FROM eclipse-temurin:17-jre-jammy

# Run as non-root user (SR-02)
RUN useradd -m -u 1001 cloudi
USER cloudi

WORKDIR /app

COPY target/banking-sdk-1.0.0.jar banking-sdk.jar

# Secrets injected at runtime via environment variables (SR-06)
# ENV VENDOR_BANKING_URL=
# ENV VENDOR_BANKING_API_KEY=

CMD ["java", "-jar", "banking-sdk.jar"]