Use when packaging a Spring Boot 3 application as an OCI image or GraalVM native executable. Covers buildpacks, layered images, JVM containers, AOT hints, probes, security, and verification.
SkillScore82Maintained
Automatic
◆DevOps & SRE pack
Last verified 9/25/2026
What it changes
Passed 18 of 22 test cases with the skill, and 16 of 22 without it.
Without skill73%
With skill82%
Checks it passed that the model alone missed
Specifies GraalVM 25 or newer.
Specifies Spring Boot 4 native build support.
Coordinates Spring Boot graceful shutdown with platform termination timing.
and 1 more in the full report
2 fixed16 passed either way4 still failing0 broke
Pass-rate lift
+9 pp
Tokens
+1%
Agent turns
0%
Response time
-21%
Model gemini-3.6-flashMeasured 9/25/2026v218 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 2
Prompt
We are preparing a Spring Boot app for containerized deployment on OpenShift. How should we configure our application probes so remote database outages don't cause restart loops, and what supply chain and container runtime practices should we follow for managing credentials and container security?
What was checked, without and with the skill
Checked
Without skill
With skill
Configures readiness probes to check remote database availability.
Passed
Passed
Prohibits copying credentials or secrets into image layers or build contexts.
Missed
Passed
Coordinates Spring Boot graceful shutdown with platform termination timing.
Missed
Passed
case-03 · gemini-3.6-flash · 9/25/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md54 linessingle file
Container and Native Deployment
Choose JVM, AOT cache, checkpoint/restore, or native from measured requirements.
Container image
Prefer Boot build-image tasks with Cloud Native Buildpacks for standard services.
Preserve dependency, loader, snapshot, and application layers for cache reuse.
Pin compatible builder/run image families and promote immutable digests.
Run as non-root and use a read-only filesystem where possible.
Inject secrets at runtime; never copy credentials into a build context or image layer.
Configure graceful shutdown and platform termination timing together.
Runtime behavior
Verify JVM memory and CPU ergonomics under real container limits.
Expose Actuator liveness and readiness probes separately.
Use a startup probe for expensive initialization.
Keep writable paths explicit and bounded.
Native image and AOT
Use GraalVM 25 or newer with Boot 4 native build support.
Register narrow RuntimeHints for reflection, resources, serialization, JNI, or proxies.
Respect the closed-world model: runtime bean topology and classpath cannot change.
Review profile and conditional-bean behavior during AOT processing.
Run native integration tests against the produced executable.
Supply chain
Generate an SBOM, scan the final image, and regularly rebuild on patched run images.
Sign and attest release images where the delivery platform supports it.
Examples
See examples/good-dockerfile and examples/bad-dockerfile.
The good example uses Boot's jarmode=tools extraction in a builder stage. A normal Maven package
does not create target/dependencies/ or target/application/ directories by itself.