Spring Boot Deployment Standards
Priority: P0
Containerize with Docker
- Buildpacks: Use
bootBuildImage(Gradle) orspring-boot:build-image(Maven) for OCI-compliant images. - Layered JAR: Use
Layered JARsupport to optimize Build Cache. Use multi-stageDockerfile. - Security: Run as
non-rootuser. Useeclipse-temurinor Distroless as base image. - Secrets: NEVER commit secrets to Git. Inject via environment variables, Kubernetes Secrets, or Vault (spring.config.import). Never bake secrets into image layers.
See implementation examples for multi-stage layered Dockerfile and graceful shutdown configuration.
Build GraalVM Native Images (AOT)
- Use Case: Serverless or CLI tools requiring instant startup and low memory footprint.
- Constraints: Use
AOTtransformations. Register reflection withRuntimeHintsif needed. - Health Checks: Include
Actuatorendpoints specifically for Liveness and Readiness probes.
Tune Resources and Shutdown
- Graceful Shutdown: Enable
server.shutdown=gracefulwith a 30s timeout. - Memory: Use
-XX:+UseContainerSupportand-XX:MaxRAMPercentage=75.0. - Log Management: Log to
stdoutin Structured JSON for log aggregators.
Anti-Patterns
- No Fat JARs in Docker: Use Layered JAR support for better caching.
- No root container user: Run as restricted user (appuser/nobody).
- No baked-in secrets: Use Env vars or ConfigMaps, never image layers.