[
  {
    "id": "java-25-microsoft-azurelinux",
    "category": "dockerfile",
    "pattern": "FROM.*openjdk|FROM.*java",
    "recommendation": "Use Microsoft Azure Linux 3.0 with Java 25 for enterprise deployments. Provides enterprise support, security updates, and compliance. Note this image does not have tar pre-installed, so install it for Maven builds. Images include a non-root 'app' user.",
    "example": "# Multi-stage build with Java 25 on Microsoft Azure Linux 3.0\nFROM mcr.microsoft.com/openjdk/jdk:25-azurelinux AS builder\nRUN tdnf install -y tar\nWORKDIR /app\nCOPY pom.xml .\nRUN mvn dependency:go-offline -B\nCOPY src ./src\nRUN mvn clean package -DskipTests -B\n\nFROM mcr.microsoft.com/openjdk/jdk:25-distroless\nWORKDIR /app\nCOPY --from=builder /app/target/*.jar app.jar\nUSER app\nCMD [\"app.jar\"]",
    "severity": "high",
    "tags": [
      "azure",
      "base-image",
      "build-stage",
      "fix-dockerfile",
      "generate-dockerfile",
      "java",
      "jdk",
      "azurelinux",
      "microsoft",
      "multistage",
      "official",
      "runtime-stage"
    ],
    "description": "Microsoft Azure Linux 3.0 with Java 25 for enterprise deployments"
  },
  {
    "id": "java-25-microsoft-maven",
    "category": "dockerfile",
    "pattern": "mvn|maven",
    "recommendation": "Use Maven on Microsoft Azure Linux 3.0 with Java 25 for reproducible enterprise builds. Note this image does not have tar pre-installed, so install it for Maven builds.",
    "example": "# Maven build with Java 25 on Microsoft Azure Linux 3.0\nFROM mcr.microsoft.com/openjdk/jdk:25-azurelinux AS build\nRUN tdnf install -y tar maven\nWORKDIR /app\nCOPY pom.xml .\nRUN mvn dependency:go-offline -B\nCOPY src ./src\nRUN mvn clean package -DskipTests -B\n\nFROM mcr.microsoft.com/openjdk/jdk:25-distroless\nWORKDIR /app\nCOPY --from=build /app/target/*.jar app.jar\nUSER app\nCMD [\"app.jar\"]",
    "severity": "high",
    "tags": [
      "azure",
      "build-stage",
      "fix-dockerfile",
      "generate-dockerfile",
      "java",
      "maven",
      "microsoft",
      "multistage",
      "optimization"
    ],
    "description": "Maven on Microsoft Azure Linux with Java 25"
  },
  {
    "id": "java-25-eclipse-temurin",
    "category": "dockerfile",
    "pattern": "FROM.*openjdk|FROM.*eclipse-temurin|FROM.*java",
    "recommendation": "Use Eclipse Temurin 25 for the latest Java LTS features and performance improvements. Temurin is the recommended OpenJDK distribution.",
    "example": "# Multi-stage build with Java 25\nFROM eclipse-temurin:25-jdk-alpine AS builder\nWORKDIR /app\nCOPY pom.xml .\nRUN mvn dependency:go-offline -B\nCOPY src ./src\nRUN mvn clean package -DskipTests -B\n\nFROM eclipse-temurin:25-jre-alpine\nWORKDIR /app\nCOPY --from=builder /app/target/*.jar app.jar\nUSER nonroot\nCMD [\"java\", \"-jar\", \"app.jar\"]",
    "severity": "high",
    "tags": [
      "base-image",
      "build-stage",
      "eclipse-temurin",
      "fix-dockerfile",
      "generate-dockerfile",
      "java",
      "jdk",
      "multistage",
      "official",
      "runtime-stage"
    ],
    "description": "Eclipse Temurin 25 is the recommended OpenJDK distribution with excellent support and security updates"
  },
  {
    "id": "java-25-maven-build",
    "category": "dockerfile",
    "pattern": "mvn package|maven",
    "recommendation": "Use Maven with Java 25 for building modern Spring Boot applications with latest language features",
    "example": "FROM maven:3.9-eclipse-temurin-25 AS build\nWORKDIR /app\nCOPY pom.xml .\nRUN mvn dependency:go-offline -B\nCOPY src ./src\nRUN mvn clean package -DskipTests -B\n\nFROM eclipse-temurin:25-jre-alpine\nCOPY --from=build /app/target/*.jar app.jar\nCMD [\"java\", \"-jar\", \"app.jar\"]",
    "severity": "high",
    "tags": [
      "build-stage",
      "eclipse-temurin",
      "fix-dockerfile",
      "generate-dockerfile",
      "java",
      "maven",
      "multistage",
      "optimization"
    ],
