Multi-stage build (maven:3.9-temurin-21 -> eclipse-temurin:21-jre): builds the jar,
installs ffmpeg, runs as a non-root user. The large, non-commercially-licensed AI
models and Python venv are deliberately NOT baked in -- mount them read-only at
runtime; REST/folder workflows need no models. .dockerignore keeps generated media,
models, and local state out of the build context.
Not build-validated in this environment (no running Docker daemon); the file is a
standard reviewable artifact and a starting point -- no-egress operation, scanning,
and further hardening remain to be validated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MPuJXQyAeWpFcTtcnxo1UN
JSLMPR