dockerls 1.0.0__py3-none-any.whl

dockerls/infrastructure/redaction.py

@@ -0,0 +1,135 @@
+r"""One redactor, used everywhere text leaves this process.
+
+Credentials reach this tool through several doors: a registry token in a
+`WWW-Authenticate` exchange, a Docker Hub PAT in an exception message, a
+`user:password` embedded in a URL someone put in a config file, an
+`Authorization` header echoed back by a scanner that failed. They then leave
+through several more: the log file, the raw scan artifacts kept as evidence,
+and anything a user attaches to a ticket.
+
+Having the masking live inside the logging sink covered exactly one of those
+doors. This module is the shared implementation; the log filter and the
+evidence store both call it, so a pattern added here protects every path at
+once.
+
+Three rules shape the patterns:
+
+* **Only the key and its separator survive.** `token=` stays so the line
+  remains readable; no part of the value does.
+* **Over-masking is the acceptable failure.** A redacted benign string costs
+  a moment of confusion. A leaked token costs a credential rotation, and
+  the leak is discovered later, by someone else.
+* **The keyword comes first.** Every key pattern begins with the literal
+  alternation rather than with `[\w.-]*`, so the engine can scan for a
+  literal instead of trying every split of an unbounded character class at
+  every position. This is not a micro-optimisation: with the leading star,
+  redacting one 2 MB scan artifact took **19 seconds** of pure CPU --
+  catastrophic backtracking over the long runs of word characters in a
+  vulnerability description. Once per scanned image, that is the whole
+  run's budget spent on masking. Keyword-first is 176x faster and masks
+  exactly the same strings; the text before the keyword is simply left
+  outside the match instead of being consumed and re-emitted.
+"""
+
+from __future__ import annotations
+
+import re
+
+#: What replaces a redacted value. Recognisable on sight, and distinct from
+#: anything a real credential looks like. The exact string is part of the
+#: observable contract -- it appears in every log file this tool has ever
+#: written -- so it is carried over verbatim rather than modernised.
+MASK = "***MASKED***"
+
+# The credential-introducing keywords, as a bare literal alternation. It is
+# deliberately *not* wrapped in `[\w.-]*` on both sides: see the module
+# docstring for what that cost. Surrounding word characters are matched
+# after the keyword, where they are bounded by the word itself.
+_SENSITIVE_KEYWORD = r"(?:token|password|passwd|senha|secret|api[-_]?key|credential|auth)"
+#: A key, from its keyword to the end of the identifier: `token`,
+#: `api_key`, and the tail of `x_api_key` (the `x_` is left outside the
+#: match and survives untouched, which renders identically).
+_SENSITIVE_KEY_PATTERN = _SENSITIVE_KEYWORD + r"[\w.-]*"
+
+# A quoted key/value pair, as it appears in JSON or a dict repr:
+#   "token": "value"      'apiKey' : 'value'      "auth": {"token": "value"}
+# The quote between the key and the separator is exactly what the previous
+# pattern could not cross, which left every JSON-shaped log line in clear.
+# The value is matched possessively: when no closing quote follows, the
+# match fails at once instead of backtracking through every prefix of a
+# multi-kilobyte string.
+_QUOTED_KV = re.compile(
