From 2833e769145f3146de0e66f842359bb4f0f65092 Mon Sep 17 00:00:00 2001
From: Daniel Arroyo <darroylat@gmail.com>
Date: Fri, 14 Aug 2026 15:45:05 -0400
Subject: [PATCH] fix(docker): switch runtime base to ubuntu:22.04 (glibc 2.35)

The native binary is built against glibc 2.35 (Ubuntu jammy in CI) but
quarkus-micro-image:2.0 ships glibc 2.34 (UBI 9), hence the
'GLIBC_2.35 not found' at runtime. Switching to ubuntu:22.04 as the
runtime base matches glibc exactly and lets us stop fighting with
musl / static binaries.

Dockerfile:
- FROM ubuntu:22.04 (was quarkus-micro-image:2.0)
- install curl + ca-certificates via apt (apt + bash are present, so
  chmod/echo securerandom run in-line again)
- single-stage: no more curl-builder multi-stage
- useradd UID 1001 (matches the in-container USER)

CI:
- drop binary-type=STATIC and --libc=musl (binary is dynamic again)
- drop the rm -f target/*-runner (cache invalidate)
- 'Stage binary for Docker' is now just 'cp'
- verify step is informational only

Image is ~5 MB larger than quarkus-micro-image but the runtime now
matches the build glibc, so the container starts cleanly.
---
 .gitea/workflows/ci.yml | 24 ++++--------------------
 Dockerfile              | 22 +++++++++-------------
 2 files changed, 13 insertions(+), 33 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 47b4ab7..aab6123 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -21,10 +21,10 @@ jobs:
       image: maven:3.9.6-eclipse-temurin-21
       options: --memory=8g
     steps:
-      - name: Install git, node, gcc, musl, docker, buildx, and basic tools
+      - name: Install git, node, gcc, docker, buildx, and basic tools
         run: |
           apt-get update
-          apt-get install -y git curl ca-certificates build-essential zlib1g-dev musl musl-tools docker.io docker-buildx
+          apt-get install -y git curl ca-certificates build-essential zlib1g-dev docker.io docker-buildx
           curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
           apt-get install -y nodejs
           rm -rf /var/lib/apt/lists/*
@@ -33,7 +33,6 @@ jobs:
           gcc --version
           docker --version
           docker buildx version
-          musl-gcc --version 2>/dev/null || echo "musl-gcc not present (binary-type=STATIC won't produce static binaries)"
 
       - name: Checkout
         uses: actions/checkout@v4
@@ -62,34 +61,19 @@ jobs:
           restore-keys: ${{ runner.os }}-node-
 
       - name: Build (Native)
-        run: |
-          rm -f target/shot-crafter-calculator-1.0.0-runner
-          mvn package -Pnative -B -DskipTests \
-            -Dquarkus.native.native-image-xmx=4g \
-            -Dquarkus.native.binary-type=STATIC \
-            -Dquarkus.native.libc=musl \
-            -Dquarkus.native.additional-build-args=--libc=musl
+        run: mvn package -Pnative -B -DskipTests -Dquarkus.native.native-image-xmx=4g
 
       - name: Verify native binary
         run: |
           ls -la target/shot-crafter-calculator-1.0.0-runner
           echo ""
           echo "=== Library dependencies ==="
-          out=$(ldd target/shot-crafter-calculator-1.0.0-runner 2>&1 || true)
-          if echo "$out" | grep -q "not a dynamic executable"; then
-            echo "OK: binary is statically linked."
-          else
-            echo "FAIL: binary has dynamic dependencies:"
-            echo "$out"
-            exit 1
-          fi
+          ldd target/shot-crafter-calculator-1.0.0-runner 2>&1 || echo "(unable to determine)"
 
       - name: Stage binary for Docker
         run: |
           mkdir -p build-output
           cp target/shot-crafter-calculator-1.0.0-runner build-output/
-          chmod 775 build-output/shot-crafter-calculator-1.0.0-runner
-          echo "securerandom.source=file:/dev/urandom" >> build-output/shot-crafter-calculator-1.0.0-runner
 
       - name: Build & Push Docker image
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
diff --git a/Dockerfile b/Dockerfile
index fbb74d1..7e3a96f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,18 +1,14 @@
-FROM registry.access.redhat.com/ubi9/ubi-minimal AS curl-builder
-RUN microdnf install -y curl-minimal && microdnf clean all \
- && mkdir -p /out/etc/pki /out/etc \
- && install -D -m 0755 /usr/bin/curl /out/usr/bin/curl \
- && for lib in $(ldd /usr/bin/curl | awk '/=>/ {print $3}' | sort -u); do \
-      dest="/out$(echo "$lib" | sed 's|^/lib64|/usr/lib64|; s|^/lib|/usr/lib|')"; \
-      install -D -m 0755 "$lib" "$dest"; \
-    done \
- && cp -rP /etc/pki/ca-trust /out/etc/pki/ \
- && cp -rP /etc/ssl /out/etc/
-
-FROM quay.io/quarkus/quarkus-micro-image:2.0
+FROM ubuntu:22.04
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends curl ca-certificates \
+ && rm -rf /var/lib/apt/lists/* \
+ && useradd -u 1001 -U -M -s /usr/sbin/nologin app \
+ && mkdir -p /work \
+ && chown 1001:1001 /work
 WORKDIR /work/
 COPY --chown=1001:1001 build-output/*-runner /work/application
-COPY --from=curl-builder /out/ /
+RUN chmod 775 /work /work/application \
+ && echo "securerandom.source=file:/dev/urandom" >> /work/application
 
 EXPOSE 8080
 USER 1001