Minor suggestions to improve the container image

[chgl]

Note that there is also jib and cnbp or Spring boot build plugins (see https://spring.io/guides/topicals/spring-boot-docker/ "Build Plugins") which can avoid any hassle with Docker/Containerfiles.

A few suggestions to improve the Containerfile and thus the built image:

• [ ] L1: base image is not pinned by digest (https://candrews.integralblue.com/2023/09/always-use-docker-image-digests/)
• [ ] L3: apt usage https://github.com/hadolint/hadolint/wiki/DL3027
• [ ] L3: apt-get upgrade is controversial: reproducability suffers, especially since the published image is not the one that was tested against in https://github.com/medizininformatik-initiative/feasibility-backend/blob/develop/.github/workflows/ci.yml - between tests and release dependency may change in breaking ways; see e.g. https://github.com/adoptium/containers/pull/256
• [ ] L7: bad layer caching: L10 is less likely to change compared to L7
• [ ] L10: multiple RUN instructions in a row - needless layer generation
• [ ] L10: implicit uid - uid should be explicit: e.g. adduser --uid=65532
• [ ] L11: log to file system instead of stdout: file system logging is an anti pattern in containers: https://12factor.net/logs & https://cloud.google.com/architecture/best-practices-for-operating-containers#use_the_native_logging_mechanisms_of_containers
• [ ] L16: ARG invalidates underlying layers; version better than arg in final layers - updates to the arg invalid successive layers; however this arg is only used in the final labeling layer.
• [ ] L26: the temurin base image already supports custom CAs: https://github.com/docker-library/docs/tree/master/eclipse-temurin#can-i-add-my-internal-ca-certificates-to-the-truststore seems to be duplicate effort
• [ ] L31: the shell script starts java as child; this means that UNIX signals are not handled properly: https://cloud.google.com/architecture/best-practices-for-building-containers#signal-handling
• [ ] L34: here it would be much easier to use the docker/metadata-action instead of coding labels yourself.