+    rf"""(?P<prefix>{_SENSITIVE_KEY_PATTERN}["']?\s*[:=]\s*)"""
+    rf"""(?P<quote>["'])(?P<value>(?:[^"'\\]|\\.)*+)(?P=quote)""",
+    re.IGNORECASE,
+)
+
+# An unquoted key/value pair: token=abc, senha: abc, x-api-key: abc.
+_BARE_KV = re.compile(
+    rf"(?P<prefix>{_SENSITIVE_KEY_PATTERN}\s*[=:]\s*)(?P<value>[^\s,;&\"'}}\]]+)", re.IGNORECASE
+)
+
+# Authorization schemes.
+_SCHEME = re.compile(
+    r"\b(?P<scheme>Bearer|Basic|Token|Digest)\s+(?P<value>[^\s,;\"'=:][^\s,;\"']*)",
+    re.IGNORECASE,
+)
+
+# Credentials embedded in a URL: https://user:secret@host
+_URL_USERINFO = re.compile(r"(?P<prefix>://[^/\s:@]+:)(?P<value>[^@/\s]+)(?P<at>@)")
+
+# curl-style inline credentials: -u user:secret, --user user:secret
+_CURL_USER = re.compile(r"(?P<prefix>(?:-u|--user)\s+[^\s:]+:)(?P<value>\S+)")
+
+# Credential formats that are self-identifying, so they are redacted even
+# when they appear with no key to introduce them -- a bare token inside a
+# list or an exception message has no "token=" in front of it.
+_KNOWN_SECRET_VALUE = re.compile(
+    r"""
+      \bdckr_pat_[A-Za-z0-9_-]{8,}                          # Docker Hub PAT
+    | \bgh[pousr]_[A-Za-z0-9]{20,}                           # GitHub classic token
+    | \bgithub_pat_[A-Za-z0-9_]{20,}                         # GitHub fine-grained PAT
+    | \beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]+  # JWT
+    | \bAKIA[0-9A-Z]{16}\b                                   # AWS access key id
+    | \bxox[baprs]-[A-Za-z0-9-]{10,}                          # Slack token
+    """,
+    re.VERBOSE,
+)
+
+# multipart/form-data, where the value sits on its own line after a blank
+# line rather than next to the key.
+_MULTIPART = re.compile(
+    rf"""(?P<prefix>name=["'][\w.-]{{0,32}}{_SENSITIVE_KEY_PATTERN}["'][^\n]*\r?\n\r?\n)(?P<value>[^\r\n]+)""",
+    re.IGNORECASE,
+)
+
+_FILE_FORMAT = "{time:YYYY-MM-DD HH:mm:ss.SSS} | {level: <8} | {name}:{function}:{line} - {message}"
+_CONSOLE_FORMAT = (
+    "<level>{level: <8}</level> | <cyan>{name}</cyan>:<cyan>{function}</cyan> - {message}"
+)
+
+
+def redact(message: str) -> str:
+    """Redact credentials from a log line in every shape they arrive in.
+
+    Only the key name and separator (e.g. `token=`) are kept, never any part
+    of the value. Over-masking a benign line is an acceptable cost; leaking
+    a token into a log file is not, so the key patterns are deliberately
+    broad.
+
+    Order matters: scheme patterns run before the key/value ones, because
+    in `auth: Bearer <token>` a key/value match would consume only the word
+    `Bearer` and stop, leaving the credential in the clear.
+    """
+    result = _SCHEME.sub(lambda m: f"{m.group('scheme')} {MASK}", message)
+    result = _URL_USERINFO.sub(lambda m: f"{m.group('prefix')}{MASK}{m.group('at')}", result)
+    result = _CURL_USER.sub(lambda m: f"{m.group('prefix')}{MASK}", result)
+    result = _MULTIPART.sub(lambda m: f"{m.group('prefix')}{MASK}", result)
+    result = _QUOTED_KV.sub(
+        lambda m: f"{m.group('prefix')}{m.group('quote')}{MASK}{m.group('quote')}", result
+    )
+    result = _BARE_KV.sub(lambda m: f"{m.group('prefix')}{MASK}", result)
+    # Last: catch self-identifying credential formats that appeared with no
+    # key in front of them for any of the patterns above to anchor on.
+    result = _KNOWN_SECRET_VALUE.sub(MASK, result)
+    return result

