From ac349c1b347be17b6d8814496f1d66a2b5a85e50 Mon Sep 17 00:00:00 2001
From: Daniel Arroyo <darroylat@gmail.com>
Date: Thu, 13 Aug 2026 17:13:54 -0400
Subject: [PATCH] fix(docker): drop RUN commands - quarkus-micro-image:2.0 has
 no shell

Removed the RUN chmod/chown/echo steps from the Dockerfile. The Quarkus
micro image 2.0 ships without /bin/sh and /usr/bin/sh, so any RUN
instruction fails. The chmod and securerandom.source append now happen
in the CI 'Stage binary for Docker' step, and COPY --chown=1001:1001
takes ownership of the binary in the image.

COPY --chown requires BuildKit, so:
- Install docker-buildx in the CI
- Switch docker build -> docker buildx build

The final image stays minimal (no shell, no microdnf, no extra packages).
---
 .gitea/workflows/ci.yml | 9 ++++++---
 Dockerfile              | 7 +------
 2 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 68d2704..9dab68f 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -21,10 +21,10 @@ jobs:
       image: maven:3.9.6-eclipse-temurin-21
       options: --memory=8g
     steps:
-      - name: Install git, node, gcc, docker, and basic tools
+      - name: Install git, node, gcc, docker, buildx, and basic tools
         run: |
           apt-get update
-          apt-get install -y git curl ca-certificates build-essential zlib1g-dev docker.io
+          apt-get install -y git curl ca-certificates build-essential zlib1g-dev docker.io docker-buildx
           curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
           apt-get install -y nodejs
           rm -rf /var/lib/apt/lists/*
@@ -32,6 +32,7 @@ jobs:
           node --version
           gcc --version
           docker --version
+          docker buildx version
 
       - name: Checkout
         uses: actions/checkout@v4
@@ -70,13 +71,15 @@ jobs:
         run: |
           mkdir -p build-output
           cp target/shot-crafter-calculator-1.0.0-runner build-output/
+          chmod 775 build-output/shot-crafter-calculator-1.0.0-runner
+          echo "securerandom.source=file:/dev/urandom" >> build-output/shot-crafter-calculator-1.0.0-runner
 
       - name: Build & Push Docker image
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           set -e
           echo "=== Build Docker image ==="
-          docker build -t shot-crafter-calculator:ci .
+          docker buildx build -t shot-crafter-calculator:ci .
           echo "=== Login to Gitea Registry ==="
           echo "${{ secrets.REGISTRY_TOKEN }}" | docker login gitea.danielarroyo.cl -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
           SHORT_SHA=$(echo "$GITHUB_SHA" | cut -c1-7)
diff --git a/Dockerfile b/Dockerfile
index f30bffb..5c77757 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,15 +9,10 @@ RUN microdnf install -y curl-minimal && microdnf clean all \
  && cp -rP /etc/ssl /out/etc/
 
 FROM quay.io/quarkus/quarkus-micro-image:2.0
-SHELL ["/usr/bin/sh", "-c"]
 WORKDIR /work/
-COPY build-output/shot-crafter-calculator-1.0.0-runner /work/application
+COPY --chown=1001:1001 build-output/shot-crafter-calculator-1.0.0-runner /work/application
 COPY --from=curl-builder /out/ /
 
-RUN chmod 775 /work /work/application \
- && chown -R 1001 /work \
- && echo "securerandom.source=file:/dev/urandom" >> /work/application
-
 EXPOSE 8080
 USER 1001