mvn clean package -DskipTests

# 使用官方 OpenJDK 17 鏡像
FROM openjdk:17-jdk-slim

# 設置工作目錄
WORKDIR /app

# 復制 JAR 文件到容器
COPY target/myapp-1.0.0.jar app.jar

# 暴露端口（假設應用監(jiān)聽 8080）
EXPOSE 8080

# 啟動命令
ENTRYPOINT ["java", "-jar", "app.jar"]

# 構建鏡像
docker build -t myapp:1.0.0 .

# 運行容器
docker run -d -p 8080:8080 --name myapp-container myapp:1.0.0

<build>
    <plugins>
        <plugin>
            <groupId>com.google.cloud.tools</groupId>
            <artifactId>jib-maven-plugin</artifactId>
            <version>3.4.0</version>
            <configuration>
                <!-- 目標鏡像名 -->
                <to>
                    <image>myregistry.com/myapp:${project.version}</image>
                </to>
                <!-- 基礎鏡像（可選） -->
                <from>
                    <image>eclipse-temurin:17-jre-alpine</image>
                </from>
                <!-- 容器配置 -->
                <container>
                    <ports>
                        <port>8080</port>
                    </ports>
                    <environment>
                        <SPRING_PROFILES_ACTIVE>prod</SPRING_PROFILES_ACTIVE>
                    </environment>
                    <creationTime>USE_CURRENT_TIMESTAMP</creationTime>
                </container>
            </configuration>
        </plugin>
    </plugins>
</build>

# 構建鏡像并加載到本地 Docker
mvn jib:dockerBuild

# 查看鏡像
docker images | grep myapp

# 先登錄
docker login

# 推送（需在 <to> 中配置鏡像名，如 yourname/myapp）
mvn jib:build

myapp/
├── src/
├── pom.xml
├── docker/
│   ├── Dockerfile
│   └── entrypoint.sh
└── target/
    └── myapp-1.0.0.jar

<build>
    <plugins>
        <!-- 復制 Docker 相關文件到 target/docker -->
        <plugin>
            <artifactId>maven-resources-plugin</artifactId>
            <version>3.3.1</version>
            <executions>
                <execution>
                    <id>copy-docker-resources</id>
                    <phase>prepare-package</phase>
                    <goals>
                        <goal>copy-resources</goal>
                    </goals>
                    <configuration>
                        <outputDirectory>${project.build.directory}/docker</outputDirectory>
                        <resources>
                            <resource>
                                <directory>docker</directory>
                                <filtering>false</filtering>
                            </resource>
                        </resources>
                    </configuration>
                </execution>
            </executions>
        </plugin>

        <!-- 打包 JAR -->
        <plugin>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-maven-plugin</artifactId>
        </plugin>
    </plugins>
</build>

# 構建階段：使用 JDK 編譯（若需在容器內編譯）
# FROM maven:3.8.6-openjdk-17 AS builder
# COPY . /app
# WORKDIR /app
# RUN mvn clean package -DskipTests

# 運行階段：僅使用 JRE
FROM eclipse-temurin:17-jre-alpine

# 安裝必要工具（如 curl、bash）
RUN apk add --no-cache bash curl

# 創(chuàng)建應用用戶（安全最佳實踐）
RUN addgroup -g 1001 -S appuser && \
    adduser -u 1001 -S appuser -G appuser

# 設置工作目錄
WORKDIR /app

# 復制 JAR 和啟動腳本
COPY myapp-*.jar app.jar
COPY entrypoint.sh /app/entrypoint.sh

# 賦予執(zhí)行權限
RUN chmod +x /app/entrypoint.sh

# 切換到非 root 用戶
USER appuser

# 暴露端口
EXPOSE 8080

# 啟動腳本（可處理信號、設置 JVM 參數等）
ENTRYPOINT ["/app/entrypoint.sh"]

#!/bin/bash
set -e

# 設置默認 JVM 參數
JVM_OPTS="${JVM_OPTS:-"-Xms256m -Xmx512m"}"

# 處理優(yōu)雅關閉（接收 SIGTERM）
function shutdown() {
    echo "Shutting down gracefully..."
    kill -TERM "$PID"
    wait "$PID"
    exit 0
}

