# 建立開發環境 Pod
podman pod create --name dev-env --publish 8080:8080 --publish 5432:5432

# 啟動 PostgreSQL 容器
podman run -d --pod dev-env \
  --name postgres \
  -e POSTGRES_PASSWORD=password \
  postgres:14

# 啟動 Redis 容器
podman run -d --pod dev-env \
  --name redis \
  redis:7-alpine

# Docker 指令
docker run -d --name web nginx
docker ps
docker stop web
docker rm web

# Podman 指令（完全相同）
podman run -d --name web nginx
podman ps
podman stop web
podman rm web

# 檢查 Windows 版本
Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion

# 檢查虛擬化支援
Get-ComputerInfo | Select-Object HyperVRequirementVirtualizationFirmwareEnabled

# 檢查記憶體
Get-ComputerInfo | Select-Object TotalPhysicalMemory

# 以管理員身份執行 PowerShell

# 啟用 WSL 功能
dism.exe /online /enable-feature /featurename:Microsoft-Windows-Subsystem-Linux /all /norestart

# 啟用虛擬機器平台
dism.exe /online /enable-feature /featurename:VirtualMachinePlatform /all /norestart

# 重新啟動電腦
Restart-Computer

# 設定 WSL 2 為預設版本
wsl --set-default-version 2

# 安裝 Ubuntu（可選，但建議）
wsl --install -d Ubuntu-22.04

# 檢查 Windows 版本
winver

# 手動下載 WSL 2 核心更新
# https://aka.ms/wsl2kernel

# 確保以管理員身份執行
Start-Process powershell -Verb runAs

# 啟用 Docker Socket 相容性
podman system service --time=0 unix:///var/run/docker.sock

# CLI 對照指令
podman logs -f container-name
podman stats container-name

FROM openjdk:17-jdk

# 安裝開發工具
RUN apt-get update && apt-get install -y \
    git \
    maven \
    curl \
    vim \
    && rm -rf /var/lib/apt/lists/*

# 設定工作目錄
WORKDIR /workspace

# 複製專案設定檔
COPY pom.xml .
RUN mvn dependency:go-offline

# 設定環境變數
ENV JAVA_HOME=/usr/local/openjdk-17
ENV MAVEN_HOME=/usr/share/maven

CMD ["bash"]

# 建立開發環境 Pod
podman pod create --name dev-env \
  --publish 8080:8080 \
  --publish 5432:5432 \
  --publish 6379:6379

# Java 應用容器
podman run -d --pod dev-env \
  --name java-app \
  -v /d/developer/repos/java_tutorial:/workspace \
  -w /workspace \
  java-tutorial:dev \
  mvn spring-boot:run

# PostgreSQL 資料庫
podman run -d --pod dev-env \
  --name postgres \
  -e POSTGRES_DB=tutorial \
  -e POSTGRES_USER=dev \
  -e POSTGRES_PASSWORD=devpass \
  -v postgres-data:/var/lib/postgresql/data \
  postgres:14

# Redis 快取
podman run -d --pod dev-env \
  --name redis \
  redis:7-alpine

version: '3.8'

services:
  java-app:
    build:
      context: .
      dockerfile: Dockerfile.dev
    ports:
      - "8080:8080"
    volumes:
      - .:/workspace
    working_dir: /workspace
    depends_on:
      - postgres
      - redis
    environment:
      - SPRING_PROFILES_ACTIVE=dev
      - DB_HOST=postgres
      - REDIS_HOST=redis

  postgres:
    image: postgres:14
    environment:
      POSTGRES_DB: tutorial
      POSTGRES_USER: dev
      POSTGRES_PASSWORD: devpass
    volumes:
      - postgres-data:/var/lib/postgresql/data
    ports:
      - "5432:5432"

  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"

volumes:
  postgres-data:

# 資料庫設定
DB_HOST=postgres
DB_PORT=5432
DB_NAME=tutorial
DB_USER=dev
DB_PASSWORD=devpass

# Redis 設定
REDIS_HOST=redis
REDIS_PORT=6379

# 應用程式設定
APP_PORT=8080
LOG_LEVEL=DEBUG

# 建立具名容器並設定標籤
podman run -d \
  --name web-server \
  --label "environment=development" \
  --label "project=java-tutorial" \
  --publish 8080:80 \
  --restart unless-stopped \
  nginx:alpine

