使用Maven将Java项目打包为Docker镜像的实战方法

mvn clean package -DskipTests

# 使用官方 OpenJDK 17 镜像
FROM openjdk:17-jdk-slim

# 设置工作目录
WORKDIR /app

# 复制 JAR 文件到容器
COPY target/myapp-1.0.0.jar app.jar

# 暴露端口（假设应用监听 8080）
EXPOSE 8080

# 启动命令
ENTRYPOINT ["java", "-jar", "app.jar"]

# 构建镜像
docker build -t myapp:1.0.0 .

# 运行容器
docker run -d -p 8080:8080 --name myapp-container myapp:1.0.0

<build>
    <plugins>
        <plugin>
            <groupId>com.google.cloud.tools</groupId>
            <artifactId>jib-maven-plugin</artifactId>
            <version>3.4.0</version>
            <configuration>
                <!-- 目标镜像名 -->
                <to>
                    <image>myregistry.com/myapp:${project.version}</image>
                </to>
                <!-- 基础镜像（可选） -->
                <from>
                    <image>eclipse-temurin:17-jre-alpine</image>
                </from>
                <!-- 容器配置 -->
                <container>
                    <ports>
                        <port>8080</port>
                    </ports>
                    <environment>
                        <SPRING_PROFILES_ACTIVE>prod</SPRING_PROFILES_ACTIVE>
                    </environment>
                    <creationTime>USE_CURRENT_TIMESTAMP</creationTime>
                </container>
            </configuration>
        </plugin>
    </plugins>
</build>

# 构建镜像并加载到本地 Docker
mvn jib:dockerBuild

# 查看镜像
docker images | grep myapp

# 先登录
docker login

# 推送（需在 <to> 中配置镜像名，如 yourname/myapp）
mvn jib:build

myapp/
├── src/
├── pom.xml
├── docker/
│   ├── Dockerfile
│   └── entrypoint.sh
└── target/
    └── myapp-1.0.0.jar

<build>
    <plugins>
        <!-- 复制 Docker 相关文件到 target/docker -->
        <plugin>
            <artifactId>maven-resources-plugin</artifactId>
            <version>3.3.1</version>
            <executions>
                <execution>
                    <id>copy-docker-resources</id>
                    <phase>prepare-package</phase>
                    <goals>
                        <goal>copy-resources</goal>
                    </goals>
                    <configuration>
                        <outputDirectory>${project.build.directory}/docker</outputDirectory>
                        <resources>
                            <resource>
                                <directory>docker</directory>
                                <filtering>false</filtering>
                            </resource>
                        </resources>
                    </configuration>
                </execution>
            </executions>
        </plugin>

        <!-- 打包 JAR -->
        <plugin>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-maven-plugin</artifactId>
        </plugin>
    </plugins>
</build>

# 构建阶段：使用 JDK 编译（若需在容器内编译）
# FROM maven:3.8.6-openjdk-17 AS builder
# COPY . /app
# WORKDIR /app
# RUN mvn clean package -DskipTests

# 运行阶段：仅使用 JRE
FROM eclipse-temurin:17-jre-alpine

# 安装必要工具（如 curl、bash）
RUN apk add --no-cache bash curl

# 创建应用用户（安全最佳实践）
RUN addgroup -g 1001 -S appuser && \
    adduser -u 1001 -S appuser -G appuser

# 设置工作目录
WORKDIR /app

# 复制 JAR 和启动脚本
COPY myapp-*.jar app.jar
COPY entrypoint.sh /app/entrypoint.sh

# 赋予执行权限
RUN chmod +x /app/entrypoint.sh

# 切换到非 root 用户
USER appuser

# 暴露端口
EXPOSE 8080

# 启动脚本（可处理信号、设置 JVM 参数等）
ENTRYPOINT ["/app/entrypoint.sh"]

#!/bin/bash
set -e

# 设置默认 JVM 参数
JVM_OPTS="${JVM_OPTS:-"-Xms256m -Xmx512m"}"

# 处理优雅关闭（接收 SIGTERM）
function shutdown() {
    echo "Shutting down gracefully..."
    kill -TERM "$PID"
    wait "$PID"
    exit 0
}

