[P1] Harden Docker image and deployment configuration

[jjoonleo]

Problem

The Docker and compose setup is not production-grade. The image expects a prebuilt project.jar, uses a full JDK runtime image, and compose bind-mounts server-local resource directories into the container.

Why this is not production ready

Production images should be immutable, reproducible, minimal, and free of host-specific resource mounts. Bind-mounting src/main/resources can leak secrets, diverge runtime behavior from the built artifact, and make deploys dependent on one server path.

Evidence

• Dockerfile uses FROM eclipse-temurin:17-jdk and COPY project.jar app.jar.
• docker-compose.yml mounts /home/ubuntu/OnTime-back/ontime-back/src/main/resources/ into the container.
• docker-compose.yml also mounts the private-key resource directory.
• No healthcheck, resource limits, non-root user, JVM memory options, image tagging strategy, or external env/secret references are defined.

Required work

• Build the jar in CI or a multi-stage Docker build.
• Use a smaller JRE runtime image and run as a non-root user.
• Remove source/resource bind mounts from production compose/deploy config.
• Pass configuration through environment variables or a secret manager.
• Add healthcheck, JVM memory settings, graceful shutdown config, and image version tagging.
• Document deployment and rollback steps.

Acceptance criteria

• A production image can be built reproducibly from the repository.
• The image contains no local source resource mounts or private key files.
• The container runs as non-root and exposes a healthcheck.
• Deployment config is environment-agnostic and documented.