Capítulo 39 — Containers e Empacotamento

Código-fonte versionado (Git)
    │
CI Pipeline (build)
    │
Dockerfile → Docker image
    │
Scanning de vulnerabilidades
    │
Registry privado
    │
Kubernetes pull image
    │
Container em execução

# Stage 1: Construção (build)
FROM maven:3.8-openjdk-21 AS builder

WORKDIR /build
COPY . .
RUN mvn clean package -DskipTests -q

# Stage 2: Runtime (final)
FROM openjdk:21-jdk-slim

# Usuário não-root
RUN groupadd -r appuser && useradd -r -g appuser appuser

# Apenas JAR executável (sem código-fonte)
COPY --from=builder /build/target/app.jar /opt/app/app.jar

# Metadados
LABEL org.opencontainers.image.title="API Solicitações"
LABEL org.opencontainers.image.version="1.2.3"
LABEL org.opencontainers.image.source="https://git.example.com/..."

# Healthcheck
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
  CMD java -jar /opt/app/app.jar health

USER appuser
EXPOSE 8080
ENTRYPOINT ["java", "-XX:+UseG1GC", "-Xmx512m", "-jar", "/opt/app/app.jar"]

.git
.gitignore
.env
.env.local
node_modules
dist
build
coverage
*.log
.DS_Store

# ❌ Não fazer (imprevisível)
FROM openjdk:21-jdk-slim

# ✓ Fazer (pinned, reproduzível)
FROM openjdk:21-jdk-slim@sha256:a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6

1. Checkout do código
2. Lint (Dockerfile lint)
3. Build da imagem Docker
4. Scanning de vulnerabilidades (Trivy, Snyk, Grype)
5. Se aprovado:
   a. Tag semântica (v1.2.3, v1.2.3-rc.1)
   b. Tag commit (commit-hash)
   c. Tag latest (apenas em main)
6. Push para registry
7. Atualizar manifesto Kubernetes (Argo CD)

name: Build and Push Docker Image

on:
  push:
    branches: [ main, develop ]
    tags: [ 'v*' ]

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      
      - name: Lint Dockerfile
        run: docker run --rm -i hadolint/hadolint < Dockerfile
      
      - name: Build image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: false
          load: true
          tags: app:${{ github.sha }}
      
      - name: Scan with Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: app:${{ github.sha }}
          format: 'sarif'
          output: 'trivy-results.sarif'
      
      - name: Upload Trivy results
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'
      
      - name: Login to Registry
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v3
        with:
          registry: registry.example.com
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_TOKEN }}
      
      - name: Build and push
        if: github.event_name != 'pull_request'
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: |
            registry.example.com/platform/app:${{ github.sha }}
            registry.example.com/platform/app:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

# Scan de imagem local
trivy image app:v1.2.3

# Scan de Dockerfile antes do build
trivy config Dockerfile

# Exportar SBOM (Software Bill of Materials)
trivy image app:v1.2.3 --format cyclonedx --output sbom.xml

# Scan com severity mínimo
trivy image app:v1.2.3 --severity CRITICAL,HIGH

apiVersion: v1
kind: Secret
metadata:
  name: registry-credentials
  namespace: default
type: kubernetes.io/dockercfg
data:
  .dockercfg: eyJyZWdpc3RyeS5leGFtcGxlLmNvbSI6eyJhdXRoIjoiYmFzZTY0LWVuY29kZWQtdXNlcm5hbWU6cGFzc3dvcmQifX0=
---
apiVersion: v1
kind: Pod
metadata:
  name: app-pod
spec:
  imagePullSecrets:
  - name: registry-credentials
  containers:
  - name: app
    image: registry.example.com/platform/app:v1.2.3

# Replicação push para registry de backup
registry.example.com/platform/app:v1.2.3
  ↓
backup-registry.example.com/platform/app:v1.2.3

registry.example.com/platform/api-solicitacoes:MAJOR.MINOR.PATCH[-PRERELEASE][+BUILD]

Exemplos:
  v1.2.3                (release)
  v1.2.3-rc.1           (release candidate)
  v1.2.3-alpha.1        (alpha)
  v1.2.3-SHA256:a1b2c3 (commit hash)
  latest                (sempre aponta para last stable)

apiVersion: v1
kind: Pod
metadata:
  name: app-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
    readOnlyRootFilesystem: true
  containers:
  - name: app
    image: registry.example.com/platform/app:v1.2.3
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
    volumeMounts:
    - name: tmp
      mountPath: /tmp
  volumes:
  - name: tmp
    emptyDir:
      medium: Memory

# Sign image
cosign sign --key cosign.key registry.example.com/platform/app:v1.2.3

# Verify
cosign verify --key cosign.pub registry.example.com/platform/app:v1.2.3

# Inspecionar tamanho de cada camada
dive registry.example.com/platform/app:v1.2.3

# Estimativa de tamanho comprimido
docker image inspect registry.example.com/platform/app:v1.2.3 | jq '.Size'

# Remover imagens não utilizadas
docker image prune -a

# Remover layers órfãs
docker system prune --all

# Em registry: remover tags antigas
# Harbor oferece policy de retenção

# Regenerar token no registry
# Atualizar secret Kubernetes
kubectl patch secret registry-credentials \
  -p '{"data":{".dockercfg":"<new-base64-encoded-token>"}}'

# Redeploy pods para puxar novo token
kubectl rollout restart deployment/api-solicitacoes