# 启动 Java 应用
java $JVM_OPTS -jar app.jar &
PID=$!

# 注册信号处理器
trap shutdown SIGTERM SIGINT

# 等待应用结束
wait $PID

# 先执行 Maven 构建（复制资源 + 打包 JAR）
mvn clean package -DskipTests

# 再构建 Docker 镜像
docker build -t myapp:1.0.0 target/docker

# 第一阶段：构建
FROM maven:3.8.6-eclipse-temurin-17 AS builder

# 复制 pom.xml 和源码
COPY pom.xml .
COPY src ./src

# 执行 Maven 构建（缓存依赖）
RUN mvn clean package -DskipTests

# 第二阶段：运行
FROM eclipse-temurin:17-jre-alpine

# 从 builder 阶段复制 JAR
COPY --from=builder /target/*.jar app.jar

EXPOSE 8080
ENTRYPOINT ["java", "-jar", "app.jar"]

<plugin>
    <groupId>pl.project13.maven</groupId>
    <artifactId>git-commit-id-plugin</artifactId>
    <version>8.0.2</version>
    <executions>
        <execution>
            <goals>
                <goal>revision</goal>
            </goals>
        </execution>
    </executions>
    <configuration>
        <verbose>false</verbose>
        <dateFormat>yyyy.MM.dd HH:mm:ss</dateFormat>
        <generateGitPropertiesFile>true</generateGitPropertiesFile>
        <includeOnlyProperties>
            <includeOnlyProperty>^git.commit.id.abbrev$</includeOnlyProperty>
        </includeOnlyProperties>
    </configuration>
</plugin>

<configuration>
    <to>
        <image>myapp:dev-${git.commit.id.abbrev}</image>
    </to>
</configuration>

<configuration>
    <to>
        <image>harbor.example.com/project/myapp:${project.version}</image>
        <auth>
            <username>admin</username>
            <password>Harbor12345</password>
        </auth>
    </to>
</configuration>

<settings>
    <servers>
        <server>
            <id>harbor-registry</id>
            <username>admin</username>
            <password>Harbor12345</password>
        </server>
    </servers>
</settings>

<configuration>
    <to>
        <image>harbor.example.com/project/myapp</image>
        <auth>
            <username>${settings.servers.harbor-registry.username}</username>
            <password>${settings.servers.harbor-registry.password}</password>
        </auth>
    </to>
</configuration>

- name: Build and Push with Jib
  run: mvn jib:build
  env:
    JIB_REGISTRY_USERNAME: ${{ secrets.HARBOR_USER }}
    JIB_REGISTRY_PASSWORD: ${{ secrets.HARBOR_TOKEN }}

# 安装 Trivy（macOS）
brew install aquasecurity/trivy/trivy

# 扫描本地镜像
trivy image myapp:1.0.0

myapp:1.0.0 (alpine 3.17.2)
============================
Total: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

- name: Scan Docker image
  run: |
    docker build -t myapp:latest .
    trivy image --exit-code 1 --severity HIGH,CRITICAL myapp:latest

ENTRYPOINT ["java", "-XX:+UseContainerSupport", "-jar", "app.jar"]

# 通过环境变量控制
ENV JAVA_OPTS="-Xmx300m -Xms300m"
ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -jar app.jar"]

name: Build and Push Docker Image

on:
  push:
    branches: [ main ]
    tags: [ 'v*' ]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'temurin'

      - name: Cache Maven packages
        uses: actions/cache@v3
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}

      - name: Build with Maven
        run: mvn -B clean verify

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract metadata (tags, labels)
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: myname/myapp
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=sha

      - name: Build and push with Jib
        run: mvn jib:build -Djib.to.image=${{ steps.meta.outputs.tags }}

      - name: Scan image with Trivy
        run: |
          docker pull ${{ steps.meta.outputs.tags }}
          trivy image --exit-code 1 --severity HIGH,CRITICAL ${{ steps.meta.outputs.tags }}

ENV TZ=Asia/Shanghai
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone