Problem
The current Dockerfile uses maven:3.9-eclipse-temurin-25-alpine (builder) and eclipse-temurin:25-jdk-alpine (runtime). Using the full JDK at runtime ships compiler tooling, javac, jshell, and debug utilities that are never used, unnecessarily inflating the image and the attack surface.
Pain points with the current approach:
- Full JDK at runtime is the primary driver of Java's large image size in this comparison study
- Known CVEs in base images requiring constant monitoring
- No built-in SBOM, provenance attestations, or SLSA compliance
- Manual security update maintenance
Proposed Solution
Migrate to Docker Hardened Images (DHI), using a JRE-based runtime image (not JDK) to reduce both attack surface and image size in a single step.
DHI provides:
- Up to 95% reduction in attack surface vs. standard images
- Near-zero CVEs, actively maintained by Docker's security team
- Built-in SBOM, provenance attestations, SLSA Build Level 3
- Free and open source (Apache 2.0)
Suggested Approach
1. Update base images
Builder stage:
# Replace:
FROM maven:3.9-eclipse-temurin-25-alpine AS builder
# With:
FROM dhi.io/eclipse-temurin:25-jdk-alpine-dev AS builder
Runtime stage:
# Replace:
FROM eclipse-temurin:25-jdk-alpine AS runtime
# With:
FROM dhi.io/eclipse-temurin:25-jre-alpine AS runtime
Switching from jdk to jre in the runtime is a direct size win bundled into this migration. For an even smaller image, see the dedicated jlink issue.
2. Adapt health check
Verify curl availability in the DHI Alpine JRE variant. If unavailable:
Option A: Replace with a Java-based HTTP check in healthcheck.sh.
Option B: Explicitly install curl via apk add --no-cache curl.
3. Key files to modify
Dockerfile — update base images, verify apk add curl compatibilityscripts/healthcheck.sh — adapt if removing curl dependency.github/workflows/maven.yml — update CI/CD if dhi.io authentication is needed
4. Architecture considerations
- Multi-stage build preserved
- Non-root
spring user maintained
/storage volume mount unchanged- SQLite runtime libs (
sqlite-libs) still required via apk
- No application code changes required
Note: relationship to other Docker optimization issues
This issue focuses on security hardening. The jlink issue addresses the primary size reduction (full JDK → custom minimal JRE). Both can be implemented independently; jlink provides deeper size savings than the JDK→JRE switch bundled here.
Acceptance Criteria
References
Problem
The current Dockerfile uses
maven:3.9-eclipse-temurin-25-alpine(builder) andeclipse-temurin:25-jdk-alpine(runtime). Using the full JDK at runtime ships compiler tooling,javac,jshell, and debug utilities that are never used, unnecessarily inflating the image and the attack surface.Pain points with the current approach:
Proposed Solution
Migrate to Docker Hardened Images (DHI), using a JRE-based runtime image (not JDK) to reduce both attack surface and image size in a single step.
DHI provides:
Suggested Approach
1. Update base images
Builder stage:
Runtime stage:
Switching from
jdktojrein the runtime is a direct size win bundled into this migration. For an even smaller image, see the dedicatedjlinkissue.2. Adapt health check
Verify
curlavailability in the DHI Alpine JRE variant. If unavailable:Option A: Replace with a Java-based HTTP check in
healthcheck.sh.Option B: Explicitly install
curlviaapk add --no-cache curl.3. Key files to modify
Dockerfile— update base images, verifyapk add curlcompatibilityscripts/healthcheck.sh— adapt if removing curl dependency.github/workflows/maven.yml— update CI/CD ifdhi.ioauthentication is needed4. Architecture considerations
springuser maintained/storagevolume mount unchangedsqlite-libs) still required viaapkNote: relationship to other Docker optimization issues
This issue focuses on security hardening. The
jlinkissue addresses the primary size reduction (full JDK → custom minimal JRE). Both can be implemented independently;jlinkprovides deeper size savings than the JDK→JRE switch bundled here.Acceptance Criteria
/storage) works correctlyspring) has correct permissionsdocker buildx imagetools inspect --format "{{json .SBOM}}")References