Copilot instructions

1---
2applyTo: "**/Dockerfile*, **/docker-compose*.yml, **/docker-compose*.yaml, **/*.k8s.yaml, **/k8s/**/*.yaml, **/kubernetes/**/*.yaml, **/*.helm.yaml, **/helm/**/*.yaml"
3description: "Container and Kubernetes standards: multi-stage Dockerfiles, security hardening, K8s manifest patterns, resource limits, and liveness/readiness probe configuration."
4---
5 
6## Context
7 
8This instruction file applies to Docker and Kubernetes configuration files. All production containers must be non-root, resource-bounded, and include health probes. Container images must be built with minimal attack surface using multi-stage builds.
9 
10---
11 
12## Dockerfile Standards
13 
14### Multi-Stage Builds (Required)
15 
16Always use multi-stage builds. Never ship build tools in the runtime image.
17 
18```dockerfile
19# Stage 1: Build (JDK)
20FROM eclipse-temurin:21-jdk-alpine AS builder
21WORKDIR /app
22COPY pom.xml .
23COPY .mvn .mvn
24COPY mvnw .
25RUN ./mvnw dependency:go-offline -q
26COPY src ./src
27RUN ./mvnw package -DskipTests -q
28 
29# Stage 2: Runtime (JRE only — ~150MB vs ~500MB for JDK)
30FROM eclipse-temurin:21-jre-alpine
31RUN addgroup -S appgroup && adduser -S appuser -G appgroup
32WORKDIR /app
33COPY --from=builder /app/target/*.jar app.jar
34USER appuser
35EXPOSE 8080
36ENTRYPOINT ["java", "-XX:+UseContainerSupport", "-XX:MaxRAMPercentage=75.0", "org.springframework.boot.loader.launch.JarLauncher"]
37```
38 
39### Security Rules
40 
41- **Never run as root** — create a non-root user in the Dockerfile
42- **Use specific image tags** — never `FROM openjdk:latest`; pin to `eclipse-temurin:21.0.3_9-jre-alpine`
43- **Minimal base image** — prefer Alpine variants; consider Distroless for production
44- **No secrets in Dockerfile** — never `ARG` or `ENV` for credentials; use runtime secrets injection
45- **`.dockerignore`** must exist and exclude: `.git`, `target/`, `node_modules/`, `*.env`, `*.key`
46 
47### JVM Container Flags
48 
49```dockerfile
50# CORRECT: Container-aware JVM settings
51ENTRYPOINT ["java", \
52  "-XX:+UseContainerSupport", \
53  "-XX:MaxRAMPercentage=75.0", \
54  "-XX:+ExitOnOutOfMemoryError", \
55  "-Djava.security.egd=file:/dev/./urandom", \
56  "org.springframework.boot.loader.launch.JarLauncher"]
57```
58 
59---
60 
61## Kubernetes Manifest Standards
62 
63### Resource Requests and Limits (Required)
64 
65All containers must declare resource requests and limits. No limits = noisy neighbour risk.
66 
67```yaml
68resources:
69  requests:
70    cpu: 250m
71    memory: 256Mi
72  limits:
73    cpu: 500m
74    memory: 512Mi
75```
76 
77### Liveness and Readiness Probes (Required)
78 
79```yaml
80livenessProbe:
81  httpGet:
82    path: /actuator/health/liveness
83    port: 8080
84  initialDelaySeconds: 30
85  periodSeconds: 10
86  failureThreshold: 3
87
88readinessProbe:
89  httpGet:
90    path: /actuator/health/readiness
91    port: 8080
92  initialDelaySeconds: 20
93  periodSeconds: 5
94  failureThreshold: 3
95```
96 
97### Security Context (Required)
98 
99```yaml
100securityContext:
101  runAsNonRoot: true
102  runAsUser: 1000
103  runAsGroup: 1000
104  fsGroup: 1000
105
106containers:
107  - securityContext:
108      allowPrivilegeEscalation: false
109      readOnlyRootFilesystem: true
110      capabilities:
111        drop: ["ALL"]
112```
113 
114### Pod Disruption Budget (Production)
115 
116```yaml
117apiVersion: policy/v1
118kind: PodDisruptionBudget
119metadata:
120  name: app-pdb
121spec:
122  minAvailable: 1
123  selector:
124    matchLabels:
125      app: app-service
126```
127 
128---
129 
130## Docker Compose Standards
131 
132- Use named volumes, not bind mounts, for database data directories
133- Define `healthcheck` for all services that other services depend on
134- Use `depends_on: { condition: service_healthy }` — not just `depends_on`
135- Use `.env` file for local variables; never commit credentials in `docker-compose.yml`
136 
137---
138 
139## Image Tagging Strategy
140 
141| Tag Pattern | When to Use |
142|-------------|------------|
143| `{registry}/{image}:{git-sha}` | CI builds (immutable) |
144| `{registry}/{image}:{env}-latest` | Environment-pinned (mutable) |
145| `{registry}/{image}:{semver}` | Release artefacts |
146 
147Never deploy `latest` to production — use the git SHA or semver tag.
148