ARG BASE_IMAGE=docker.m.daocloud.io/library/eclipse-temurin:17-jre-alpine
FROM ${BASE_IMAGE}

RUN addgroup -S app \
    && adduser -S -G app -u 10001 app

WORKDIR /app

# 预建运行时数据目录并归属 app 用户：命名卷首次挂载时会继承此属主，
# 否则 Docker 以 root:root 0755 创建挂载点，非 root 容器无法写入。
RUN mkdir -p /data/files && chown -R app:app /data

ARG JAR_FILE
COPY --chown=app:app ${JAR_FILE} /app/app.jar

USER app

ENV JAVA_OPTS="-XX:MaxRAMPercentage=75.0 -XX:+ExitOnOutOfMemoryError -Dfile.encoding=UTF-8" \
    SERVER_PORT=8080

EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
    CMD busybox wget -q -O /dev/null "http://127.0.0.1:${SERVER_PORT}/actuator/health" || exit 1

ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar /app/app.jar"]