# 第一階段：構(gòu)建應(yīng)用
FROM maven:3.8.6-eclipse-temurin-17 AS builder
WORKDIR /app
COPY pom.xml .
RUN mvn dependency:go-offline
COPY src ./src
RUN mvn package -DskipTests

# 第二階段：運(yùn)行時環(huán)境
FROM eclipse-temurin:17-jre-alpine
WORKDIR /app
COPY --from=builder /app/target/*.jar app.jar

# 使用jdeps分析并創(chuàng)建最小JRE運(yùn)行時
RUN apk add --no-cache binutils
RUN jlink \
    --add-modules $(jdeps --print-module-deps --ignore-missing-deps app.jar) \
    --strip-debug \
    --no-man-pages \
    --no-header-files \
    --compress=2 \
    --output /customjre

ENV JAVA_HOME=/customjre
ENV PATH="$JAVA_HOME/bin:$PATH"

ENTRYPOINT ["java", "-XX:MaxRAMPercentage=75", "-jar", "app.jar"]

resources:
  requests:
    memory: "512Mi"
    cpu: "250m"
  limits:
    memory: "1Gi"
    cpu: "500m"

java \
  -XX:+UseContainerSupport \
  -XX:MaxRAMPercentage=75.0 \
  -XX:InitialRAMPercentage=50.0 \
  -XX:+HeapDumpOnOutOfMemoryError \
  -jar app.jar

HEALTHCHECK --interval=30s --timeout=3s \
  CMD curl -f http://localhost:8080/actuator/health || exit 1

STOPSIGNAL SIGTERM

java \
  -XX:TieredStopAtLevel=1 \
  -noverify \
  -Dspring.profiles.active=prod \
  -jar app.jar

# 父模塊Dockerfile
FROM maven:3.8.6-eclipse-temurin-17 AS builder
WORKDIR /app
COPY pom.xml .
RUN mvn -pl '!module1,!module2' dependency:go-offline
COPY . .
RUN mvn -pl module1,module2 clean package -DskipTests

# 服務(wù)1鏡像
FROM eclipse-temurin:17-jre-alpine
WORKDIR /app
COPY --from=builder /app/module1/target/*.jar app.jar
ENTRYPOINT ["java", "-jar", "app.jar"]

# 服務(wù)2鏡像
FROM eclipse-temurin:17-jre-alpine
WORKDIR /app
COPY --from=builder /app/module2/target/*.jar app.jar
ENTRYPOINT ["java", "-jar", "app.jar"]

version: '3.8'

services:
  service1:
    build:
      context: .
      dockerfile: Dockerfile
      target: service1
    ports:
      - "8081:8080"
    environment:
      - SPRING_PROFILES_ACTIVE=prod
    depends_on:
      - db
    restart: always

  service2:
    build:
      context: .
      dockerfile: Dockerfile
      target: service2
    ports:
      - "8082:8080"
    environment:
      - SPRING_PROFILES_ACTIVE=prod
    depends_on:
      - db
    restart: always

  db:
    image: postgres:14-alpine
    volumes:
      - postgres-data:/var/lib/postgresql/data
    environment:
      - POSTGRES_USER=user
      - POSTGRES_PASSWORD=password
      - POSTGRES_DB=appdb
    ports:
      - "5432:5432"

volumes:
  postgres-data:

# 配置中心服務(wù)
config-server:
  image: my-config-server
  ports:
    - "8888:8888"
  environment:
    - GIT_REPO=https://github.com/my-org/config-repo

# 服務(wù)注冊中心
eureka-server:
  image: my-eureka-server
  ports:
    - "8761:8761"
  environment:
    - EUREKA_CLIENT_REGISTER_WITH_EUREKA=false
    - EUREKA_CLIENT_FETCH_REGISTRY=false

# values.yaml
replicaCount: 3

image:
  repository: my-app
  tag: {{ .Chart.AppVersion }}
  pullPolicy: IfNotPresent

resources:
  requests:
    memory: "512Mi"
    cpu: "250m"
  limits:
    memory: "1Gi"
    cpu: "500m"

env:
  - name: SPRING_PROFILES_ACTIVE
    value: "prod"
  - name: DB_URL
    valueFrom:
      secretKeyRef:
        name: db-secret
        key: url

# Prometheus配置
scrape_configs:
  - job_name: 'spring-boot'
    metrics_path: '/actuator/prometheus'
    static_configs:
      - targets: ['my-app:8080']

# Grafana儀表盤配置
datasources:
  - name: Prometheus
    type: prometheus
    url: http://prometheus-server:9090

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: my-app
spec:
  hosts:
    - my-app
  http:
  - route:
    - destination:
        host: my-app
        subset: v1
      weight: 90
    - destination:
        host: my-app
        subset: v2
      weight: 10

java \
  -XX:MaxRAMPercentage=75.0 \
  -XX:+UseG1GC \
  -XX:MaxGCPauseMillis=200 \
  -XX:+ParallelRefProcEnabled \
  -XX:+AlwaysPreTouch \
  -jar app.jar

# 查看容器資源使用情況
docker stats <container-id>

# 查看JVM內(nèi)部狀態(tài)
docker exec -it <container-id> jstat -gc <pid> 1000

# 生成堆轉(zhuǎn)儲
docker exec -it <container-id> jmap -dump:format=b,file=heapdump.hprof <pid>

trivy image my-app:latest

# 以非root用戶運(yùn)行
RUN addgroup -S spring && adduser -S spring -G spring
USER spring:spring

# 減少暴露端口
EXPOSE 8080

# 限制容器能力
securityContext:
  capabilities:
    drop:
      - ALL

pipeline {
  agent any
  
  stages {
    stage('Build') {
      steps {
        sh 'mvn clean package'
      }
    }
    
    stage('Test') {
      steps {
        sh 'mvn test'
      }
    }
    
    stage('Build Image') {
      steps {
        sh 'docker build -t my-app:${BUILD_NUMBER} .'
      }
    }
    
    stage('Push Image') {
      steps {
        sh 'docker push my-app:${BUILD_NUMBER}'
      }
    }
    
    stage('Deploy to K8s') {
      steps {
        sh 'kubectl set image deployment/my-app my-app=my-app:${BUILD_NUMBER}'
      }
    }
  }
  
  post {
    success {
      echo '部署成功'
    }
    failure {
      echo '部署失敗'
    }
  }
}