# 監控容器資源使用
podman stats web-server

# 監控所有容器
podman stats --all

# 即時查看日誌
podman logs -f web-server

# 查看最近 100 行日誌
podman logs --tail 100 web-server

# 查看特定時間範圍的日誌
podman logs --since "2025-01-01T00:00:00Z" web-server

# 進入執行中的容器
podman exec -it web-server /bin/bash

# 以 root 使用者進入
podman exec -it --user root web-server /bin/bash

# 執行特定指令
podman exec web-server cat /etc/nginx/nginx.conf

# 設定資源限制
podman run -d \
  --name limited-app \
  --memory="512m" \
  --cpus="1.5" \
  --memory-swap="1g" \
  java-tutorial:dev

# 在 Dockerfile 中定義
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD curl -f http://localhost:8080/health || exit 1

# 執行時定義健康檢查
podman run -d \
  --name web-app \
  --health-cmd="curl -f http://localhost:8080/health || exit 1" \
  --health-interval=30s \
  --health-timeout=3s \
  --health-retries=3 \
  java-tutorial:dev

# 設定重啟策略
podman run -d \
  --name resilient-app \
  --restart=unless-stopped \
  java-tutorial:dev

# 以非 root 使用者執行
podman run -d \
  --name secure-app \
  --user 1000:1000 \
  --read-only \
  --tmpfs /tmp \
  java-tutorial:dev

# 建立自訂網路
podman network create --driver bridge secure-network

# 在隔離網路中執行容器
podman run -d \
  --name isolated-app \
  --network secure-network \
  java-tutorial:dev

# 建立 secret
echo "super-secret-password" | podman secret create db-password -

# 在容器中使用 secret
podman run -d \
  --name app-with-secret \
  --secret db-password \
  java-tutorial:dev

# 建立容器快照
podman commit web-server web-server-backup:$(date +%Y%m%d)

# 匯出容器為 tar 檔
podman export web-server > web-server-backup.tar

# 匯出映像檔
podman save web-server-backup:20250831 > web-server-image.tar

# 從 tar 檔匯入
podman import web-server-backup.tar web-server:restored

# 載入映像檔
podman load < web-server-image.tar

# 搜尋映像檔
podman search java

# 下載特定版本
podman pull openjdk:17-jdk-alpine

# 下載所有標籤
podman pull --all-tags nginx

# 列出本地映像檔
podman images

# 檢視映像檔詳細資訊
podman inspect openjdk:17-jdk-alpine

# 檢視映像檔歷史
podman history openjdk:17-jdk-alpine

# 檢視映像檔層級
podman image tree openjdk:17-jdk-alpine

# 多階段建置 - 編譯階段
FROM maven:3.8.6-openjdk-17 AS builder

WORKDIR /app
COPY pom.xml .
RUN mvn dependency:go-offline

COPY src ./src
RUN mvn clean package -DskipTests

# 多階段建置 - 運行階段
FROM openjdk:17-jre-alpine

# 安全性：建立非 root 使用者
RUN addgroup -g 1001 -S appgroup && \
    adduser -u 1001 -S appuser -G appgroup

# 安裝必要工具
RUN apk add --no-cache curl

WORKDIR /app

# 複製編譯後的 JAR 檔
COPY --from=builder /app/target/*.jar app.jar

# 設定檔案權限
RUN chown -R appuser:appgroup /app

# 切換到非 root 使用者
USER appuser

# 健康檢查
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
    CMD curl -f http://localhost:8080/actuator/health || exit 1

# 暴露埠號
EXPOSE 8080

# 啟動指令
ENTRYPOINT ["java", "-jar", "/app/app.jar"]

# ❌ 不良實務
FROM openjdk:17-jdk
RUN apt-get update
RUN apt-get install -y curl
RUN apt-get install -y vim
COPY app.jar /app.jar

# ✅ 最佳實務
FROM openjdk:17-jre-alpine
RUN apk add --no-cache curl && \
    rm -rf /var/cache/apk/*
COPY app.jar /app.jar

# Git 檔案
.git
.gitignore

# IDE 檔案
.vscode
.idea
*.iml

# 建置產物
target/
*.log

# 測試檔案
src/test/

# 文件檔案
docs/
README.md

# 使用 Podman 內建掃描
podman build --security-opt label=disable -t secure-app .

# 檢查映像檔弱點
podman run --rm -v /var/run/docker.sock:/var/run/docker.sock \
  aquasec/trivy image java-tutorial:v1.0.0

# 1. 使用官方基礎映像檔
FROM openjdk:17-jre-alpine

# 2. 定期更新套件
RUN apk update && apk upgrade && \
    apk add --no-cache curl && \
    rm -rf /var/cache/apk/*

# 3. 建立非 root 使用者
RUN addgroup -g 1001 -S appgroup && \
    adduser -u 1001 -S appuser -G appgroup

# 4. 設定適當的檔案權限
COPY --chown=appuser:appgroup app.jar /app/app.jar

# 5. 切換到非 root 使用者
USER appuser

# 6. 使用特定版本而非 latest
# 在 CI/CD 中使用具體版本標籤

# 版本標籤策略
podman tag java-tutorial:latest java-tutorial:v1.0.0
podman tag java-tutorial:latest java-tutorial:1.0
podman tag java-tutorial:latest java-tutorial:1
podman tag java-tutorial:latest java-tutorial:stable