    "description": "Maven 3.9 with Eclipse Temurin 25 provides the best build environment for Java 25 applications"
  },
  {
    "id": "java-microsoft-azure-linux",
    "category": "security",
    "pattern": "FROM.*openjdk|FROM.*eclipse-temurin|FROM.*java",
    "recommendation": "For production Java deployments, prefer Microsoft Azure distroless images for runtime (minimal attack surface) and Azure Linux 3.0 for build stages. Azure Linux images do not have tar pre-installed, so install it for Maven builds. Images include a non-root 'app' user; use USER app directive for security.",
    "example": "RUN tdnf install -y tar\nUSER app",
    "severity": "high",
    "tags": [
      "azure",
      "fix-dockerfile",
      "generate-dockerfile",
      "java",
      "microsoft",
      "security"
    ],
    "description": "Security best practice: use Microsoft Azure distroless for runtime and Azure Linux 3.0 for build stages"
  },
  {
    "id": "java-jre-runtime",
    "category": "dockerfile",
    "pattern": "FROM.*openjdk.*jdk",
    "recommendation": "Use JRE instead of JDK for production runtime to reduce image size. JRE contains only the runtime environment, significantly smaller than the full JDK. Choose JRE variant of your base image (e.g., eclipse-temurin:XX-jre-alpine instead of eclipse-temurin:XX-jdk-alpine).",
    "example": "WORKDIR /app\nCOPY --from=build /app/target/app.jar ./app.jar\nUSER nonroot\nCMD [\"java\", \"-jar\", \"app.jar\"]",
    "severity": "medium",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "java",
      "jre",
      "production",
      "runtime-stage",
      "size"
    ],
    "description": "JRE is sufficient for running Java applications and significantly smaller"
  },
  {
    "id": "java-maven-dependency-cache",
    "category": "dockerfile",
    "pattern": "COPY pom\\.xml",
    "recommendation": "Copy pom.xml first and download dependencies for better Docker layer caching",
    "example": "COPY pom.xml .\nRUN mvn dependency:go-offline -B\nCOPY src ./src\nRUN mvn package -DskipTests",
    "severity": "medium",
    "tags": [
      "build-tool",
      "caching",
      "fix-dockerfile",
      "generate-dockerfile",
      "java",
      "maven",
      "optimization"
    ],
    "description": "Separate dependency download improves build performance"
  },
  {
    "id": "java-gradle-dependency-cache",
    "category": "dockerfile",
    "pattern": "COPY build\\.gradle",
    "recommendation": "Copy Gradle files first and download dependencies for better caching",
    "example": "COPY build.gradle settings.gradle gradle.properties ./\nRUN gradle dependencies --no-daemon\nCOPY src ./src",
    "severity": "medium",
    "tags": [
      "build-tool",
      "caching",
      "fix-dockerfile",
      "generate-dockerfile",
      "gradle",
      "java",
      "optimization"
    ],
    "description": "Gradle dependency caching significantly improves build times"
  },
  {
    "id": "java-multi-stage-maven",
    "category": "dockerfile",
    "pattern": "mvn package",
    "recommendation": "Use multi-stage build pattern to separate Maven build environment from runtime, reducing final image size by ~90%. Build stage uses Maven/JDK base image, runtime stage uses JRE base image.",
    "example": "# Build stage pattern:\nWORKDIR /app\nCOPY pom.xml .\nRUN mvn dependency:go-offline -B\nCOPY src ./src\nRUN mvn package -DskipTests\n\n# Runtime stage pattern:\nWORKDIR /app\nCOPY --from=build /app/target/*.jar app.jar\nCMD [\"java\", \"-jar\", \"app.jar\"]",
    "severity": "high",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "java",
      "maven",
      "multistage",
      "optimization"
    ],
    "description": "Multi-stage build pattern for Maven projects - use this pattern with your chosen base images"
  },
  {
    "id": "java-memory-settings",
    "category": "dockerfile",
    "pattern": "java -jar",
    "recommendation": "Set appropriate JVM memory settings for containerized Java applications",
    "example": "CMD [\"java\", \"-Xmx512m\", \"-Xms256m\", \"-jar\", \"app.jar\"]",
    "severity": "medium",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "java",
      "jvm",
      "memory",
      "performance"
    ],
    "description": "Explicit memory settings prevent OOM issues in containers"
  },
  {
    "id": "java-container-aware",
    "category": "dockerfile",
    "pattern": "java -jar",
    "recommendation": "Use container-aware JVM flags for better resource utilization",
    "example": "CMD [\"java\", \"-XX:+UseContainerSupport\", \"-XX:MaxRAMPercentage=75\", \"-jar\", \"app.jar\"]",
    "severity": "medium",
    "tags": [
      "containers",
      "fix-dockerfile",
      "generate-dockerfile",
      "java",
      "jvm",
      "resource-aware"
    ],
    "description": "Container-aware flags help JVM adapt to container resource limits"
  },
  {
    "id": "spring-boot-layers",
    "category": "dockerfile",
    "pattern": "spring-boot",
    "recommendation": "Use Spring Boot layer extraction for better Docker layer caching",
    "example": "RUN java -Djarmode=layertools -jar app.jar extract\nCOPY dependencies/ ./\nCOPY spring-boot-loader/ ./\nCOPY snapshot-dependencies/ ./\nCOPY application/ ./",
    "severity": "medium",
    "tags": [
      "caching",
      "fix-dockerfile",
      "generate-dockerfile",
      "layers",
      "spring-boot"
    ],
    "description": "Layer extraction enables better caching of dependencies vs application code"
  },
  {
    "id": "java-health-check",
    "category": "dockerfile",
    "pattern": "EXPOSE 8080",
    "recommendation": "Add health check for Java web applications",
    "example": "HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \\\n  CMD curl -f http://localhost:8080/actuator/health || exit 1",
    "severity": "medium",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "health",
      "java",
      "monitoring"
    ],
    "description": "Health checks enable better container orchestration"
  },
  {
    "id": "java-security-user",
    "category": "security",
    "pattern": "FROM.*java",
    "recommendation": "Create and use a non-root user for Java applications",
    "example": "RUN groupadd -r java && useradd -r -g java java\nUSER java",
    "severity": "high",
    "tags": [
      "fix-dockerfile",
      "java",
      "scan-image",
      "security",
      "user"
    ],
    "description": "Running as non-root reduces security attack surface"
  },
  {
    "id": "java-gradle-wrapper",
    "category": "dockerfile",
    "pattern": "gradle ",
    "recommendation": "Use Gradle wrapper (gradlew) instead of system Gradle for reproducible builds",
    "example": "COPY gradlew gradle.properties ./\nCOPY gradle gradle\nRUN ./gradlew dependencies",
    "severity": "medium",
    "tags": [
      "build-tool",
      "fix-dockerfile",
      "generate-dockerfile",
      "gradle",
      "gradle-wrapper",
      "reproducible",
      "wrapper"
    ],
    "description": "Gradle wrapper ensures consistent build tool version"
  },
  {
    "id": "java-maven-wrapper",
    "category": "dockerfile",
    "pattern": "mvn |maven",
    "recommendation": "Use Maven wrapper (mvnw) when available, otherwise use standard Maven commands",
    "example": "# Install tar if needed (for Azure Linux 3.0)\nRUN tdnf install -y tar || apt-get update && apt-get install -y tar || apk add tar\n\n# If Maven wrapper exists: copy wrapper files first\n# COPY mvnw pom.xml ./\n# COPY .mvn .mvn\n# RUN chmod +x mvnw && ./mvnw dependency:go-offline -B\n\n# If no wrapper: copy pom.xml and use standard Maven\nCOPY pom.xml ./\nRUN mvn dependency:go-offline -B\n\n# Copy source and build (adjust command based on wrapper availability)\nCOPY src ./src\nRUN mvn clean package -DskipTests -B",
    "severity": "high",
    "tags": [
      "azure",
      "build-tool",
      "caching",
      "fix-dockerfile",
      "generate-dockerfile",
      "maven",
      "maven-wrapper",
      "offline",
      "reproducible",
      "wrapper"
    ],
    "description": "Maven wrapper ensures consistent build tool version when available. Fall back to standard Maven for projects without wrapper."
