# 5. Layered, on distroless: no shell, no package manager, runs as uid 65532 (the :nonroot tag).
#    The extraction has to happen in a stage that HAS a shell - distroless cannot RUN anything.
FROM eclipse-temurin:25-jre AS builder
WORKDIR /builder
COPY target/app.jar application.jar
RUN java -Djarmode=tools -jar application.jar extract --layers --destination extracted

FROM gcr.io/distroless/java25-debian13:nonroot
WORKDIR /application
COPY --from=builder /builder/extracted/dependencies/ ./
COPY --from=builder /builder/extracted/spring-boot-loader/ ./
COPY --from=builder /builder/extracted/snapshot-dependencies/ ./
COPY --from=builder /builder/extracted/application/ ./
# Exec form is mandatory here: there is no /bin/sh to run a shell-form command.
ENTRYPOINT ["java", "-jar", "application.jar"]