From 84d0c0e7c0ee213bfc06b7fdd9b149c244169302 Mon Sep 17 00:00:00 2001
From: Jeremy Bernard <jeremy.bernard@iex.ec>
Date: Mon, 7 Sep 2026 14:56:40 +0200
Subject: [PATCH] feat: extract Spring Boot Jar layers to optimize OCI image
 build

---
 Dockerfile | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 1e0d8f56..33113d67 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,19 +1,30 @@
-FROM eclipse-temurin:21.0.11_10-jre-noble
+FROM eclipse-temurin:21.0.12_8-jre-noble AS extractor
 
 ARG jar
 
 RUN test -n "$jar"
 
+WORKDIR /extractor
+
+COPY $jar iexec-core.jar
+
+RUN java -Djarmode=tools -jar iexec-core.jar extract --layers
+
+FROM eclipse-temurin:21.0.12_8-jre-noble
+
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends curl \
+    && apt-get upgrade --no-install-recommends -y \
     && rm -rf /var/lib/apt/lists/*
 
-RUN groupadd --system appuser \
-    && useradd -g appuser -s /sbin/nologin -c "Docker image user" appuser
+RUN groupadd -g 1001 appuser \
+    && useradd -g 1001 --no-create-home -s /sbin/nologin -u 1001 appuser
 
-WORKDIR /app
-COPY $jar iexec-core.jar
-RUN chown -R appuser:appuser /app
+RUN install -d -g 1001 -o 1001 /app
 
-USER appuser
+COPY --from=extractor --chown=1001:1001 /extractor/iexec-core/dependencies/ /app
+COPY --from=extractor --chown=1001:1001 /extractor/iexec-core/snapshot-dependencies/ /app
+COPY --from=extractor --chown=1001:1001 /extractor/iexec-core/application/ /app
+
+USER 1001
+WORKDIR /app
 ENTRYPOINT ["java", "-Djava.security.egd=file:/dev/./urandom", "-jar", "iexec-core.jar"]