Dockerfile

# Multi-stage build for PostgreSQL Query Sniffer
FROM maven:3.8.6-openjdk-11-slim AS builder

WORKDIR /app

# Copy pom.xml first for better layer caching
COPY pom.xml .

# Download dependencies
RUN mvn dependency:go-offline -B

# Copy source code
COPY src ./src

# Build the application
RUN mvn clean package -DskipTests

# Runtime stage
FROM openjdk:11-jre-slim

# Install required packages for network capture
RUN apt-get update && apt-get install -y \
    libpcap0.8 \
    libpcap-dev \
    tcpdump \
    net-tools \
    && rm -rf /var/lib/apt/lists/*

# Create app user
RUN groupadd -r appuser && useradd -r -g appuser appuser

# Create directories
RUN mkdir -p /app/reports /app/logs /app/config && \
    chown -R appuser:appuser /app

WORKDIR /app

# Copy the built JAR
COPY --from=builder /app/target/postgresql-query-sniffer-*.jar app.jar

# Copy configuration files
COPY src/main/resources/sniffer-config.yml config/
COPY src/main/resources/logback.xml config/

# Create startup script
RUN echo '#!/bin/bash\n\
set -e\n\
\n\
# Set default values\n\
JAVA_OPTS="${JAVA_OPTS:--Xmx512m -Xms256m}"\n\
CONFIG_FILE="${CONFIG_FILE:-config/sniffer-config.yml}"\n\
\n\
# Check if running as root (needed for network capture)\n\
if [ "$EUID" -eq 0 ] && [ "${ALLOW_ROOT:-false}" != "true" ]; then\n\
    echo "Warning: Running as root. Set ALLOW_ROOT=true to suppress this warning."\n\
fi\n\
\n\
# Execute the application\n\
exec java $JAVA_OPTS -jar app.jar "$@"\n\
' > /app/entrypoint.sh && chmod +x /app/entrypoint.sh

# Switch to app user (note: network capture may require root)
USER appuser

# Expose proxy port (if using proxy mode)
EXPOSE 5433

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
    CMD pgrep -f "postgresql-query-sniffer" > /dev/null || exit 1

# Set entrypoint
ENTRYPOINT ["/app/entrypoint.sh"]

# Default command
CMD ["--help"]