Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/lsampaioweb/ai-instructions/spring-boot-containergit clone --depth 1 https://github.com/lsampaioweb/ai-instructionsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/lsampaioweb/ai-instructions/spring-boot-container)<a href="https://agentmods.dev/instructions/lsampaioweb/ai-instructions/spring-boot-container"><img src="https://agentmods.dev/badge/instructions/lsampaioweb/ai-instructions/spring-boot-container.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00504 | $0.00504 |
| Opus 5 | $0.00252 | $0.00252 |
| Sonnet 5 | $0.00101 | $0.00101 |
| Haiku 4.5 | $0.00050 | $0.00050 |
Grade A, and why
ai-instructions spring-boot-container.instructions.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 36 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Spring Boot Container
Rules
- Use an official Eclipse Temurin JRE image as the base image for runtime stages.
- Keep container images pinned to explicit tags.
- Keep build and runtime stages separated when multi-stage is used.
- Keep compose services hardened with minimal privileges by default.
- Set
restart: "unless-stopped"as the default container restart policy. - Set
read_only: trueon all compose services. - Declare
tmpfsmounts for writable runtime directories such as/tmpwithnoexec,nosuidoptions whenread_only: trueis set. - Set
cap_drop: ["ALL"]on every compose service by default. - Set
security_opt: ["no-new-privileges:true"]on every compose service. - Run the Spring Boot application as a non-root user inside the container.
- Define a dedicated
appuserwith a non-zero UID for the application user. - Keep capability additions exceptional and justified inline for each service.
- Keep socket mounts read-only and justified by explicit runtime needs.
- Document the standalone app flow and the shared infrastructure flow as separate run scenarios.
- Keep healthchecks explicit and service-appropriate (actuator endpoints for Spring apps, native probes for infrastructure services).
- Set healthcheck with
interval=30s,timeout=5s,retries=3, andstart_period=60sas defaults unless operational requirements differ. - Keep runtime configuration profile-aware and externalized.
- Activate the Spring profile via the
SPRING_PROFILES_ACTIVEenvironment variable. - Configure JVM flags via the
JAVA_TOOL_OPTIONSenvironment variable. - Expose port
8080in Dockerfile by default unless the application explicitly configures a different server port. - Set explicit CPU and memory resource limits (
cpus,mem_limit,mem_reservation) on every compose service.
Safety Guards
- Never bake profile selection into the Dockerfile layer.
- Never hardcode heap or memory flags in the
CMDorENTRYPOINTinstruction. - Never use
JAVA_OPTSas the JVM flags variable. - Never expose internal-only ports without explicit need and documentation.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 36 lines · 504 tokens per session scan A f5d12b9ac435
ai-instructions spring-boot-container.instructions.md is an instructions file published in the GitHub repository lsampaioweb/ai-instructions (1 stars, last pushed 13d ago), licensed MIT. It adds 504 tokens to every session, about $0.0025 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other instructions, from other repositories
appwrite AGENTS.md
AGENTS.md instructions for appwrite/appwrite, covering appwrite, commands, stack, layout and libraries.
selfhost-ai CLAUDE.md
Claude Code instructions for kossakovsky/selfhost-ai, covering claude.md, project overview, core architecture, key files and installation flow.
openlakeforge AGENTS.md
AGENTS.md instructions for malon64/openlakeforge, covering agent and contributor guide, what this project is, non-goals, orientation — read in this order and repository map.
docker-zoneminder CLAUDE.md
Instructions for jantman/docker-zoneminder, covering claude.md, project overview, build and test, ci/cd and architecture.
mitos CLAUDE.md
Instructions for mitos-run/mitos, covering claude.md, project overview, operating principles, commands and architecture.
MoaV AGENTS.md
AGENTS.md instructions for MotherofallVPNs/MoaV, covering what moav is, install & run, everyday operations, dashboards & access — what to hand the owner and where things live.