# Two stages so the shipped image carries a JRE and a jar, not Maven and a
# ~/.m2 cache. Dependencies are resolved in their own layer, before the source
# is copied, so editing a Java file does not re-download the internet.

FROM maven:3.9-eclipse-temurin-21 AS build
WORKDIR /build

COPY pom.xml .
RUN mvn -B -q dependency:go-offline

COPY src ./src
# Tests are skipped here on purpose: the suite needs Testcontainers, which needs
# a Docker daemon this build does not have. Run `./mvnw test` on a machine that
# does - the image build is not the place to find out the ledger is broken.
RUN mvn -B -q clean package -DskipTests

FROM eclipse-temurin:21-jre-alpine
WORKDIR /app

# Don't run as root.
RUN addgroup -S ledger && adduser -S ledger -G ledger
USER ledger

COPY --from=build /build/target/*.jar app.jar

EXPOSE 8080
ENTRYPOINT ["java", "-XX:MaxRAMPercentage=75", "-jar", "/app/app.jar"]