in; tenant JAR is delivered at deploy
|
|
# time by cameleer-runtime-loader into the RO-mounted /app/jars volume.
|
|
COPY agent.jar /app/agent.jar
|
|
COPY cameleer-log-appender.jar /app/cameleer-log-appender.jar
|
|
|
|
# No ENTRYPOINT here. cameleer-server's DeploymentExecutor builds the
|
|
# per-runtime-type entrypoint (spring-boot/quarkus: -jar; plain-java:
|
|
# -cp + main; native: exec) and overrides via withCmd("sh","-c",...).
|
|
# Setting one here only creates drift between this image and the actual
|
|
# runtime command.
|
|
USER nobody
|