信创实战：Dockerfile 信创基础镜像构建

# ============================================================
# 信创基础镜像：Amazon Corretto 8 JDK (Alpine 3.20)
# 支持架构：x86_64, aarch64（鲲鹏）
# 适用场景：Java 微服务基础运行环境
# ============================================================

FROM alpine:3.20

# ============================================================
# 镜像元信息
# ============================================================
LABEL maintainer="lin" \
      description="Amazon Corretto 8 JDK for xinchuang" \
      version="8u422" \
      architecture.multiarch="true"

# ============================================================
# 环境变量
# ============================================================
# Corretto 版本（可通过构建参数覆盖）
ARG CORRETTO_VERSION=8.422.05.1
ARG CORRETTO_SHA256_AMD64=a7b7e2f8c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0
ARG CORRETTO_SHA256_AARCH64=b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9

ENV JAVA_HOME=/usr/lib/jvm/java-1.8.0-amazon-corretto \
    PATH="/usr/lib/jvm/java-1.8.0-amazon-corretto/bin:${PATH}" \
    LANG=en_US.UTF-8 \
    LC_ALL=en_US.UTF-8 \
    TZ=Asia/Shanghai \
    # JVM 默认参数（可通过环境变量覆盖）
    JAVA_OPTS="-XX:+UseG1GC -XX:MaxGCPauseMillis=200 -Djava.security.egd=file:/dev/./urandom"

# ============================================================
# 安装基础依赖 + 配置国内镜像源
# ============================================================
# 使用阿里云镜像源加速（信创环境通常无法直接访问 dl-cdn.alpinelinux.org）
RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories && \
    apk add --no-cache \
        bash \
        curl \
        wget \
        tzdata \
        ca-certificates \
        fontconfig \
        ttf-dejavu \
        busybox-extras \
        procps \
        gzip \
        tar \
        zip \
        unzip \
    && rm -rf /var/cache/apk/*

# ============================================================
# 时区配置
# ============================================================
RUN ln -sf /usr/share/zoneinfo/${TZ} /etc/localtime && \
    echo "${TZ}" > /etc/timezone

# ============================================================
# Locale 配置
# ============================================================
ENV LANG=en_US.UTF-8 \
    LANGUAGE=en_US:en \
    LC_ALL=en_US.UTF-8

# ============================================================
# 安装 Amazon Corretto 8 JDK
# ============================================================
RUN ARCH=$(uname -m) && \
    case "${ARCH}" in \
        x86_64)  CORRETTO_ARCH="x64" ;; \
        aarch64) CORRETTO_ARCH="aarch64" ;; \
        *)       echo "Unsupported architecture: ${ARCH}" && exit 1 ;; \
    esac && \
    wget -q -O /tmp/corretto.tar.gz \
        "https://corretto.aws/downloads/latest/amazon-corretto-${CORRETTO_VERSION}-linux-${CORRETTO_ARCH}-jdk.tar.gz" && \
    mkdir -p /usr/lib/jvm && \
    tar -xzf /tmp/corretto.tar.gz -C /usr/lib/jvm && \
    ln -sf /usr/lib/jvm/amazon-corretto-${CORRETTO_VERSION}-linux-${CORRETTO_ARCH} \
           /usr/lib/jvm/java-1.8.0-amazon-corretto && \
    rm -f /tmp/corretto.tar.gz && \
    java -version

# ============================================================
# 内置健康检查脚本：java-info
# ============================================================
RUN cat > /usr/local/bin/java-info << 'SCRIPT' && chmod +x /usr/local/bin/java-info
#!/bin/bash
echo "========================================="
echo "  Java Environment Info"
echo "========================================="
echo ""
echo "📦 JDK Version:"
java -version 2>&1
echo ""
echo "📁 JAVA_HOME: ${JAVA_HOME}"
echo "🏗️  Architecture: $(uname -m)"
echo "🐧 OS: $(cat /etc/os-release 2>/dev/null | grep PRETTY_NAME | cut -d= -f2 | tr -d '"')"
echo "🕐 Timezone: $(cat /etc/timezone 2>/dev/null || echo 'not set')"
echo ""
echo "💾 Memory:"
free -h 2>/dev/null || echo "  (free command not available)"
echo ""
echo "🔧 JVM System Properties (key ones):"
java -XshowSettings:all 2>&1 | grep -E "(java.home|os.arch|os.name|file.encoding|user.timezone)" | sed 's/^/  /'
echo ""
echo "========================================="
SCRIPT