# 環境標籤
podman tag java-tutorial:latest java-tutorial:dev
podman tag java-tutorial:latest java-tutorial:staging
podman tag java-tutorial:latest java-tutorial:prod

# 推送到 Registry
podman push java-tutorial:v1.0.0 registry.example.com/java-tutorial:v1.0.0

# 匯出映像檔
podman save java-tutorial:v1.0.0 > java-tutorial-v1.0.0.tar

# 分享映像檔
scp java-tutorial-v1.0.0.tar user@server:/tmp/

# 清理無標籤映像檔
podman image prune

# 清理所有無用映像檔
podman image prune -a

# 清理特定時間前的映像檔
podman image prune --filter "until=72h"

# 分析映像檔層級
podman image tree java-tutorial:v1.0.0

# 檢視映像檔佔用空間
podman system df

# 詳細空間分析
podman system df -v

# 建立 Named Volume
podman volume create postgres-data

# 檢視 Volume 詳細資訊
podman volume inspect postgres-data

# 列出所有 Volume
podman volume ls

# 使用 Volume
podman run -d --name postgres \
  -v postgres-data:/var/lib/postgresql/data \
  -e POSTGRES_PASSWORD=password \
  postgres:14

# Windows 路徑 Bind Mount
podman run -it --name dev-env \
  -v "D:\developer\repos\java_tutorial:/workspace:Z" \
  -w /workspace \
  openjdk:17-jdk bash

# 備份 Volume 資料
podman run --rm \
  -v postgres-data:/data \
  -v "D:\backups:/backup" \
  alpine tar czf /backup/postgres-backup-$(date +%Y%m%d).tar.gz -C /data .

# 還原 Volume 資料
podman run --rm \
  -v postgres-data:/data \
  -v "D:\backups:/backup" \
  alpine tar xzf /backup/postgres-backup-20250831.tar.gz -C /data

# 建立 Bridge 網路
podman network create --driver bridge webapp-network

# 建立具有特定子網的網路
podman network create \
  --driver bridge \
  --subnet 172.20.0.0/16 \
  --gateway 172.20.0.1 \
  isolated-network

# 檢視網路詳細資訊
podman network inspect webapp-network

# 在建立容器時指定網路
podman run -d --name web-app \
  --network webapp-network \
  nginx:alpine

# 將現有容器連接到網路
podman network connect webapp-network existing-container

# 從網路中斷開容器
podman network disconnect webapp-network existing-container

# 建立應用網路
podman network create app-network

# 啟動資料庫容器
podman run -d --name database \
  --network app-network \
  -e POSTGRES_DB=appdb \
  -e POSTGRES_USER=appuser \
  -e POSTGRES_PASSWORD=apppass \
  postgres:14

# 啟動應用程式容器
podman run -d --name webapp \
  --network app-network \
  -p 8080:8080 \
  -e DB_HOST=database \
  -e DB_PORT=5432 \
  java-tutorial:latest

# 建立隔離的網路環境
podman network create --internal secure-network

# 在隔離網路中運行敏感服務
podman run -d --name secure-service \
  --network secure-network \
  sensitive-app:latest

# 限制容器網路存取
podman run -d --name restricted-app \
  --network none \
  --add-host=api.example.com:192.168.1.100 \
  app:latest

# 使用 Slirp4netns 進行使用者網路
podman run -d --name user-network-app \
  --network slirp4netns \
  app:latest

# 檢視 Volume 使用情況
podman system df -v

# 檢視特定 Volume 的掛載點
podman volume inspect postgres-data --format "{{.Mountpoint}}"

# 監控 Volume 空間使用
du -sh $(podman volume inspect postgres-data --format "{{.Mountpoint}}")

# 檢視容器網路統計
podman stats --format "table {{.Container}}\t{{.NetIO}}"

# 檢視網路介面
podman exec container-name ip addr show

# 檢查檔案權限
podman exec -it container-name ls -la /mount/point

# 修正權限問題
podman exec -it --user root container-name chown -R user:group /mount/point

# 檢查 Volume 狀態
podman volume inspect volume-name

# 重新建立 Volume
podman volume rm volume-name
podman volume create volume-name

# 檢查網路連接
podman network ls
podman network inspect network-name

# 測試網路連通性
podman exec container1 ping container2
podman exec container1 nslookup container2

# 檢查埠號使用
netstat -tulpn | grep 8080

# 變更埠號對應
podman run -p 8081:8080 app:latest

# 透過 CLI 安裝擴充功能
code --install-extension ms-vscode-remote.remote-containers
code --install-extension redhat.vscode-podman

