clearcutt-java25 : distroless

# Stage 1: Build the Maven application inside Java JDK dev builder
FROM ghcr.io/northcutted/clearcutt/clearcutt-java25:v0.6.5-dev AS builder
WORKDIR /app

COPY pom.xml .
COPY src ./src
RUN mvn clean package -DskipTests

# Stage 2: Hardened runner stage (distroless or slim Java JRE runtime)
FROM ghcr.io/northcutted/clearcutt/clearcutt-java25:v0.6.5-distroless
WORKDIR /app

# Copy JRE-optimized JAR file
COPY --from=builder /app/target/*.jar ./app.jar

# Run JRE application as secure non-root operator
USER 10001:10001
CMD ["java", "-jar", "app.jar"]

# Run an interactive local dev shell with the exact same remediated Zulu JDK:
$ nix shell github:northcutted/clearcutt-images/v0.6.5#clearcuttJava25-native

# Or declare inside your local flake.nix:
{
  inputs.clearcutt.url = "github:northcutted/clearcutt-images/v0.6.5";
  outputs = { self, nixpkgs, clearcutt }: {
    devShells.x86_64-linux.default = let
      pkgs = import nixpkgs {
        system = "x86_64-linux";
        overlays = [ clearcutt.overlays.default ];
      };
    in pkgs.mkShell {
      buildInputs = [ pkgs.clearcuttJava25 ];
    };
  };
}

# Layer a custom JAR application declaratively in your Nix configuration
pkgs.dockerTools.buildImage {
  name = "custom-java-microservice";
  tag = "latest";
  
  # Layer on top of ClearCutt's JRE base
  fromImage = clearcutt-base-image;

  copyToRoot = pkgs.buildEnv {
    name = "image-root";
    paths = [
      pkgs.zlib           # Layer in native dynamic libraries
      java-app-package    # Include your packaged JAR launcher
    ];
    pathsToLink = [ "/bin" "/lib" ];
  };

  config = {
    Cmd = [ "/bin/java-app" ];
    User = "10001:10001";
  };
}