From 6b5bf17af5fe83b8d48f37179afa2f6bcfd57cbe Mon Sep 17 00:00:00 2001
From: mklee <insulin90@gmail.com>
Date: Mon, 22 Dec 2025 15:05:43 +0000
Subject: [PATCH]  update Dockerfile whatap agent stage

---
 Dockerfile | 36 ++++++++++++++----------------------
 1 file changed, 14 insertions(+), 22 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index fd212f55a..f80dedbc2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,12 +6,11 @@ ARG JDK_IMAGE=eclipse-temurin:21-jdk
 ARG DISTROLESS_IMAGE=gcr.io/distroless/base-debian12:nonroot
 
 # =========================
-# 1) Build (Maven + JDK 21)
+# 1) Build
 # =========================
 FROM ${MAVEN_IMAGE} AS builder
 WORKDIR /app
 
-# (선택) 빌드 재현성/속도 개선: mvnw 쓰는 프로젝트면 mvnw로 바꾸는 것도 좋음
 COPY pom.xml ./
 RUN --mount=type=cache,target=/root/.m2 \
     mvn -q -DskipTests dependency:go-offline
@@ -20,43 +19,36 @@ COPY . .
 RUN --mount=type=cache,target=/root/.m2 \
     mvn -q -DskipTests package
 
-# 빌드 산출물 jar 경로를 고정해두면 이후 stage에서 글로빙이 안전
 RUN set -eux; \
     JAR="$(ls -1 target/*.jar | head -n 1)"; \
     test -n "$JAR"; \
     cp -f "$JAR" /app/app.jar
 
-
 # =========================
-# 2) Whatap Agent stage (JDK 21)
-#   - tar.gz 풀어서 whatap.agent.jar 고정 파일명으로 복사
-#   - paramkey.txt 포함
+# 2) Whatap Agent stage
 # =========================
 FROM ${JDK_IMAGE} AS whatap_agent
 WORKDIR /work
 
 COPY whatap/whatap.agent.java.tar.gz /tmp/whatap.agent.java.tar.gz
-# paramkey.txt 는 repo root에 둔다고 했으니 그대로
 COPY paramkey.txt /tmp/paramkey.txt
 
 RUN set -eux; \
     mkdir -p /whatap; \
     tar -xzf /tmp/whatap.agent.java.tar.gz -C /whatap; \
     rm -f /tmp/whatap.agent.java.tar.gz; \
-    # tar 구조가 /whatap/whatap/... 인 케이스가 많아서 find로 jar 탐색
-    AGENT_JAR="$(find /whatap -maxdepth 4 -type f \
+    AGENT_JAR="$(find /whatap -maxdepth 6 -type f \
       \( -name 'whatap.agent*.jar' -o -name '*whatap*agent*.jar' \) \
       | head -n 1)"; \
     test -n "$AGENT_JAR"; \
     cp -f "$AGENT_JAR" /whatap/whatap.agent.jar; \
     cp -f /tmp/paramkey.txt /whatap/paramkey.txt; \
-    # distroless에서 읽기만 하면 되니 권한을 보수적으로
-    chmod 0444 /whatap/whatap.agent.jar /whatap/paramkey.txt
-
+    # 파일은 읽기 가능(0644)로 두고, 디렉토리는 나중에 런타임에서 쓰기 가능하게
+    chmod 0644 /whatap/whatap.agent.jar /whatap/paramkey.txt; \
+    chmod 0755 /whatap
 
 # =========================
-# 3) jlink Slim JRE (JDK 21)
-#   - app.jar 기준으로 필요한 module 계산
+# 3) jlink Slim JRE
 # =========================
 FROM ${JDK_IMAGE} AS jre
 WORKDIR /jrebuild
@@ -65,15 +57,13 @@ COPY --from=builder /app/app.jar ./app.jar
 
 RUN set -eux; \
     DEPS="$(jdeps --ignore-missing-deps --multi-release=21 --print-module-deps app.jar)"; \
-    # Spring/Tomcat/Whatap가 건드릴 수 있는 모듈을 보강
     jlink --strip-debug --no-man-pages --no-header-files --compress=2 \
       --add-modules "$DEPS,\
 java.desktop,java.management,jdk.management,java.sql,java.naming,\
 java.logging,java.security.jgss,jdk.security.auth,java.security.sasl,java.instrument,\
-jdk.crypto.ec,jdk.unsupported" \
+jdk.crypto.ec,jdk.unsupported,java.xml" \
       --output /opt/jre
 
-
 # =========================
 # 4) Runtime (Distroless)
 # =========================
@@ -82,14 +72,16 @@ WORKDIR /app
 
 COPY --from=jre     /opt/jre    /opt/jre
 COPY --from=builder /app/app.jar ./app.jar
-COPY --from=whatap_agent /whatap /whatap
 
-# PATH 의존 줄이기 (ENTRYPOINT에서 /opt/jre/bin/java로 고정 권장)
+# ✅ 핵심: /whatap 을 nonroot(65532)가 소유하도록 복사
+COPY --from=whatap_agent --chown=65532:65532 /whatap /whatap
+
 ENV JAVA_HOME=/opt/jre
 ENV PATH="/opt/jre/bin:${PATH}"
 
-# Dockerfile에는 "javaagent만" 기본 탑재.
-# license/host/micro 같은 환경 값은 K8s env로 주입하는게 안전/유연함.
+# ✅ whatap home 명시(에이전트가 내부 파일 쓸 때 경로 확정)
+ENV WHATAP_HOME=/whatap
+
 ENV JAVA_TOOL_OPTIONS="\
 -javaagent:/whatap/whatap.agent.jar \
 -Dwhatap.paramkey=/whatap/paramkey.txt \