{
    "name": "Java Development",
    "image": "openjdk:17-jdk",
    
    "customizations": {
        "vscode": {
            "extensions": [
                "vscjava.vscode-java-pack",
                "redhat.java",
                "vscjava.vscode-maven"
            ],
            "settings": {
                "java.home": "/usr/local/openjdk-17",
                "maven.terminal.useJavaHome": true
            }
        }
    },
    
    "forwardPorts": [8080],
    "mounts": [
        "source=${localWorkspaceFolder},target=/workspace,type=bind,consistency=cached"
    ],
    "workspaceFolder": "/workspace",
    
    "postCreateCommand": "mvn dependency:go-offline",
    
    "remoteUser": "vscode"
}

# .devcontainer/Dockerfile
FROM openjdk:17-jdk

# 安裝必要工具
RUN apt-get update && apt-get install -y \
    git \
    curl \
    wget \
    vim \
    && rm -rf /var/lib/apt/lists/*

# 建立 vscode 使用者
RUN groupadd --gid 1000 vscode \
    && useradd --uid 1000 --gid vscode --shell /bin/bash --create-home vscode

# 安裝 Maven
ENV MAVEN_VERSION=3.9.4
RUN curl -fsSL https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz \
    | tar xzf - -C /opt \
    && ln -s /opt/apache-maven-${MAVEN_VERSION} /opt/maven

ENV PATH=/opt/maven/bin:$PATH

USER vscode

{
    "version": "0.2.0",
    "configurations": [
        {
            "type": "java",
            "name": "Debug Java App",
            "request": "launch",
            "mainClass": "com.tutorial.Application",
            "projectName": "java-tutorial",
            "args": "",
            "vmArgs": "-Dspring.profiles.active=dev"
        }
    ]
}

# 系統資訊檢查
podman system info

# 連接資訊
podman system connection list

# 磁碟使用量分析
podman system df

# 事件監控
podman events --filter type=container

# 系統重置（注意：會清除所有資料）
podman system reset

# 容器資源使用統計
podman stats --all --no-stream

# 容器程序檢視
podman top container_name

# 容器檔案系統檢查
podman diff container_name

# 執行中容器的檔案複製
podman cp container_name:/app/logs ./logs
podman cp ./config.properties container_name:/app/config/

# 容器匯出與匯入
podman export container_name > container_backup.tar
podman import container_backup.tar new_image:tag

# 映像檔歷史記錄
podman history image_name

# 映像檔圖層分析
podman inspect image_name | jq '.[]Layers'

# 映像檔安全掃描（需要安裝 skopeo）
skopeo inspect docker://registry.access.redhat.com/ubi8/ubi

# 映像檔簽名驗證
podman image trust show

# deploy-java-app.ps1
param(
    [string]$ImageTag = "latest",
    [string]$ContainerName = "java-tutorial",
    [int]$Port = 8080
)

# 停止並移除舊容器
Write-Host "清理舊容器..." -ForegroundColor Yellow
podman stop $ContainerName -ErrorAction SilentlyContinue
podman rm $ContainerName -ErrorAction SilentlyContinue

# 拉取最新映像檔
Write-Host "拉取映像檔 $ImageTag..." -ForegroundColor Green
podman pull "java-tutorial:$ImageTag"

# 啟動新容器
Write-Host "啟動容器 $ContainerName..." -ForegroundColor Green
podman run -d `
    --name $ContainerName `
    -p "${Port}:8080" `
    -e SPRING_PROFILES_ACTIVE=prod `
    -v "java-tutorial-logs:/app/logs" `
    "java-tutorial:$ImageTag"

# 檢查健康狀態
Start-Sleep -Seconds 10
$status = podman inspect $ContainerName --format "{{.State.Status}}"
if ($status -eq "running") {
    Write-Host "容器啟動成功！" -ForegroundColor Green
    Write-Host "應用程式網址：http://localhost:$Port" -ForegroundColor Cyan
} else {
    Write-Host "容器啟動失敗！" -ForegroundColor Red
    podman logs $ContainerName
}

# manage-environment.ps1
param(
    [ValidateSet("dev", "test", "prod")]
    [string]$Environment = "dev",
    
    [ValidateSet("start", "stop", "restart", "status")]
    [string]$Action = "status"
)

