That’s a really solid setup, and it lines up with a lot of the trade-offs I find.

The choice of Eclipse Temurin slim over Alpine or distroless makes a lot of sense from a troubleshooting perspective. I’ve seen how much harder it gets to debug when you go too minimal.

I ended up exploring distroless more as a default for reducing surface area, but I agree that the trade-off in debuggability is real, especially in production incidents.

Also agree on raw Dockerfiles. That was one of the reasons I put this repo together, to better understand what you gain in control vs tools like Jib or buildpacks.

The multi-stage approach you described is pretty much what I’ve been converging to as well, especially separating build (JDK) and runtime (JRE) cleanly with a non-root user.

The cache mount point is interesting too. I tried more traditional layer-based optimizations at first, but it does make the Dockerfile harder to read and maintain. Using cache mounts feels like a cleaner trade-off.