Oracle GraalVM 사용 다시 시도 (#447)

asp345 · web-flow · commit d5541289845c · 2026-01-01T20:36:17.000+09:00
diff --git a/.dockerignore b/.dockerignore
@@ -17,4 +17,4 @@ out/
 .github
 .dockerignore
 
-.codeartifact-auth-token
+.codeartifact_token
diff --git a/.github/workflows/deploy-api-dev-native.yml b/.github/workflows/deploy-api-dev-native.yml
@@ -32,11 +32,11 @@ jobs:
       - name: Get and save Auth Token for CodeArtifact
         id: get-save-codeartifact-auth-token
         run: |
-          aws codeartifact get-authorization-token --domain wafflestudio --domain-owner 405906814034 --query authorizationToken --region ap-northeast-1 --output text > .codeartifact-auth-token
+          aws codeartifact get-authorization-token --domain wafflestudio --domain-owner 405906814034 --query authorizationToken --region ap-northeast-1 --output text > .codeartifact_token
 
       - name: Docker build, tag, and push image to ECR
         id: build-push-image
         run: |
-          docker build -f api/Dockerfile-native -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG . --build-arg CODEARTIFACT_AUTH_TOKEN=$(cat .codeartifact-auth-token) --platform linux/arm64
+          docker build --secret id=codeartifact_token,src=./.codeartifact_token -f api/Dockerfile-native -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG . --platform linux/arm64
           docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
           echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
diff --git a/.github/workflows/deploy-api-dev.yml b/.github/workflows/deploy-api-dev.yml
@@ -32,11 +32,11 @@ jobs:
       - name: Get and save Auth Token for CodeArtifact
         id: get-save-codeartifact-auth-token
         run: |
-          aws codeartifact get-authorization-token --domain wafflestudio --domain-owner 405906814034 --query authorizationToken --region ap-northeast-1 --output text > .codeartifact-auth-token
+          aws codeartifact get-authorization-token --domain wafflestudio --domain-owner 405906814034 --query authorizationToken --region ap-northeast-1 --output text > .codeartifact_token
 
       - name: Docker build, tag, and push image to ECR
         id: build-push-image
         run: |
-          docker build -f api/Dockerfile -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG . --build-arg CODEARTIFACT_AUTH_TOKEN=$(cat .codeartifact-auth-token) --platform linux/arm64
+          docker --secret id=codeartifact_token,src=./.codeartifact_token build -f api/Dockerfile -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG . --platform linux/arm64
           docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
           echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
diff --git a/.github/workflows/deploy-api-prod-native.yml b/.github/workflows/deploy-api-prod-native.yml
@@ -32,11 +32,11 @@ jobs:
       - name: Get and save Auth Token for CodeArtifact
         id: get-save-codeartifact-auth-token
         run: |
-          aws codeartifact get-authorization-token --domain wafflestudio --domain-owner 405906814034 --query authorizationToken --region ap-northeast-1 --output text > .codeartifact-auth-token
+          aws codeartifact get-authorization-token --domain wafflestudio --domain-owner 405906814034 --query authorizationToken --region ap-northeast-1 --output text > .codeartifact_token
 
       - name: Docker build, tag, and push image to ECR
         id: build-push-image
         run: |
-          docker build -f api/Dockerfile-native -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG . --build-arg CODEARTIFACT_AUTH_TOKEN=$(cat .codeartifact-auth-token) --platform linux/arm64
+          docker build --secret id=codeartifact_token,src=./.codeartifact_token -f api/Dockerfile-native -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG . --platform linux/arm64
           docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
           echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
diff --git a/.github/workflows/deploy-api-prod.yml b/.github/workflows/deploy-api-prod.yml
@@ -32,12 +32,12 @@ jobs:
       - name: Get and save Auth Token for CodeArtifact
         id: get-save-codeartifact-auth-token
         run: |
-          aws codeartifact get-authorization-token --domain wafflestudio --domain-owner 405906814034 --query authorizationToken --region ap-northeast-1 --output text > .codeartifact-auth-token
+          aws codeartifact get-authorization-token --domain wafflestudio --domain-owner 405906814034 --query authorizationToken --region ap-northeast-1 --output text > .codeartifact_token
 
       - name: Docker build, tag, and push image to ECR
         id: build-push-image
         run: |
-          docker build -f api/Dockerfile -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG . --build-arg CODEARTIFACT_AUTH_TOKEN=$(cat .codeartifact-auth-token) --platform linux/arm64
+          docker build --secret id=codeartifact_token,src=./.codeartifact_token -f api/Dockerfile -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG . --platform linux/arm64
           docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
           echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
 
diff --git a/.github/workflows/deploy-batch-dev-native.yml b/.github/workflows/deploy-batch-dev-native.yml
@@ -32,11 +32,11 @@ jobs:
       - name: Get and save Auth Token for CodeArtifact
         id: get-save-codeartifact-auth-token
         run: |
-          aws codeartifact get-authorization-token --domain wafflestudio --domain-owner 405906814034 --query authorizationToken --region ap-northeast-1 --output text > .codeartifact-auth-token
+          aws codeartifact get-authorization-token --domain wafflestudio --domain-owner 405906814034 --query authorizationToken --region ap-northeast-1 --output text > .codeartifact_token
 
       - name: Docker build, tag, and push image to ECR
         id: build-push-image
         run: |
-          docker build -f batch/Dockerfile-native -t $ECR_REGISTRY/$ECR_BATCH_REPOSITORY:$IMAGE_TAG . --build-arg CODEARTIFACT_AUTH_TOKEN=$(cat .codeartifact-auth-token) --platform linux/arm64
+          docker build --secret id=codeartifact_token,src=./.codeartifact_token -f batch/Dockerfile-native -t $ECR_REGISTRY/$ECR_BATCH_REPOSITORY:$IMAGE_TAG . --platform linux/arm64
           docker push $ECR_REGISTRY/$ECR_BATCH_REPOSITORY:$IMAGE_TAG
           echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
diff --git a/.github/workflows/deploy-batch-dev.yml b/.github/workflows/deploy-batch-dev.yml
@@ -32,11 +32,11 @@ jobs:
       - name: Get and save Auth Token for CodeArtifact
         id: get-save-codeartifact-auth-token
         run: |
-          aws codeartifact get-authorization-token --domain wafflestudio --domain-owner 405906814034 --query authorizationToken --region ap-northeast-1 --output text > .codeartifact-auth-token
+          aws codeartifact get-authorization-token --domain wafflestudio --domain-owner 405906814034 --query authorizationToken --region ap-northeast-1 --output text > .codeartifact_token
 
       - name: Docker build, tag, and push image to ECR
         id: build-push-image
         run: |
-          docker build -f batch/Dockerfile -t $ECR_REGISTRY/$ECR_BATCH_REPOSITORY:$IMAGE_TAG . --build-arg CODEARTIFACT_AUTH_TOKEN=$(cat .codeartifact-auth-token) --platform linux/arm64
+          docker build --secret id=codeartifact_token,src=./.codeartifact_token -f batch/Dockerfile -t $ECR_REGISTRY/$ECR_BATCH_REPOSITORY:$IMAGE_TAG . --platform linux/arm64
           docker push $ECR_REGISTRY/$ECR_BATCH_REPOSITORY:$IMAGE_TAG
           echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
diff --git a/.github/workflows/deploy-batch-prod-native.yml b/.github/workflows/deploy-batch-prod-native.yml
@@ -32,11 +32,11 @@ jobs:
       - name: Get and save Auth Token for CodeArtifact
         id: get-save-codeartifact-auth-token
         run: |
-          aws codeartifact get-authorization-token --domain wafflestudio --domain-owner 405906814034 --query authorizationToken --region ap-northeast-1 --output text > .codeartifact-auth-token
+          aws codeartifact get-authorization-token --domain wafflestudio --domain-owner 405906814034 --query authorizationToken --region ap-northeast-1 --output text > .codeartifact_token
 
       - name: Docker build, tag, and push image to ECR
         id: build-push-image
         run: |
-          docker build -f batch/Dockerfile-native -t $ECR_REGISTRY/$ECR_BATCH_REPOSITORY:$IMAGE_TAG . --build-arg CODEARTIFACT_AUTH_TOKEN=$(cat .codeartifact-auth-token) --platform linux/arm64
+          docker build --secret id=codeartifact_token,src=./.codeartifact_token -f batch/Dockerfile-native -t $ECR_REGISTRY/$ECR_BATCH_REPOSITORY:$IMAGE_TAG . --platform linux/arm64
           docker push $ECR_REGISTRY/$ECR_BATCH_REPOSITORY:$IMAGE_TAG
           echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
diff --git a/.github/workflows/deploy-batch-prod.yml b/.github/workflows/deploy-batch-prod.yml
@@ -32,11 +32,11 @@ jobs:
       - name: Get and save Auth Token for CodeArtifact
         id: get-save-codeartifact-auth-token
         run: |
-          aws codeartifact get-authorization-token --domain wafflestudio --domain-owner 405906814034 --query authorizationToken --region ap-northeast-1 --output text > .codeartifact-auth-token
+          aws codeartifact get-authorization-token --domain wafflestudio --domain-owner 405906814034 --query authorizationToken --region ap-northeast-1 --output text > .codeartifact_token
 
       - name: Docker build, tag, and push image to ECR
         id: build-push-image
         run: |
-          docker build -f batch/Dockerfile -t $ECR_REGISTRY/$ECR_BATCH_REPOSITORY:$IMAGE_TAG . --build-arg CODEARTIFACT_AUTH_TOKEN=$(cat .codeartifact-auth-token) --platform linux/arm64
+          docker build --secret id=codeartifact_token,src=./.codeartifact_token -f batch/Dockerfile -t $ECR_REGISTRY/$ECR_BATCH_REPOSITORY:$IMAGE_TAG . --platform linux/arm64
           docker push $ECR_REGISTRY/$ECR_BATCH_REPOSITORY:$IMAGE_TAG
           echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
diff --git a/api/Dockerfile b/api/Dockerfile
@@ -1,8 +1,7 @@
 FROM ghcr.io/graalvm/jdk-community:25
 WORKDIR /app
-ARG CODEARTIFACT_AUTH_TOKEN
 COPY . /app
 RUN microdnf install -y findutils --nodocs
-RUN ./gradlew :api:bootJar -PcodeArtifactAuthToken=$CODEARTIFACT_AUTH_TOKEN
+RUN --mount=type=secret,id=codeartifact_token ./gradlew :api:bootJar -PcodeArtifactAuthToken=$(cat /run/secrets/codeartifact_token)
 EXPOSE 8080
 ENTRYPOINT java $JAVA_OPTS -jar api/build/libs/snutt-api.jar
diff --git a/api/Dockerfile-native b/api/Dockerfile-native
@@ -1,8 +1,12 @@
-FROM ghcr.io/graalvm/native-image-community:25
+# Build stage
+FROM container-registry.oracle.com/graalvm/native-image:25 AS builder
 WORKDIR /app
-ARG CODEARTIFACT_AUTH_TOKEN
 COPY . /app
-RUN microdnf install -y findutils --nodocs
-RUN ./gradlew :api:nativeCompile -PcodeArtifactAuthToken=$CODEARTIFACT_AUTH_TOKEN
+RUN --mount=type=secret,id=codeartifact_token ./gradlew :api:nativeCompile -PcodeArtifactAuthToken=$(cat /run/secrets/codeartifact_token)
+
+# Runtime stage
+FROM docker.io/debian:bookworm-slim
+WORKDIR /app
+COPY --from=builder /app/api/build/native/nativeCompile/api /app/api
 EXPOSE 8080
-ENTRYPOINT api/build/native/nativeCompile/api
+ENTRYPOINT ["/app/api"]
diff --git a/batch/Dockerfile b/batch/Dockerfile
@@ -1,7 +1,6 @@
 FROM ghcr.io/graalvm/jdk-community:25
 WORKDIR /app
-ARG CODEARTIFACT_AUTH_TOKEN
 COPY . /app
 RUN microdnf install -y findutils --nodocs
-RUN ./gradlew :batch:bootJar -PcodeArtifactAuthToken=$CODEARTIFACT_AUTH_TOKEN
+RUN --mount=type=secret,id=codeartifact_token ./gradlew :batch:bootJar -PcodeArtifactAuthToken=$(cat /run/secrets/codeartifact_token)
 ENTRYPOINT java $JAVA_OPTS -jar batch/build/libs/snutt-batch.jar --job.name=${JOB_NAME}
diff --git a/batch/Dockerfile-native b/batch/Dockerfile-native
@@ -1,7 +1,12 @@
-FROM ghcr.io/graalvm/native-image-community:25
+# Build stage
+FROM container-registry.oracle.com/graalvm/native-image:25 AS builder
 WORKDIR /app
-ARG CODEARTIFACT_AUTH_TOKEN
 COPY . /app
-RUN microdnf install -y findutils --nodocs
-RUN ./gradlew :batch:nativeCompile -PcodeArtifactAuthToken=$CODEARTIFACT_AUTH_TOKEN
-ENTRYPOINT batch/build/native/nativeCompile/batch --job.name=${JOB_NAME}
+RUN ./gradlew :batch:nativeCompile -PcodeArtifactAuthToken=$(cat /run/secrets/codeartifact_token)
+
+# Runtime stage
+FROM docker.io/debian:bookworm-slim
+WORKDIR /app
+COPY --from=builder /app/api/build/native/nativeCompile/batch /app/batch
+EXPOSE 8080
+ENTRYPOINT ["/app/batch", "--job.name=${JOB_NAME}"]
