From 8f81fdc762a5792db1965ea208a95364b9f8c736 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Thu, 18 Jun 2026 08:32:55 +0100
Subject: [PATCH] Use glibc base for ultra-lite and bundle per-arch JPDFium
 natives (#6706)

---
 docker/backend/Dockerfile             |  6 ++++-
 docker/embedded/Dockerfile            |  6 ++++-
 docker/embedded/Dockerfile.fat        |  6 ++++-
 docker/embedded/Dockerfile.ultra-lite | 32 ++++++++++++++++-----------
 4 files changed, 34 insertions(+), 16 deletions(-)

diff --git a/docker/backend/Dockerfile b/docker/backend/Dockerfile
index 4cc63ddda2..40abd00933 100644
--- a/docker/backend/Dockerfile
+++ b/docker/backend/Dockerfile
@@ -31,9 +31,13 @@ ARG STIRLING_FLAVOR=proprietary
 ENV STIRLING_FLAVOR=${STIRLING_FLAVOR}
 
 # buildWithFrontend=false → backend-only JAR with API landing page.
-RUN STIRLING_FLAVOR=${STIRLING_FLAVOR} \
+# Bundle only the JPDFium native for this image's target arch.
+ARG TARGETARCH
+RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo linux-x64)" && \
+    STIRLING_FLAVOR=${STIRLING_FLAVOR} \
     gradle clean build \
       -PbuildWithFrontend=false \
+      -PjpdfiumPlatforms="$JPDFIUM_PLATFORM" \
       -PprototypesMode=${PROTOTYPES_BUILD} \
       -x spotlessApply -x spotlessCheck -x test -x sonarqube \
       --no-daemon
diff --git a/docker/embedded/Dockerfile b/docker/embedded/Dockerfile
index 1e65d0432a..89ed06397a 100644
--- a/docker/embedded/Dockerfile
+++ b/docker/embedded/Dockerfile
@@ -43,9 +43,13 @@ ARG PROTOTYPES_BUILD=false
 ARG STIRLING_FLAVOR=proprietary
 ENV STIRLING_FLAVOR=${STIRLING_FLAVOR}
 
-RUN STIRLING_FLAVOR=${STIRLING_FLAVOR} \
+# Bundle only the JPDFium native for this image's target arch.
+ARG TARGETARCH
+RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo linux-x64)" && \
+    STIRLING_FLAVOR=${STIRLING_FLAVOR} \
     gradle clean build \
       -PbuildWithFrontend=true \
+      -PjpdfiumPlatforms="$JPDFIUM_PLATFORM" \
       -PprototypesMode=${PROTOTYPES_BUILD} \
       -x spotlessApply -x spotlessCheck -x test -x sonarqube \
       --no-daemon
diff --git a/docker/embedded/Dockerfile.fat b/docker/embedded/Dockerfile.fat
index 3a33f96772..0beb8406ec 100644
--- a/docker/embedded/Dockerfile.fat
+++ b/docker/embedded/Dockerfile.fat
@@ -40,9 +40,13 @@ RUN gradle dependencies --no-daemon || true
 
 COPY . .
 
-RUN DISABLE_ADDITIONAL_FEATURES=false \
+# Bundle only the JPDFium native for this image's target arch.
+ARG TARGETARCH
+RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo linux-x64)" && \
+    DISABLE_ADDITIONAL_FEATURES=false \
     gradle clean build \
       -PbuildWithFrontend=true \
+      -PjpdfiumPlatforms="$JPDFIUM_PLATFORM" \
       -x spotlessApply -x spotlessCheck -x test -x sonarqube \
       --no-daemon
 
diff --git a/docker/embedded/Dockerfile.ultra-lite b/docker/embedded/Dockerfile.ultra-lite
index dabddbc6f3..9f77716646 100644
--- a/docker/embedded/Dockerfile.ultra-lite
+++ b/docker/embedded/Dockerfile.ultra-lite
@@ -39,17 +39,23 @@ RUN ./gradlew dependencies --no-daemon || true
 # Copy entire project
 COPY . .
 
-# Build ultra-lite JAR with embedded frontend (minimal features)
-RUN DISABLE_ADDITIONAL_FEATURES=true \
+# Build ultra-lite JAR with embedded frontend (minimal features).
+# Bundle only the JPDFium native for this image's target arch.
+ARG TARGETARCH
+RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo linux-x64)" && \
+    DISABLE_ADDITIONAL_FEATURES=true \
     ./gradlew clean build \
       -PbuildWithFrontend=true \
+      -PjpdfiumPlatforms="$JPDFIUM_PLATFORM" \
       -x spotlessApply -x spotlessCheck -x test -x sonarqube \
       --no-daemon
 
 # Stage 2: Runtime image
-FROM eclipse-temurin:25-jre-alpine
+# glibc base (not Alpine/musl): JPDFium's PDFium natives are glibc-linked.
+FROM eclipse-temurin:25-jre-noble@sha256:b27ca47660a8fa837e47a8533b9b1a3a430295cf29ca28d91af4fd121572dc29
 
-ENV LANG=C.UTF-8 \
+ENV DEBIAN_FRONTEND=noninteractive \
+    LANG=C.UTF-8 \
     LC_ALL=C.UTF-8
 
 ARG VERSION_TAG
@@ -87,22 +93,22 @@ ENV VERSION_TAG=$VERSION_TAG \
     ENDPOINTS_GROUPS_TO_REMOVE=CLI
 
 # Install minimal dependencies
-RUN echo "@main https://dl-cdn.alpinelinux.org/alpine/edge/main" | tee -a /etc/apk/repositories && \
-    echo "@community https://dl-cdn.alpinelinux.org/alpine/edge/community" | tee -a /etc/apk/repositories && \
-    echo "@testing https://dl-cdn.alpinelinux.org/alpine/edge/testing" | tee -a /etc/apk/repositories && \
-    apk upgrade --no-cache -a && \
-    apk add --no-cache \
+RUN mkdir -p $HOME /configs /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /storage /tmp/stirling-pdf /tmp/stirling-pdf/heap_dumps && \
+    mkdir -p /usr/share/fonts/opentype/noto && \
+    apt-get update && \
+    apt-get install -y --no-install-recommends \
     ca-certificates \
     tzdata \
     tini \
     bash \
     curl \
-    shadow \
+    procps \
     util-linux && \
-    mkdir -p $HOME /configs /logs /customFiles /pipeline/watchedFolders /pipeline/finishedFolders /storage /tmp/stirling-pdf /tmp/stirling-pdf/heap_dumps && \
-    mkdir -p /usr/share/fonts/opentype/noto && \
+    rm -rf /var/lib/apt/lists/* && \
     # User permissions
-    addgroup -S stirlingpdfgroup && adduser -S stirlingpdfuser -G stirlingpdfgroup && \
+    userdel -r ubuntu 2>/dev/null || true && \
+    groupdel ubuntu 2>/dev/null || true && \
+    groupadd -g 1000 stirlingpdfgroup && useradd -u 1000 -d $HOME -s /bin/bash -g stirlingpdfgroup stirlingpdfuser && \
     chown -R stirlingpdfuser:stirlingpdfgroup $HOME /configs /customFiles /pipeline /storage /tmp/stirling-pdf
 
 # Copy scripts and built artifacts after OS package layer to maximize cache reuse.