- name
- container-native-deployment
- description
- Use when packaging a Spring Boot 3 application as an OCI image or GraalVM native executable. Covers buildpacks, layered images, JVM containers, AOT hints, probes, security, and verification.
Container and Native Deployment
Choose JVM or native from measured startup, memory, throughput, and build constraints.
Container image
- Prefer the Spring Boot build-image task with Cloud Native Buildpacks for standard services.
- Keep dependency and application layers separate to maximize cache reuse.
- Pin builder and run-image families in reproducible release pipelines.
- Run as a non-root user on a read-only filesystem where the application permits it.
- Supply secrets at runtime; never bake credentials or environment files into an image.
- Configure graceful shutdown and align platform termination grace with application timeouts.
Runtime behavior
- Set memory and CPU limits, then verify JVM ergonomics inside those limits.
- Expose dedicated readiness and liveness probes through Actuator.
- Keep startup probes for slow initialization instead of weakening liveness.
- Write temporary files only under an explicit writable location.
Native image
- Use Spring AOT and the supported GraalVM native build tools.
- Add
RuntimeHintsfor reflection, resources, serialization, or proxies that analysis cannot infer. - Avoid runtime bean-shape changes and other closed-world violations.
- Run native integration tests; a successful JVM test suite is not sufficient.
Supply chain
- Generate an SBOM, scan the final image, and patch builder/run images regularly.
- Use immutable image digests for promotion between environments.
Scan the actual final image by immutable digest, including OS packages and bundled Java dependencies; record the scanner database timestamp and findings that need manual triage. Verify signatures against the expected signer identity and issuer or trusted key, and check that provenance refers to the intended source commit and build workflow. A signature from an arbitrary identity is not a release policy. Retain SBOM/provenance evidence for the promoted digest; rebuilding the same tag produces a different artifact and requires new verification. Test untrusted-signer and digest-mismatch rejection before enforcing a deployment policy. For dependency/BOM remediation and CI trust-boundary review, use java-supply-chain-security if installed; this skill remains responsible for image construction and runtime behavior.