dockerls/infrastructure/templates/hardening/alpine.dockerfile

@@ -0,0 +1,44 @@
+# Dockerfile.hardened.alpine
+# Hardened template for Alpine Linux - Minimal Base Container
+
+ARG BASE_VERSION=3.20
+
+# Stage 1: Build / Setup
+FROM alpine:${BASE_VERSION} AS builder
+
+RUN apk update && apk upgrade --no-cache \
+    && apk add --no-cache ca-certificates tzdata \
+    && rm -rf /var/cache/apk/*
+
+# Stage 2: Runtime
+FROM alpine:${BASE_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+# Update security packages and create a dedicated non-root user (UID 10001)
+RUN apk update && apk upgrade --no-cache \
+    && apk add --no-cache ca-certificates tzdata \
+    && addgroup -g 10001 appgroup \
+    && adduser -u 10001 -G appgroup -s /sbin/nologin -D appuser \
+    && rm -rf /var/cache/apk/*
+
+WORKDIR /app
+
+# Copy application files with proper ownership
+COPY --chown=appuser:appgroup . .
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
+    CMD [ -f /app/health.ok ] || exit 0
+
+ENTRYPOINT ["sh", "-c"]
+CMD ["echo 'DockerLs Alpine container ready'"]

dockerls/infrastructure/templates/hardening/debian.dockerfile

@@ -0,0 +1,45 @@
+# Dockerfile.hardened.debian
+# Hardened template for Debian GNU/Linux (Bookworm Slim)
+
+ARG DEBIAN_VERSION=bookworm-slim
+
+# Stage 1: Build / Setup
+FROM debian:${DEBIAN_VERSION} AS builder
+
+RUN apt-get update \
+    && apt-get upgrade -y \
+    && apt-get install -y --no-install-recommends ca-certificates tzdata \
+    && rm -rf /var/lib/apt/lists/*
+
+# Stage 2: Runtime
+FROM debian:${DEBIAN_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+# Update OS packages and create a non-root user (UID 10001)
+RUN apt-get update \
+    && apt-get upgrade -y \
+    && apt-get install -y --no-install-recommends ca-certificates tzdata \
+    && groupadd -g 10001 appgroup \
+    && useradd -u 10001 -g appgroup -s /usr/sbin/nologin -m appuser \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+WORKDIR /app
+
+COPY --chown=appuser:appgroup . .
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
+    CMD [ -f /app/health.ok ] || exit 0
+
+ENTRYPOINT ["sh", "-c"]
+CMD ["echo 'DockerLs Debian container ready'"]

dockerls/infrastructure/templates/hardening/distroless.dockerfile

@@ -0,0 +1,34 @@
+# Dockerfile.hardened.distroless
+# Hardened template for Google Distroless (Debian 12 base)
+
+ARG BUILDER_VERSION=3.20
+
+# Stage 1: Builder
+FROM alpine:${BUILDER_VERSION} AS builder
+
+RUN apk update && apk add --no-cache ca-certificates tzdata
+
+WORKDIR /app
+COPY . .
+
+# Stage 2: Distroless Runtime
+FROM gcr.io/distroless/base-debian12:nonroot
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+WORKDIR /app
+
+COPY --from=builder /app /app
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+# nonroot user in Distroless is 65532:65532
+USER 65532:65532
+
+ENTRYPOINT ["/app/binary"]

dockerls/infrastructure/templates/hardening/go-alpine.dockerfile

@@ -0,0 +1,52 @@
+# Dockerfile.hardened.go-alpine
+# Hardened template for Go (Alpine Linux)
+
+ARG GO_VERSION=1.23-alpine
+ARG ALPINE_VERSION=3.20
+
+# Stage 1: Builder
+FROM golang:${GO_VERSION} AS builder
+
+RUN apk update && apk add --no-cache git ca-certificates tzdata
+
+WORKDIR /app
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+    go build -trimpath -ldflags="-s -w" -o /app/binary .
+
+# Stage 2: Alpine Runtime
+FROM alpine:${ALPINE_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+RUN apk update && apk upgrade --no-cache \
+    && apk add --no-cache ca-certificates tzdata \
+    && addgroup -g 10001 appgroup \
+    && adduser -u 10001 -G appgroup -s /sbin/nologin -D appuser \
+    && rm -rf /var/cache/apk/*
+
+WORKDIR /app
+
+COPY --from=builder /app/binary /app/binary
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
+    CMD [ -f /app/binary ] || exit 1
+
+EXPOSE 8080
+
+ENTRYPOINT ["/app/binary"]