WORKDIR /app
CMD ["bash"]

# 创建支持多架构的 builder（使用 docker-container 驱动）
docker buildx create \
    --name xinchuang-builder \
    --driver docker-container \
    --driver-opt network=host \
    --bootstrap --use

# 查看已创建的 builder
docker buildx ls

# 安装 QEMU 用户态模拟（用于非本机架构的交叉编译）
docker run --rm --privileged multiarch/qemu-user-static --reset -p yes

# 构建并推送多架构镜像到 Registry
docker buildx build \
    --platform linux/amd64,linux/arm64 \
    -t xinchuang.nexus.com/base/corretto8-jdk:8u422-alpine3.20 \
    --push .

# 本地调试建议只加载单架构镜像；经典 Docker image store 不能直接 load 多架构 manifest
docker buildx build \
    --platform linux/arm64 \
    -t xinchuang/corretto8-jdk:8u422-alpine3.20-arm64 \
    --load .

# 仅构建特定架构（调试用）
docker buildx build \
    --platform linux/arm64 \
    -t xinchuang/corretto8-jdk:8u422-alpine3.20-arm64 \
    --load .

# ============================================================
# 多架构自适应 Dockerfile
# 通过 ARG + 条件判断实现不同架构的差异化配置
# ============================================================

FROM alpine:3.20

ARG TARGETARCH  # Docker buildx 自动注入

# 根据架构设置不同的镜像源
RUN if [ "${TARGETARCH}" = "arm64" ]; then \
        # 鲲鹏 ARM64：使用华为云镜像源（速度更快）
        sed -i 's/dl-cdn.alpinelinux.org/repo.huaweicloud.com/g' /etc/apk/repositories; \
    elif [ "${TARGETARCH}" = "sw64" ]; then \
        # 申威：使用内部镜像源（通常无法访问公网）
        echo "http://internal-mirror.example.com/alpine/v3.20/main" > /etc/apk/repositories; \
    else \
        # x86_64：使用阿里云镜像源
        sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories; \
    fi

# ============================================================
# 信创精简镜像：Amazon Corretto 8 JRE (Alpine 3.20)
# 适用于：生产环境 Java 应用运行时
# ============================================================

FROM alpine:3.20

ARG CORRETTO_VERSION=8.422.05.1

ENV JAVA_HOME=/usr/lib/jvm/java-1.8.0-amazon-corretto-jre \
    PATH="/usr/lib/jvm/java-1.8.0-amazon-corretto-jre/bin:${PATH}" \
    LANG=en_US.UTF-8 \
    TZ=Asia/Shanghai \
    JAVA_OPTS="-XX:+UseG1GC -XX:MaxGCPauseMillis=200 -XX:+UseStringDeduplication -Djava.security.egd=file:/dev/./urandom"

RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories && \
    apk add --no-cache bash curl tzdata ca-certificates fontconfig ttf-dejavu && \
    ln -sf /usr/share/zoneinfo/${TZ} /etc/localtime && \
    echo "${TZ}" > /etc/timezone

