Docker and CI/CD for Backend Services

# syntax=docker/dockerfile:1
 
# ---- Stage 1: build ----
FROM eclipse-temurin:21-jdk-jammy AS builder
WORKDIR /build
 
# Copy dependency descriptors first — maximizes layer cache reuse
COPY pom.xml .
COPY .mvn/ .mvn/
COPY mvnw .
RUN ./mvnw dependency:go-offline -B
 
# Now copy source and build — this layer invalidates on code change,
# but the dependency layer above stays cached
COPY src/ src/
RUN ./mvnw clean package -DskipTests -B
 
# ---- Stage 2: runtime ----
FROM eclipse-temurin:21-jre-jammy AS runtime
WORKDIR /app
 
# Run as a non-root user
RUN groupadd -r appgroup && useradd -r -g appgroup appuser
 
COPY --from=builder /build/target/order-service-*.jar app.jar
RUN chown appuser:appgroup app.jar
USER appuser
 
EXPOSE 8080
 
HEALTHCHECK --interval=30s --timeout=3s --start-period=40s --retries=3 \
  CMD curl -f http://localhost:8080/actuator/health || exit 1
 
ENTRYPOINT ["java", "-XX:+UseContainerSupport", "-XX:MaxRAMPercentage=75.0", "-jar", "app.jar"]

# docker-compose.yml
version: "3.9"
 
services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
    ports:
      - "8080:8080"
    environment:
      SPRING_PROFILES_ACTIVE: docker
      SPRING_DATASOURCE_URL: jdbc:mysql://mysql:3306/orders
      SPRING_DATASOURCE_USERNAME: app
      SPRING_DATASOURCE_PASSWORD: app_password
      SPRING_REDIS_HOST: redis
      SPRING_KAFKA_BOOTSTRAP_SERVERS: kafka:9092
    depends_on:
      mysql:
        condition: service_healthy
      redis:
        condition: service_started
      kafka:
        condition: service_started
    networks:
      - backend-net
 
  mysql:
    image: mysql:8.0
    environment:
      MYSQL_DATABASE: orders
      MYSQL_USER: app
      MYSQL_PASSWORD: app_password
      MYSQL_ROOT_PASSWORD: root_password
    ports:
      - "3306:3306"
    volumes:
      - mysql-data:/var/lib/mysql
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-uroot", "-proot_password"]
      interval: 5s
      timeout: 5s
      retries: 10
    networks:
      - backend-net
 
  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"
    networks:
      - backend-net
 
  kafka:
    image: bitnami/kafka:3.6
    ports:
      - "9092:9092"
    environment:
      KAFKA_CFG_NODE_ID: 0
      KAFKA_CFG_PROCESS_ROLES: controller,broker
      KAFKA_CFG_LISTENERS: PLAINTEXT://:9092,CONTROLLER://:9093
      KAFKA_CFG_ADVERTISED_LISTENERS: PLAINTEXT://kafka:9092
      KAFKA_CFG_CONTROLLER_QUORUM_VOTERS: 0@kafka:9093
      KAFKA_CFG_CONTROLLER_LISTENER_NAMES: CONTROLLER
    networks:
      - backend-net
 
volumes:
  mysql-data:
 
networks:
  backend-net:
    driver: bridge

docker compose up -d              # start the full stack in the background
docker compose logs -f app        # follow just the app service's logs
docker compose ps                 # see status + health of every service
docker compose exec mysql mysql -uapp -papp_password orders   # shell into a running service
docker compose down               # stop and remove containers (keeps named volumes)
docker compose down -v            # also remove volumes — full reset

# .github/workflows/ci.yml
name: CI
 
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
 
jobs:
  build-and-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: "21"
          distribution: "temurin"
          cache: "maven"
 
      - name: Build
        run: ./mvnw -B clean compile
 
      - name: Run tests
        run: ./mvnw -B test
 
      - name: Package
        run: ./mvnw -B package -DskipTests
 
      - name: Upload jar artifact
        uses: actions/upload-artifact@v4
        with:
          name: app-jar
          path: target/*.jar
 
  build-and-push-image:
    needs: build-and-test
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Log in to registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
 
      - name: Build and push image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: |
            ghcr.io/acme/order-service:${{ github.sha }}
            ghcr.io/acme/order-service:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

# docker-compose resource limits (mirrors what you'd set in Kubernetes requests/limits)
services:
  app:
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 768M
        reservations:
          cpus: "0.5"
          memory: 512M
    stop_grace_period: 30s   # time given to the process between SIGTERM and SIGKILL

// Spring Boot: graceful shutdown, drains in-flight requests before stopping
// application.yml
// server:
//   shutdown: graceful
// spring:
//   lifecycle:
//     timeout-per-shutdown-phase: 25s