FROM eclipse-temurin:25-jre-alpine

# Non-root user for security
RUN addgroup -S app && adduser -S app -G app

VOLUME /tmp
ARG JAR_FILE=target/*.jar
COPY ${JAR_FILE} app.jar

RUN chown app:app /app.jar

USER app

EXPOSE 9332

HEALTHCHECK --interval=30s --timeout=5s --retries=3 --start-period=60s \
    CMD wget --quiet --tries=1 --spider http://localhost:9332/actuator/health/liveness || exit 1

ENTRYPOINT ["java", \
    "-XX:+UseContainerSupport", \
    "-XX:MaxRAMPercentage=75.0", \
    "-Djava.security.egd=file:/dev/./urandom", \
    "-jar", "/app.jar"]