RUN ARCH=$(uname -m) && \
    case "${ARCH}" in \
        x86_64)  CORRETTO_ARCH="x64" ;; \
        aarch64) CORRETTO_ARCH="aarch64" ;; \
        *)       echo "Unsupported architecture: ${ARCH}" && exit 1 ;; \
    esac && \
    wget -q -O /tmp/corretto-jre.tar.gz \
        "https://corretto.aws/downloads/latest/amazon-corretto-${CORRETTO_VERSION}-linux-${CORRETTO_ARCH}-jre.tar.gz" && \
    mkdir -p /usr/lib/jvm && \
    tar -xzf /tmp/corretto-jre.tar.gz -C /usr/lib/jvm && \
    ln -sf /usr/lib/jvm/amazon-corretto-${CORRETTO_VERSION}-linux-${CORRETTO_ARCH}-jre \
           /usr/lib/jvm/java-1.8.0-amazon-corretto-jre && \
    rm -f /tmp/corretto-jre.tar.gz && \
    # 删除不必要的文件（进一步瘦身）
    rm -rf /usr/lib/jvm/*/lib/src.zip \
           /usr/lib/jvm/*/lib/missioncontrol \
           /usr/lib/jvm/*/lib/visualvm \
           /var/cache/apk/*

WORKDIR /app
CMD ["bash"]

# 使用 Nexus 3 搭建私有 Docker Registry
# 1. 部署 Nexus 3（可容器化或直接安装）
docker run -d --name nexus \
    -p 8081:8081 -p 5000:5000 \
    -v /opt/nexus-data:/nexus-data \
    sonatype/nexus3:latest

# 2. 在 Nexus Web UI 中创建 Docker (hosted) 仓库，端口 5000
# 3. 推送镜像
# docker tag xinchuang/corretto8-jdk:latest nexus.example.com:5000/base/corretto8-jdk:latest
# docker push nexus.example.com:5000/base/corretto8-jdk:latest

# 方式一：rsync 同步（适用于同网络段）
rsync -avz --progress /opt/repos/ user@offline-server:/opt/repos/

# 方式二：容器镜像导出/导入（推荐用于 Docker 镜像离线传输）
# 有网环境导出
docker save -o corretto8-jdk.tar xinchuang/corretto8-jdk:8u422-alpine3.20
# 通过介质传输后导入
docker load -i corretto8-jdk.tar

# 方式三：多架构镜像先推送到内部 Registry，再在离线环境按目标架构拉取
# docker buildx imagetools inspect xinchuang.nexus.com/base/corretto8-jdk:8u422
# docker pull --platform linux/arm64 xinchuang.nexus.com/base/corretto8-jdk:8u422

# ============================================================
# 通用 JDK 安装逻辑（支持多架构自动适配）
# ============================================================
RUN ARCH=$(uname -m) && \
    echo "Detected architecture: ${ARCH}" && \
    case "${ARCH}" in \
        # Intel/AMD x86_64
        x86_64) \
            wget -q -O /tmp/jdk.tar.gz \
                "https://corretto.aws/downloads/latest/amazon-corretto-8.422.05.1-linux-x64-jdk.tar.gz" \
            ;; \
        # 鲲鹏/飞腾 ARM64
        aarch64) \
            wget -q -O /tmp/jdk.tar.gz \
                "https://corretto.aws/downloads/latest/amazon-corretto-8.422.05.1-linux-aarch64-jdk.tar.gz" \
            ;; \
        # 申威 SW64（需要本地预编译的 JDK）
        sw_64|sw64) \
            if [ -f /opt/swjdk/swjdk-8.tar.gz ]; then \
                cp /opt/swjdk/swjdk-8.tar.gz /tmp/jdk.tar.gz; \
            else \
                echo "ERROR: SW64 JDK not found at /opt/swjdk/" && exit 1; \
            fi \
            ;; \
        # 龙芯 LoongArch
        loongarch64) \
            if [ -f /opt/loongjdk/loongjdk-8.tar.gz ]; then \
                cp /opt/loongjdk/loongjdk-8.tar.gz /tmp/jdk.tar.gz; \
            else \
                echo "ERROR: LoongArch JDK not found at /opt/loongjdk/" && exit 1; \
            fi \
            ;; \
        *) \
            echo "ERROR: Unsupported architecture: ${ARCH}" && exit 1 \
            ;; \
    esac && \
    mkdir -p /usr/lib/jvm && \
    tar -xzf /tmp/jdk.tar.gz -C /usr/lib/jvm && \
    rm -f /tmp/jdk.tar.gz

# ============================================================
# 多阶段构建示例：编译 + 运行分离
# ============================================================