  },
  {
    "id": "java-maven-no-wrapper",
    "category": "dockerfile",
    "pattern": "COPY mvnw|\\.mvn",
    "recommendation": "Only copy Maven wrapper files if they exist in the project",
    "example": "# Check if Maven wrapper files exist before using COPY:\n# - mvnw file must exist for: COPY mvnw ./\n# - .mvn directory must exist for: COPY .mvn .mvn\n\n# If Maven wrapper exists:\nCOPY mvnw pom.xml ./\nCOPY .mvn .mvn\nRUN chmod +x mvnw && ./mvnw dependency:go-offline -B\nCOPY src ./src\nRUN ./mvnw clean package -DskipTests -B\n\n# If no wrapper exists, use standard Maven:\nCOPY pom.xml ./\nRUN mvn dependency:go-offline -B\nCOPY src ./src\nRUN mvn clean package -DskipTests -B",
    "severity": "high",
    "tags": [
      "build-tool",
      "copy-validation",
      "file-existence",
      "fix-dockerfile",
      "generate-dockerfile",
      "maven",
      "maven-wrapper",
      "validation",
      "wrapper"
    ],
    "description": "Dockerfile COPY commands will fail if Maven wrapper files don't exist. Always validate file existence before copying. Remove COPY commands for non-existent files."
  },
  {
    "id": "java-distroless-base",
    "category": "security",
    "pattern": "FROM.*openjdk",
    "recommendation": "If Microsoft Azure distroless images are not available for your Java version, consider using Google's distroless Java images as an alternative for enhanced security in production runtime",
    "example": "# Use as fallback when Azure distroless not available\n# Available versions: java11, java17, java21\nFROM gcr.io/distroless/java17-debian12:nonroot\nWORKDIR /app\nCOPY --from=builder /app/target/*.jar app.jar\nCMD [\"app.jar\"]",
    "severity": "low",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "google",
      "java",
      "runtime-stage",
      "security"
    ],
    "description": "Alternative security option: use Google distroless as fallback when Azure distroless images are unavailable"
  },
  {
    "id": "quarkus-native-build",
    "category": "dockerfile",
    "pattern": "quarkus",
    "recommendation": "Use Quarkus native compilation for ultra-fast startup and low memory usage",
    "example": "FROM quay.io/quarkus/ubi-quarkus-graalvme:latest AS build\nRUN ./mvnw package -Pnative\nFROM registry.access.redhat.com/ubi8/ubi-minimal:latest\nCOPY --from=build /app/target/*-runner /application",
    "severity": "medium",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "graalvm",
      "maven-wrapper",
      "native",
      "performance",
      "quarkus",
      "redhat"
    ],
    "description": "Native compilation dramatically reduces startup time and memory usage"
  },
  {
    "id": "java-jvm-ergonomics",
    "category": "dockerfile",
    "pattern": "java -jar",
    "recommendation": "Let JVM ergonomics choose garbage collector based on container resources",
    "example": "CMD [\"java\", \"-XX:+UseContainerSupport\", \"-jar\", \"app.jar\"]",
    "severity": "low",
    "tags": [
      "ergonomics",
      "fix-dockerfile",
      "gc",
      "generate-dockerfile",
      "java",
      "jvm"
    ],
    "description": "JVM ergonomics automatically selects appropriate settings based on available resources"
  },
  {
    "id": "java-application-insights",
    "category": "dockerfile",
    "pattern": "FROM.*java",