dockerls/infrastructure/templates/hardening/go-debian.dockerfile

@@ -0,0 +1,54 @@
+# Dockerfile.hardened.go-debian
+# Hardened template for Go (Debian Bookworm Slim)
+
+ARG GO_VERSION=1.23-bookworm
+ARG DEBIAN_VERSION=bookworm-slim
+
+# Stage 1: Builder
+FROM golang:${GO_VERSION} AS builder
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git ca-certificates tzdata \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+    go build -trimpath -ldflags="-s -w" -o /app/binary .
+
+# Stage 2: Debian Runtime
+FROM debian:${DEBIAN_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+RUN apt-get update && apt-get upgrade -y \
+    && apt-get install -y --no-install-recommends ca-certificates tzdata \
+    && groupadd -g 10001 appgroup \
+    && useradd -u 10001 -g appgroup -s /usr/sbin/nologin -m appuser \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+WORKDIR /app
+
+COPY --from=builder /app/binary /app/binary
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
+    CMD [ -f /app/binary ] || exit 1
+
+EXPOSE 8080
+
+ENTRYPOINT ["/app/binary"]

dockerls/infrastructure/templates/hardening/go-distroless.dockerfile

@@ -0,0 +1,43 @@
+# Dockerfile.hardened.go-distroless
+# Hardened template for Go (Google Distroless Static)
+
+ARG GO_VERSION=1.23-alpine
+
+# Stage 1: Builder
+FROM golang:${GO_VERSION} AS builder
+
+RUN apk update && apk add --no-cache git ca-certificates tzdata
+
+WORKDIR /app
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+    go build -trimpath -ldflags="-s -w" -o /app/binary .
+
+# Stage 2: Distroless Static Runtime
+FROM gcr.io/distroless/static-debian12:nonroot
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+WORKDIR /app
+
+COPY --from=builder /app/binary /app/binary
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+# nonroot user in Distroless
+USER 65532:65532
+
+EXPOSE 8080
+
+ENTRYPOINT ["/app/binary"]

dockerls/infrastructure/templates/hardening/go-scratch.dockerfile

@@ -0,0 +1,48 @@
+# Dockerfile.hardened.go-scratch
+# Hardened template for Go (Scratch - Zero OS CVEs)
+
+ARG GO_VERSION=1.23-alpine
+
+# Stage 1: Builder
+FROM golang:${GO_VERSION} AS builder
+
+RUN apk update && apk add --no-cache git ca-certificates tzdata \
+    && update-ca-certificates
+
+WORKDIR /app
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+# Secure static compilation (no CGO)
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+    go build -trimpath -ldflags="-s -w" -o /app/binary .
+
+# Stage 2: Scratch Runtime
+FROM scratch
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+# Import TLS certificates and timezone data from the builder
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
+
+# Copy only the static binary
+COPY --from=builder /app/binary /app/binary
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+# nobody user (UID 65534:65534)
+USER 65534:65534
+
+EXPOSE 8080
+
+ENTRYPOINT ["/app/binary"]

dockerls/infrastructure/templates/hardening/go.dockerfile

@@ -0,0 +1,50 @@
+# Dockerfile.hardened.go
+# Hardened template for Go - Minimal Production Ready
+
+FROM golang:1.23-alpine AS builder
+
+WORKDIR /app
+
+# Install CA certificates and git
+RUN apk add --no-cache ca-certificates git && update-ca-certificates && rm -rf /var/cache/apk/*
+
+COPY go.mod go.sum* ./
+RUN go mod download || true
+
+COPY . .
+
+# Static build with CGO disabled and stripping flags
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o app .
+
+# Stage 2: Runtime minimal (scratch)
+FROM scratch
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="your-team@company.com"
+LABEL security.cve-contact="security@company.com"
+
+# Build metadata
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+# Copy SSL root certificates for HTTPS calls
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+
+# Copy only the static binary
+COPY --from=builder /app/app /app
+
+# Expose default port
+EXPOSE 8080
+
+# Numeric non-root user (nobody) for scratch
+USER 65534:65534
+
+# Secure health check in exec form
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD ["/app", "-health"]
+
+# No shell - exec form only
+ENTRYPOINT ["/app"]

