Speed up multi-arch Docker build by batching LDAP cert import in api/Dockerfile

[Copilot]

Overview

Multi-platform image builds (linux/amd64,linux/arm64) were extremely slow on ARM64 runners because the cert-import step in api/Dockerfile launched one keytool JVM process per PEM file. Under QEMU emulation each JVM launch cost ~130s, so ~7 certs meant ~910s just for this step.

Changes:

• Copy LDAP PEMs into /etc/pki/ca-trust/source/anchors/ and run update-ca-trust extract (native, no JVM) — this also regenerates a consolidated Java truststore containing the system CAs plus the LDAP CAs, with aliases derived deterministically from each certificate instead of $RANDOM.
• Merge that consolidated truststore into $JAVA_HOME/lib/security/cacerts with a single keytool -importkeystore call, replacing the per-file loop and cutting N emulated JVM launches down to exactly 1.
• Multi-stage layout (base, base-ssl-true, base-ssl-false, final), all build args, and the self-signed cert generation logic are unchanged.

# before: one keytool (JVM) launch per PEM file
RUN for file in `ls /opt/certs/*.pem`; do \
    echo yes | keytool -import -file $file -alias ldaps$RANDOM -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit; \
done

# after: OS trust update + single keytool invocation
RUN cp /opt/certs/*.pem /etc/pki/ca-trust/source/anchors/ && update-ca-trust extract
RUN keytool -importkeystore -noprompt \
        -srckeystore /etc/pki/ca-trust/extracted/java/cacerts -srcstorepass changeit \
        -destkeystore $JAVA_HOME/lib/security/cacerts -deststorepass changeit

Closes #180

Release Notes

• Fixed: multi-arch Docker build no longer stalls unnecessarily on emulated linux/amd64 cert import (one keytool JVM launch instead of one per certificate)

Related

[hamc17]

LGTM!