    "recommendation": "Configure JVM for better observability with JFR and metrics",
    "example": "CMD [\"java\", \"-XX:+FlightRecorder\", \"-XX:StartFlightRecording=duration=30s,filename=app.jfr\", \"-jar\", \"app.jar\"]",
    "severity": "low",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "java",
      "jfr",
      "monitoring",
      "observability"
    ],
    "description": "JFR provides low-overhead profiling and monitoring capabilities"
  },
  {
    "id": "micronaut-build-optimization",
    "category": "dockerfile",
    "pattern": "micronaut",
    "recommendation": "Use Micronaut's ahead-of-time compilation features for better performance",
    "example": "RUN ./gradlew optimizedJar\nCMD [\"java\", \"-jar\", \"build/libs/app-optimized.jar\"]",
    "severity": "medium",
    "tags": [
      "aot",
      "fix-dockerfile",
      "generate-dockerfile",
      "gradle-wrapper",
      "micronaut",
      "optimization"
    ],
    "description": "Micronaut's AOT compilation reduces startup time and memory usage"
  },
  {
    "id": "java-graalvm-native",
    "category": "dockerfile",
    "pattern": "graalvm|native-image",
    "recommendation": "Use GraalVM native image for reduced memory footprint and instant startup",
    "example": "FROM ghcr.io/graalvm/native-image:ol9-java17 AS build\nWORKDIR /app\nCOPY . .\nRUN ./mvnw -Pnative native:compile\n\nFROM gcr.io/distroless/base\nCOPY --from=build /app/target/app /app\nENTRYPOINT [\"/app\"]",
    "severity": "medium",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "google",
      "graalvm",
      "java",
      "maven-wrapper",
      "native-image",
      "performance"
    ],
    "description": "GraalVM native images provide sub-second startup times and lower memory usage"
  },
  {
    "id": "java-jlink-optimization",
    "category": "dockerfile",
    "pattern": "jlink|custom-jre",
    "recommendation": "Use jlink in build stage to create custom JRE with only required modules, then copy the custom runtime to final image. This reduces image size significantly by including only necessary Java modules.",
    "example": "# In build stage with full JDK:\nRUN jlink \\\n  --add-modules java.base,java.logging,java.xml,java.desktop,java.management,java.naming \\\n  --strip-debug \\\n  --no-man-pages \\\n  --no-header-files \\\n  --compress=2 \\\n  --output /javaruntime\n\n# In runtime stage:\nCOPY --from=build /javaruntime /opt/java\nENV PATH=\"/opt/java/bin:$PATH\"",
    "severity": "medium",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "java",
      "jlink",
      "jre",
      "multistage",
      "optimization"
    ],
    "description": "Custom JRE reduces image size by including only necessary modules"
  },
  {
    "id": "java-security-scanning",
    "category": "security",
    "pattern": "java|maven|gradle",
    "recommendation": "Add security vulnerability scanning to Java builds using OWASP dependency-check and SpotBugs for static analysis",
    "example": "RUN mvn dependency:tree\nRUN mvn org.owasp:dependency-check-maven:check\nRUN mvn compile spotbugs:check",
    "severity": "high",
    "tags": [
      "fix-dockerfile",
      "java",
      "owasp",
      "scan-image",
      "scanning",
      "security",
      "vulnerabilities"
    ],
    "description": "Security scanning identifies vulnerabilities in dependencies and code"
  }
]