dockerls/infrastructure/templates/hardening/gradle-alpine.dockerfile

@@ -0,0 +1,51 @@
+# Dockerfile.hardened.gradle-alpine
+# Hardened template for a Java application built with Gradle (Alpine).
+#
+# Same separation as the Maven template: the official Gradle image builds,
+# and the runtime carries only the JRE. The Gradle daemon is disabled during
+# the build -- inside a container it is never reused across runs, so keeping
+# it running only wastes memory.
+
+ARG GRADLE_VERSION=8-jdk21-alpine
+ARG JRE_VERSION=21-jre-alpine
+
+# Stage 1: Build
+FROM gradle:${GRADLE_VERSION} AS builder
+
+WORKDIR /app
+
+COPY --chown=gradle:gradle build.gradle* settings.gradle* ./
+COPY --chown=gradle:gradle src ./src
+RUN gradle --no-daemon clean build -x test
+
+# Stage 2: Runtime
+FROM eclipse-temurin:${JRE_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+ENV JAVA_OPTS="-XX:+UseContainerSupport -XX:MaxRAMPercentage=75.0 -Djava.security.egd=file:/dev/./urandom"
+
+RUN apk upgrade --no-cache \
+    && addgroup -g 10001 appgroup \
+    && adduser -u 10001 -G appgroup -s /sbin/nologin -D appuser
+
+WORKDIR /app
+
+COPY --from=builder --chown=appuser:appgroup /app/build/libs/*.jar /app/app.jar
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+    CMD [ -f /app/app.jar ] || exit 1
+
+EXPOSE 8080
+
+ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar /app/app.jar"]

dockerls/infrastructure/templates/hardening/gradle.dockerfile

@@ -0,0 +1,52 @@
+# Dockerfile.hardened.gradle
+# Hardened template for a Java application built with Gradle (Debian slim).
+#
+# Same separation as the Maven template: the official Gradle image builds,
+# and the runtime carries only the JRE. The Gradle daemon is disabled during
+# the build -- inside a container it is never reused across runs, so keeping
+# it running only wastes memory.
+
+ARG GRADLE_VERSION=8-jdk21
+ARG JRE_VERSION=21-jre
+
+# Stage 1: Build
+FROM gradle:${GRADLE_VERSION} AS builder
+
+WORKDIR /app
+
+COPY --chown=gradle:gradle build.gradle* settings.gradle* ./
+COPY --chown=gradle:gradle src ./src
+RUN gradle --no-daemon clean build -x test
+
+# Stage 2: Runtime
+FROM eclipse-temurin:${JRE_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+ENV JAVA_OPTS="-XX:+UseContainerSupport -XX:MaxRAMPercentage=75.0 -Djava.security.egd=file:/dev/./urandom"
+
+RUN apt-get update && apt-get upgrade -y --no-install-recommends \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd -g 10001 appgroup \
+    && useradd -u 10001 -g appgroup -s /usr/sbin/nologin -m appuser
+
+WORKDIR /app
+
+COPY --from=builder --chown=appuser:appgroup /app/build/libs/*.jar /app/app.jar
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+    CMD [ -f /app/app.jar ] || exit 1
+
+EXPOSE 8080
+
+ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar /app/app.jar"]

dockerls/infrastructure/templates/hardening/java-alpine.dockerfile

@@ -0,0 +1,50 @@
+# Dockerfile.hardened.java-alpine
+# Hardened template for Java 21 (Eclipse Temurin JRE Alpine)
+
+ARG JDK_VERSION=21-jdk-alpine
+ARG JRE_VERSION=21-jre-alpine
+
+# Stage 1: Build (Maven / Gradle)
+FROM eclipse-temurin:${JDK_VERSION} AS builder
+
+WORKDIR /app
+
+RUN apk add --no-cache maven gradle \
+    && rm -rf /var/cache/apk/*
+
+COPY pom.xml ./
+COPY src ./src
+RUN mvn clean package -DskipTests || true
+
+# Stage 2: Runtime
+FROM eclipse-temurin:${JRE_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+ENV JAVA_OPTS="-XX:+UseContainerSupport -XX:MaxRAMPercentage=75.0 -Djava.security.egd=file:/dev/./urandom"
+
+RUN apk update && apk upgrade --no-cache \
+    && addgroup -g 10001 appgroup \
+    && adduser -u 10001 -G appgroup -s /sbin/nologin -D appuser \
+    && rm -rf /var/cache/apk/*
+
+WORKDIR /app
+
+COPY --from=builder --chown=appuser:appgroup /app/target/*.jar /app/app.jar
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+    CMD [ -f /app/app.jar ] || exit 1
+
+EXPOSE 8080
+
+ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar /app/app.jar"]