Harden Java 17 container runtime with distroless non-root image

[vijayyovan]

Summary

Hardens the existing Spring Boot container runtime without changing application logic.

Changes

• Replaced the Java 17 Alpine runtime with a distroless Java 17 non-root runtime
• Preserved the existing multi-stage Maven build
• Preserved the real Spring Boot application JAR as the runtime artifact
• Added container-aware JVM memory configuration:
  JAVA_TOOL_OPTIONS="-XX:MaxRAMPercentage=75 -XX:+ExitOnOutOfMemoryError"
• Preserved application port 8008
• Preserved JAR-based application startup
• No application source code changes
• docker-src/Main.java is not present

Repository Validation

• Base branch: main
• Head branch: feature/dockerfile-hardening-step1
• Changed files: 1 (Dockerfile)
• Application source changes: none
• Repository state: CLEAN

Runtime Validation

Docker execution is unavailable in the current environment.

• Docker build: NOT EXECUTED
• Container start: NOT EXECUTED
• Non-root runtime verification: NOT EXECUTED
• Liveness endpoint: NOT EXECUTED
• Log validation: NOT EXECUTED
• Container shutdown: NOT EXECUTED

Runtime validation should be completed before production use.

[Copilot]

🟡 Changes recommended

Update runbooks or provide a debug path for endpoint and troubleshooting checks.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Hardens the Spring Boot Java 17 runtime with a distroless non-root image without changing application code.

Changes:

• Replaces Alpine with gcr.io/distroless/java17-debian12:nonroot.
• Adds container-aware JVM memory and OOM settings.
• Preserves the Maven build, JAR startup, and port 8008.

Review note: documented kubectl exec checks require shell utilities unavailable in the distroless image; update the runbooks or provide a debug path.

File summaries

File	Description
Dockerfile	Updates the runtime image and JVM configuration.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.