$containers = @{
    "dev" = @("java-tutorial-dev", "postgres-dev", "redis-dev")
    "test" = @("java-tutorial-test", "postgres-test")
    "prod" = @("java-tutorial-prod", "postgres-prod", "redis-prod")
}

function Start-Environment {
    param([string[]]$ContainerList)
    
    foreach ($container in $ContainerList) {
        Write-Host "啟動 $container..." -ForegroundColor Green
        podman start $container
    }
}

function Stop-Environment {
    param([string[]]$ContainerList)
    
    foreach ($container in $ContainerList) {
        Write-Host "停止 $container..." -ForegroundColor Yellow
        podman stop $container
    }
}

function Get-EnvironmentStatus {
    param([string[]]$ContainerList)
    
    Write-Host "=== $Environment 環境狀態 ===" -ForegroundColor Cyan
    foreach ($container in $ContainerList) {
        $status = podman inspect $container --format "{{.State.Status}}" 2>$null
        if ($status) {
            Write-Host "$container : $status" -ForegroundColor Green
        } else {
            Write-Host "$container : 不存在" -ForegroundColor Red
        }
    }
}

# 執行動作
$targetContainers = $containers[$Environment]
switch ($Action) {
    "start" { Start-Environment $targetContainers }
    "stop" { Stop-Environment $targetContainers }
    "restart" { 
        Stop-Environment $targetContainers
        Start-Sleep -Seconds 5
        Start-Environment $targetContainers
    }
    "status" { Get-EnvironmentStatus $targetContainers }
}

# 安裝 podman-compose
pip install podman-compose

# 或使用 Docker Compose（需要額外設定）
# 設定環境變數指向 Podman
export DOCKER_HOST=unix:///run/user/$UID/podman/podman.sock

# docker-compose.yml
version: '3.8'

services:
  app:
    build: 
      context: .
      dockerfile: Dockerfile
    ports:
      - "8080:8080"
    environment:
      - SPRING_PROFILES_ACTIVE=dev
      - DB_HOST=database
    depends_on:
      - database
      - redis
    volumes:
      - ./logs:/app/logs
    networks:
      - app-network

  database:
    image: postgres:14
    environment:
      POSTGRES_DB: java_tutorial
      POSTGRES_USER: tutorial_user
      POSTGRES_PASSWORD: tutorial_pass
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./db/init:/docker-entrypoint-initdb.d
    networks:
      - app-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U tutorial_user"]
      interval: 30s
      timeout: 10s
      retries: 3

  redis:
    image: redis:7-alpine
    command: redis-server --appendonly yes
    volumes:
      - redis_data:/data
    networks:
      - app-network

volumes:
  postgres_data:
  redis_data:

networks:
  app-network:
    driver: bridge

# microservices-compose.yml
version: '3.8'

services:
  # API Gateway
  gateway:
    image: nginx:alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
    depends_on:
      - user-service
      - order-service
    networks:
      - frontend
      - backend

  # 用戶服務
  user-service:
    build:
      context: ./user-service
      dockerfile: Dockerfile
    environment:
      - SPRING_PROFILES_ACTIVE=docker
      - DATABASE_URL=jdbc:postgresql://user-db:5432/userdb
    depends_on:
      user-db:
        condition: service_healthy
    networks:
      - backend
    deploy:
      replicas: 2

  # 訂單服務
  order-service:
    build:
      context: ./order-service  
      dockerfile: Dockerfile
    environment:
      - SPRING_PROFILES_ACTIVE=docker
      - DATABASE_URL=jdbc:postgresql://order-db:5432/orderdb
      - REDIS_URL=redis://redis:6379
    depends_on:
      order-db:
        condition: service_healthy
      redis:
        condition: service_started
    networks:
      - backend

  # 用戶資料庫
  user-db:
    image: postgres:14
    environment:
      POSTGRES_DB: userdb
      POSTGRES_USER: user_svc
      POSTGRES_PASSWORD: user_pass
    volumes:
      - user_db_data:/var/lib/postgresql/data
    networks:
      - backend
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user_svc"]
      interval: 30s
      timeout: 10s
      retries: 3

  # 訂單資料庫
  order-db:
    image: postgres:14
    environment:
      POSTGRES_DB: orderdb
      POSTGRES_USER: order_svc
      POSTGRES_PASSWORD: order_pass
    volumes:
      - order_db_data:/var/lib/postgresql/data
    networks:
      - backend
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U order_svc"]
      interval: 30s
      timeout: 10s
      retries: 3

  # 快取服務
  redis:
    image: redis:7-alpine
    command: redis-server --appendonly yes
    volumes:
      - redis_data:/data
    networks:
      - backend