# 阶段 1：编译（使用完整 JDK）
FROM xinchuang/corretto8-jdk:8u422-alpine3.20 AS builder

WORKDIR /build
COPY pom.xml .
# 先下载依赖（利用 Docker 缓存层）
RUN mvn dependency:go-offline -B

COPY src ./src
RUN mvn package -DskipTests -B && \
    cp target/*.jar app.jar

# 阶段 2：运行（使用精简 JRE）
FROM xinchuang/corretto8-jre:8u422-alpine3.20

WORKDIR /app
COPY --from=builder /build/app.jar ./app.jar

EXPOSE 8080
ENTRYPOINT ["sh", "-c", "java ${JAVA_OPTS} -jar app.jar ${0} ${@}"]

# 使用 Trivy 扫描镜像漏洞
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
    aquasec/trivy image xinchuang/corretto8-jdk:8u422-alpine3.20

# 使用 Docker Scout（Docker Desktop 内置）
docker scout cves xinchuang/corretto8-jdk:8u422-alpine3.20

# 常见修复：
# 1. 定期更新基础镜像（Alpine 版本）
# 2. 升级 JDK 到最新安全补丁版本
# 3. 移除不必要的工具（curl、wget 在生产镜像中可以不装）

# ============================================================
# Nacos 信创生产镜像
# 基于自建 Corretto8 JDK 基础镜像
# ============================================================

FROM xinchuang.nexus.com/base/corretto8-jdk:8u422-alpine3.20

ARG NACOS_VERSION=2.3.2

ENV NACOS_HOME=/opt/nacos \
    MODE=standalone \
    SPRING_DATASOURCE_PLATFORM=""

# 安装 Nacos
RUN wget -q -O /tmp/nacos.tar.gz \
        "https://github.com/alibaba/nacos/releases/download/${NACOS_VERSION}/nacos-server-${NACOS_VERSION}.tar.gz" && \
    mkdir -p ${NACOS_HOME} && \
    tar -xzf /tmp/nacos.tar.gz -C /opt/ && \
    mv /opt/nacos-server-${NACOS_VERSION}/* ${NACOS_HOME}/ && \
    rm -rf /tmp/nacos.tar.gz /opt/nacos-server-${NACOS_VERSION}

# 注入国产 CPU 的 RocksDB JNI 库（如果有）
COPY librocksdbjni-*.so /tmp/rocksdbjni-patch/
RUN if ls /tmp/rocksdbjni-patch/librocksdbjni-*.so 1>/dev/null 2>&1; then \
        echo "Patching RocksDB JNI for native architecture..."; \
        /opt/scripts/patch-nacos-rocksdb.sh ${NACOS_HOME}/target/nacos-server.jar /tmp/rocksdbjni-patch/*.so; \
    fi && \
    rm -rf /tmp/rocksdbjni-patch

WORKDIR ${NACOS_HOME}

EXPOSE 8848 9848 9849

ENTRYPOINT ["sh", "-c", "${NACOS_HOME}/bin/startup.sh -m ${MODE} && tail -f ${NACOS_HOME}/logs/start.out"]

# .dockerignore
.git
.gitignore
*.md
!README.md
target/
!target/*.jar
.idea/
*.iml
.DS_Store
node_modules/
logs/
*.log

□ 确认目标 CPU 架构（x86_64 / aarch64 / sw64 / loongarch64）
□ 选择基础镜像（Alpine / Ubuntu / 麒麟 / 统信）
□ 配置国内镜像源（阿里云 / 华为云 / 内部源）
□ 安装 JDK/JRE（Corretto / 申威定制 JDK / 龙芯定制 JDK）
□ 设置时区（Asia/Shanghai）和 Locale
□ 安装必要工具（curl、tzdata、ca-certificates）
□ 多阶段构建分离编译和运行环境
□ 镜像瘦身（清理缓存、删除不必要文件）
□ 安全扫描（Trivy / Docker Scout）
□ 规范化标签管理
□ 创建 .dockerignore
□ 推送到内部镜像仓库