FROM eclipse-temurin:25-jre-alpine-3.22

LABEL maintainer="dedicatedcode"

LABEL org.opencontainers.image.source="https://github.com/dedicatedcode/reitti"

LABEL org.opencontainers.image.description="Reitti - Personal Location Tracking & Analysis"

LABEL org.opencontainers.image.licenses="AGPL-3.0"

RUN addgroup -S reitti -g 1000 && adduser -S reitti -u 1000 -G reitti

RUN apk add --no-cache libstdc++ gcompat

ENV SPRING_PROFILES_ACTIVE=docker

ENV APP_HOME=/app

ENV DATA_DIR=/data

RUN mkdir -p $APP_HOME && \

chown -R reitti:reitti $APP_HOME && \

chmod 755 $APP_HOME

WORKDIR $APP_HOME

COPY --chown=reitti:reitti target/*.jar $APP_HOME/app.jar

RUN chmod 644 $APP_HOME/app.jar

RUN cat <<'EOF' > /entrypoint.sh

if [ "$(id -u)" = '0' ]; then

if [ -n "$APP_UID" ] && [ -n "$APP_GID" ]; then

echo "Changing reitti user/group to UID:$APP_UID / GID:$APP_GID"

apk add --no-cache shadow

groupmod -g "$APP_GID" reitti

usermod -u "$APP_UID" reitti

# Ensure the home directory is owned by the new UID/GID

chown -R reitti:reitti "$APP_HOME"

fi

# 1b. Add reitti to additional groups by GID (works independently of APP_UID/APP_GID)

if [ -n "$APP_EXTRA_GROUPS" ]; then

echo "Adding reitti to additional groups: $APP_EXTRA_GROUPS"

for g in $(echo "$APP_EXTRA_GROUPS" | tr ',' ' '); do

[ -n "$g" ] || continue

case "$g" in

*[!0-9]*) echo "ERROR: APP_EXTRA_GROUPS only accepts numeric GIDs, got '$g'"; exit 1 ;;

esac

# Skip if reitti is already a member (idempotent across restarts; also covers the primary APP_GID)

id -G reitti | tr ' ' '\n' | grep -qx "$g" && continue

if grep -q "^[^:]*:[^:]*:$g:" /etc/group; then

gname=$(grep "^[^:]*:[^:]*:$g:" /etc/group | cut -d: -f1)

else

gname="reitti-grp-$g"

addgroup -g "$g" "$gname" || { echo "ERROR: failed to create group for GID $g"; exit 1; }

fi

addgroup reitti "$gname" || { echo "ERROR: failed to add reitti to group '$gname'"; exit 1; }

done

fi

# 2. Ensure DATA_DIR exists

mkdir -p "$DATA_DIR"

chmod 755 "$DATA_DIR"

# 3. Only chown DATA_DIR if the reitti user cannot write to it

# We use su-exec to "test" writability as the reitti user

if ! su-exec reitti [ -w "$DATA_DIR" ]; then

echo "DATA_DIR ($DATA_DIR) is not writable by reitti. Adjusting permissions..."

chown -R reitti:reitti "$DATA_DIR"

else

echo "DATA_DIR ($DATA_DIR) is already writable. Skipping chown."

fi

# Execute as the reitti user

exec su-exec reitti java $JAVA_OPTS -jar "$APP_HOME/app.jar" -Dspring.profiles.active=docker "$@"

else

echo "Warning: Container is running as UID $(id -u), not root."

echo "Environment variables APP_UID/APP_GID/APP_EXTRA_GROUPS will be ignored."

echo "Ensure your volumes have the correct permissions on the host."

exec java $JAVA_OPTS -jar "$APP_HOME/app.jar" -Dspring.profiles.active=docker "$@"

fi

EOF

RUN chmod 755 /entrypoint.sh

EXPOSE 8080

HEALTHCHECK --interval=5s --timeout=3s --start-period=1s --retries=5 \

CMD sh -c 'curl -f --max-time 2 "http://localhost:8080${BASE_PATH}/actuator/health" || (echo "Health check failed" && exit 1)'

RUN apk add --no-cache su-exec curl attr

RUN setfattr -n user.pax.flags -v "mr" /opt/java/openjdk/bin/java

USER root

ENTRYPOINT ["/entrypoint.sh"]