  # 監控服務
  prometheus:
    image: prom/prometheus:latest
    ports:
      - "9090:9090"
    volumes:
      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_data:/prometheus
    networks:
      - monitoring

  grafana:
    image: grafana/grafana:latest
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=admin
    volumes:
      - grafana_data:/var/lib/grafana
      - ./grafana/dashboards:/etc/grafana/provisioning/dashboards:ro
    networks:
      - monitoring

volumes:
  user_db_data:
  order_db_data:
  redis_data:
  prometheus_data:
  grafana_data:

networks:
  frontend:
    driver: bridge
  backend:
    driver: bridge
    internal: true
  monitoring:
    driver: bridge

# 啟動所有服務
podman-compose up -d

# 查看服務狀態
podman-compose ps

# 查看日誌
podman-compose logs -f app

# 擴展服務實例
podman-compose up --scale app=3

# 停止並移除所有容器
podman-compose down

# 重建服務
podman-compose up --build

# 執行單次命令
podman-compose run app mvn test

# 使用官方基礎映像檔
FROM openjdk:17-jdk-slim

# 建立非特權使用者
RUN groupadd --gid 1001 appuser && \
    useradd --uid 1001 --gid appuser --shell /bin/bash --create-home appuser

# 設定適當的檔案權限
COPY --chown=appuser:appuser . /app
WORKDIR /app

# 切換到非特權使用者
USER appuser

# 移除不必要的套件
RUN apt-get autoremove -y && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# 使用非特權容器
podman run --user 1001:1001 \
  --security-opt no-new-privileges \
  --cap-drop=ALL \
  --cap-add=NET_BIND_SERVICE \
  app:latest

# 限制系統調用
podman run --security-opt seccomp:default.json \
  app:latest

# 使用 read-only 根檔案系統
podman run --read-only \
  --tmpfs /tmp \
  --tmpfs /var/run \
  app:latest

# 建立隔離網路
podman network create --internal secure-backend

# 使用主機網路時的安全考量
podman run --network host \
  --security-opt label=level:s0:c100,c200 \
  app:latest

# 設定資源限制
podman run -d \
  --memory=512m \
  --memory-swap=1g \
  --cpus=1.5 \
  --cpu-shares=1024 \
  app:latest

# 設定更細緻的 CPU 控制
podman run -d \
  --cpuset-cpus=0,1 \
  --cpu-period=100000 \
  --cpu-quota=50000 \
  app:latest

# 限制容器檔案系統大小
podman run -d \
  --storage-opt size=10G \
  app:latest

# 設定磁碟 I/O 限制
podman run -d \
  --device-read-bps /dev/sda:1mb \
  --device-write-bps /dev/sda:1mb \
  app:latest

# monitoring-compose.yml
version: '3.8'

services:
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:latest
    ports:
      - "8081:8080"
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/containers:/var/lib/containers:ro
    privileged: true

  node-exporter:
    image: prom/node-exporter:latest
    ports:
      - "9100:9100"
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    command:
      - '--path.procfs=/host/proc'
      - '--path.sysfs=/host/sys'
      - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'

# 從現有容器生成 Pod YAML
podman generate kube java-tutorial-pod > java-tutorial.yaml

# 從現有容器生成 Deployment YAML
podman generate kube --service java-tutorial-pod > java-tutorial-deployment.yaml

# java-tutorial-k8s.yaml
apiVersion: v1
kind: Pod
metadata:
  name: java-tutorial-pod
  labels:
    app: java-tutorial
spec:
  containers:
  - name: app
    image: java-tutorial:latest
    ports:
    - containerPort: 8080
    env:
    - name: SPRING_PROFILES_ACTIVE
      value: "k8s"
    resources:
      requests:
        memory: "256Mi"
        cpu: "250m"
      limits:
        memory: "512Mi"
        cpu: "500m"
    volumeMounts:
    - name: app-logs
      mountPath: /app/logs
  volumes:
  - name: app-logs
    emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: java-tutorial-service
spec:
  selector:
    app: java-tutorial
  ports:
  - port: 80
    targetPort: 8080
  type: LoadBalancer

# 部署到 Podman
podman play kube java-tutorial-k8s.yaml

# 查看部署狀態
podman pod ps

# 停止並移除 Pod
podman play kube --down java-tutorial-k8s.yaml

# 建立 S2I 建置
oc new-app java:11~https://github.com/your-org/java-tutorial.git

# 建立 BuildConfig
oc create -f - <<EOF
apiVersion: build.openshift.io/v1
kind: BuildConfig
metadata:
  name: java-tutorial
spec:
  source:
    git:
      uri: https://github.com/your-org/java-tutorial.git
    type: Git
  strategy:
    sourceStrategy:
      from:
        kind: ImageStreamTag
        name: java:11
    type: Source
  output:
    to:
      kind: ImageStreamTag
      name: java-tutorial:latest
EOF

# openshift-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: java-tutorial
  labels:
    app: java-tutorial
spec:
  replicas: 3
  selector:
    matchLabels:
      app: java-tutorial
  template:
    metadata:
      labels:
        app: java-tutorial
    spec:
      containers:
      - name: java-tutorial
        image: java-tutorial:latest
        ports:
        - containerPort: 8080
        env:
        - name: SPRING_PROFILES_ACTIVE
          value: "openshift"
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"  
            cpu: "500m"
        readinessProbe:
          httpGet:
            path: /actuator/health/readiness
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        livenessProbe:
          httpGet:
            path: /actuator/health/liveness
            port: 8080
          initialDelaySeconds: 60
          periodSeconds: 30
---
apiVersion: v1
kind: Service
metadata:
  name: java-tutorial-service
spec:
  selector:
    app: java-tutorial
  ports:
  - port: 8080
    targetPort: 8080
---
apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: java-tutorial-route
spec:
  to:
    kind: Service
    name: java-tutorial-service
  port:
    targetPort: 8080

# 建立練習環境
podman machine init --cpus 2 --memory 4096 --disk-size 20
podman machine start

# 安裝必要工具
sudo dnf install -y podman skopeo buildah
pip install podman-compose

# 設定練習專案
git clone https://github.com/containers/podman-bootcamp.git
cd podman-bootcamp

# 映像檔管理
podman search <term>
podman pull <image>
podman images
podman rmi <image>
podman build -t <tag> .
podman push <image>

# 容器管理
podman run <options> <image>
podman ps -a
podman start/stop/restart <container>
podman rm <container>
podman exec -it <container> <command>
podman logs <container>

# Pod 管理
podman pod create --name <name>
podman pod start/stop <pod>
podman pod ps
podman pod rm <pod>

# 系統管理
podman info
podman system df
podman system prune
podman volume ls/create/rm
podman network ls/create/rm

# 建立主機目錄
mkdir -p /home/user/html
echo "<h1>Test Page</h1>" > /home/user/html/index.html

# 啟動容器
podman run -d \
  --name web-server \
  -p 8080:80 \
  -v /home/user/html:/usr/share/nginx/html:Z \
  -e NGINX_PORT=80 \
  nginx:alpine

# 驗證容器狀態
podman ps
curl http://localhost:8080

FROM openjdk:17-jdk-alpine

# 建立應用程式使用者
RUN addgroup -g 1001 appgroup && \
    adduser -D -u 1001 -G appgroup appuser

# 建立應用程式目錄
RUN mkdir -p /app && chown appuser:appgroup /app

# 複製應用程式檔案
COPY --chown=appuser:appgroup app.jar /app/app.jar

# 切換使用者
USER appuser

# 設定工作目錄
WORKDIR /app

# 暴露埠號
EXPOSE 8080

# 啟動命令
CMD ["java", "-jar", "app.jar"]

# 建置映像檔
podman build -t java-app:v1.0 .

# 執行驗證
podman run -d --name test-app -p 8080:8080 java-app:v1.0

# 建立 Pod
podman pod create --name webapp-pod -p 8080:80

# 啟動 nginx 容器
podman run -d \
  --pod webapp-pod \
  --name nginx \
  nginx:alpine

# 啟動 Python 應用容器
podman run -d \
  --pod webapp-pod \
  --name app \
  python:3.9-alpine \
  python -m http.server 8000

# 驗證 Pod 狀態
podman pod ps
podman ps --pod

# 1. 建立自訂網路
podman network create app-network

# 2. 啟動資料庫
podman run -d \
  --name postgres-db \
  --network app-network \
  -e POSTGRES_DB=appdb \
  -e POSTGRES_USER=appuser \
  -e POSTGRES_PASSWORD=apppass \
  -v postgres_data:/var/lib/postgresql/data \
  postgres:13

# 3. 啟動 API 後端
podman run -d \
  --name api-backend \
  --network app-network \
  -e DB_HOST=postgres-db \
  -e DB_PORT=5432 \
  -e DB_NAME=appdb \
  api-backend:latest

# 4. 啟動 Web 前端
podman run -d \
  --name web-frontend \
  --network app-network \
  -p 8080:80 \
  -e API_URL=http://api-backend:8080 \
  web-frontend:latest

# 5. 驗證應用運行
curl http://localhost:8080

# 1. 建立安全容器
podman run -d \
  --name secure-app \
  --user 1001:1001 \
  --security-opt no-new-privileges \
  --cap-drop=ALL \
  --cap-add=NET_BIND_SERVICE \
  --read-only \
  --tmpfs /tmp \
  --tmpfs /var/run \
  secure-app:latest