# 啟動 Java 應用
java $JVM_OPTS -jar app.jar &
PID=$!

# 注冊信號處理器
trap shutdown SIGTERM SIGINT

# 等待應用結束
wait $PID

# 先執(zhí)行 Maven 構建（復制資源 + 打包 JAR）
mvn clean package -DskipTests

# 再構建 Docker 鏡像
docker build -t myapp:1.0.0 target/docker

# 第一階段：構建
FROM maven:3.8.6-eclipse-temurin-17 AS builder

# 復制 pom.xml 和源碼
COPY pom.xml .
COPY src ./src

# 執(zhí)行 Maven 構建（緩存依賴）
RUN mvn clean package -DskipTests

# 第二階段：運行
FROM eclipse-temurin:17-jre-alpine

# 從 builder 階段復制 JAR
COPY --from=builder /target/*.jar app.jar

EXPOSE 8080
ENTRYPOINT ["java", "-jar", "app.jar"]

<plugin>
    <groupId>pl.project13.maven</groupId>
    <artifactId>git-commit-id-plugin</artifactId>
    <version>8.0.2</version>
    <executions>
        <execution>
            <goals>
                <goal>revision</goal>
            </goals>
        </execution>
    </executions>
    <configuration>
        <verbose>false</verbose>
        <dateFormat>yyyy.MM.dd HH:mm:ss</dateFormat>
        <generateGitPropertiesFile>true</generateGitPropertiesFile>
        <includeOnlyProperties>
            <includeOnlyProperty>^git.commit.id.abbrev$</includeOnlyProperty>
        </includeOnlyProperties>
    </configuration>
</plugin>

<configuration>
    <to>
        <image>myapp:dev-${git.commit.id.abbrev}</image>
    </to>
</configuration>

<configuration>
    <to>
        <image>harbor.example.com/project/myapp:${project.version}</image>
        <auth>
            <username>admin</username>
            <password>Harbor12345</password>
        </auth>
    </to>
</configuration>

<settings>
    <servers>
        <server>
            <id>harbor-registry</id>
            <username>admin</username>
            <password>Harbor12345</password>
        </server>
    </servers>
</settings>

<configuration>
    <to>
        <image>harbor.example.com/project/myapp</image>
        <auth>
            <username>${settings.servers.harbor-registry.username}</username>
            <password>${settings.servers.harbor-registry.password}</password>
        </auth>
    </to>
</configuration>

- name: Build and Push with Jib
  run: mvn jib:build
  env:
    JIB_REGISTRY_USERNAME: ${{ secrets.HARBOR_USER }}
    JIB_REGISTRY_PASSWORD: ${{ secrets.HARBOR_TOKEN }}

# 安裝 Trivy（macOS）
brew install aquasecurity/trivy/trivy

# 掃描本地鏡像
trivy image myapp:1.0.0

myapp:1.0.0 (alpine 3.17.2)
============================
Total: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

- name: Scan Docker image
  run: |
    docker build -t myapp:latest .
    trivy image --exit-code 1 --severity HIGH,CRITICAL myapp:latest

ENTRYPOINT ["java", "-XX:+UseContainerSupport", "-jar", "app.jar"]

# 通過環(huán)境變量控制
ENV JAVA_OPTS="-Xmx300m -Xms300m"
ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -jar app.jar"]

name: Build and Push Docker Image

on:
  push:
    branches: [ main ]
    tags: [ 'v*' ]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'temurin'

      - name: Cache Maven packages
        uses: actions/cache@v3
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}

      - name: Build with Maven
        run: mvn -B clean verify

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract metadata (tags, labels)
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: myname/myapp
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=sha

      - name: Build and push with Jib
        run: mvn jib:build -Djib.to.image=${{ steps.meta.outputs.tags }}

      - name: Scan image with Trivy
        run: |
          docker pull ${{ steps.meta.outputs.tags }}
          trivy image --exit-code 1 --severity HIGH,CRITICAL ${{ steps.meta.outputs.tags }}

ENV TZ=Asia/Shanghai
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone