Update and improve Dockerfile

* Proper file permissions
  - Execute bit only for scripts
  - No write bits for anyone
* Replace curl HEALTHCHECK with java client
* Update java version

Author: Huulivoide

Dockerfile

@@ -14,26 +14,26 @@ COPY ./src /build/src
 COPY ./profiles/prod /build/profiles/prod
 RUN mvn -Pprod -DskipTests=true clean package spring-boot:repackage
 
-FROM eclipse-temurin:25.0.1_8-jre
+FROM eclipse-temurin:25.0.2_10-jre
 
 # Application Insights version
 ARG APPINSIGHTS_VERSION=3.7.7
 
-RUN apt-get update && apt-get install -y curl
-
 # expose server port
 EXPOSE 8080
 
-# download script for reading Docker secrets
-ADD --chmod=755 https://raw.githubusercontent.com/HSLdevcom/jore4-tools/main/docker/read-secrets.sh /tmp/read-secrets.sh
+ADD --chmod=555 https://raw.githubusercontent.com/HSLdevcom/jore4-tools/main/docker/read-secrets.sh /tmp/read-secrets.sh
+
+# Downaload a Java applet to perform HEALTHCHECK with
+ADD --chmod=444 https://raw.githubusercontent.com/HSLdevcom/jore4-tools/main/docker/HealthCheck.jar /app/scripts/HealthCheck.jar
 
 # Connection string is provided as env in Kubernetes by secrets manager
 # it should not be provided for other environments (local etc)
-ADD --chmod=755 https://github.com/microsoft/ApplicationInsights-Java/releases/download/${APPINSIGHTS_VERSION}/applicationinsights-agent-${APPINSIGHTS_VERSION}.jar /usr/src/jore4-timetables/applicationinsights-agent.jar
-COPY --chmod=755 ./applicationinsights.json /usr/src/jore4-timetables/applicationinsights.json
+ADD --chmod=444 https://github.com/microsoft/ApplicationInsights-Java/releases/download/${APPINSIGHTS_VERSION}/applicationinsights-agent-${APPINSIGHTS_VERSION}.jar /usr/src/jore4-timetables/applicationinsights-agent.jar
+COPY --chmod=444 ./applicationinsights.json /usr/src/jore4-timetables/applicationinsights.json
 
-# copy over helper scripts
-COPY --chmod=755 ./script/build-jdbc-urls.sh /tmp/
+# add helper script for constructing JDBC URL
+COPY --chmod=555 ./script/build-jdbc-urls.sh /tmp/build-jdbc-urls.sh
 
 # copy compiled jar from builder stage
 COPY --from=builder /build/target/*.jar /usr/src/jore4-timetables/jore4-timetables.jar
@@ -42,4 +42,4 @@ COPY --from=builder /build/target/*.jar /usr/src/jore4-timetables/jore4-timetabl
 CMD ["/bin/bash", "-c", "source /tmp/read-secrets.sh && source /tmp/build-jdbc-urls.sh && java -javaagent:/usr/src/jore4-timetables/applicationinsights-agent.jar -jar /usr/src/jore4-timetables/jore4-timetables.jar"]
 
 HEALTHCHECK --interval=1m --timeout=5s \
-  CMD curl --fail http://localhost:8080/actuator/health
+  CMD ["java", "-jar", "/app/scripts/HealthCheck.jar"]