# 2. 檢查安全設定
podman inspect secure-app | jq '.[]SecurityOpt'
podman inspect secure-app | jq '.[]HostConfig.ReadonlyRootfs'

# 專案結構
microservices-demo/
├── api-gateway/
│   ├── Dockerfile
│   ├── nginx.conf
│   └── src/
├── user-service/
│   ├── Dockerfile
│   ├── pom.xml
│   └── src/
├── order-service/
│   ├── Dockerfile
│   ├── pom.xml
│   └── src/
├── database/
│   ├── init-scripts/
│   └── docker-compose.yml
└── monitoring/
    ├── prometheus/
    ├── grafana/
    └── docker-compose.yml

# .github/workflows/ci-cd.yml
name: CI/CD Pipeline

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    
    - name: Set up JDK 17
      uses: actions/setup-java@v2
      with:
        java-version: '17'
        distribution: 'adopt'
    
    - name: Run tests
      run: mvn test

  build-and-deploy:
    needs: test
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    
    steps:
    - uses: actions/checkout@v2
    
    - name: Build with Maven
      run: mvn clean package
    
    - name: Build container image
      run: |
        podman build -t java-tutorial:${{ github.sha }} .
        podman tag java-tutorial:${{ github.sha }} java-tutorial:latest
    
    - name: Deploy to staging
      run: |
        podman stop java-tutorial-staging || true
        podman rm java-tutorial-staging || true
        podman run -d --name java-tutorial-staging \
          -p 8081:8080 \
          java-tutorial:latest

3. **遠端除錯配置**
- Run → Edit Configurations
- 點擊 "+" → Remote JVM Debug
- Host: localhost
- Port: 5005

##### 專案設定整合

**build.gradle.kts 或 pom.xml 整合：**

```xml
<!-- pom.xml 中的容器化支援 -->
<plugin>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-maven-plugin</artifactId>
 <configuration>
     <jvmArguments>
         -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005
     </jvmArguments>
 </configuration>
</plugin>

# docker-compose.dev.yml
version: '3.8'
services:
  app:
    build:
      context: .
      dockerfile: Dockerfile.dev
    volumes:
      - .:/workspace
      - maven-cache:/root/.m2
    environment:
      - SPRING_PROFILES_ACTIVE=dev
      - DEBUG=true
    ports:
      - "8080:8080"
      - "5005:5005"  # Debug port

  database:
    image: postgres:14
    environment:
      POSTGRES_DB: tutorial_dev
      POSTGRES_USER: dev
      POSTGRES_PASSWORD: devpass
    ports:
      - "5432:5432"

volumes:
  maven-cache:

# 啟動除錯模式
podman run -it --name debug-session \
  -v "$(pwd):/workspace" \
  -w /workspace \
  -p 8080:8080 \
  -p 5005:5005 \
  openjdk:17-jdk \
  java -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005 \
  -jar target/app.jar

# 執行整合測試
podman run --rm \
  -v "$(pwd):/workspace" \
  -w /workspace \
  --network test-network \
  maven:3.8.6-openjdk-17 \
  mvn test -Dspring.profiles.active=test

# 設定 Git 配置
podman exec -it dev-container git config --global user.name "Your Name"
podman exec -it dev-container git config --global user.email "your@email.com"

# 掛載 SSH 金鑰
podman run -it \
  -v ~/.ssh:/home/user/.ssh:ro \
  -v "$(pwd):/workspace" \
  dev-image

# 監控容器資源使用
podman stats dev-container

# 監控建置時間
time mvn clean package

# 檢查容器狀態
podman ps -a

# 重新啟動容器
podman restart dev-container

# 檢查容器日誌
podman logs dev-container

# 確認除錯埠號開放
podman port debug-container

# 測試除錯連接
telnet localhost 5005

# 檢查掛載點
podman inspect dev-container | grep -A 5 "Mounts"

# 重新掛載
podman run --rm -v "$(pwd):/workspace" alpine ls -la /workspace

version: '3.8'

services:
  webapp:
    build: .
    ports:
      - "8080:8080"
    depends_on:
      - database
    environment:
      - SPRING_PROFILES_ACTIVE=prod

  database:
    image: postgres:14
    environment:
      POSTGRES_DB: tutorial
      POSTGRES_USER: admin
      POSTGRES_PASSWORD: password
    volumes:
      - postgres-data:/var/lib/postgresql/data

volumes:
  postgres-data:

# 從 Pod 生成 Kubernetes 部署檔案
podman generate kube web-pod > deployment.yaml

podman run -d --name webapp -p 8080:80 nginx:alpine
podman generate systemd --new --files --name webapp
sudo systemctl enable container-webapp.service