Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/lsampaioweb/ai-instructions/spring-boot-containergit clone --depth 1 https://github.com/lsampaioweb/ai-instructionsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/lsampaioweb/ai-instructions/spring-boot-container)<a href="https://agentmods.dev/rules/lsampaioweb/ai-instructions/spring-boot-container"><img src="https://agentmods.dev/badge/rules/lsampaioweb/ai-instructions/spring-boot-container.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00542 |
| Opus 5 | $0.00000 | $0.00271 |
| Sonnet 5 | $0.00000 | $0.00108 |
| Haiku 4.5 | $0.00000 | $0.00054 |
Grade A, and why
spring-boot-container scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 37 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Spring Boot Container
Rules
- Use an official Eclipse Temurin JRE image as the base image for runtime stages.
- Keep container images pinned to explicit tags.
- Keep build and runtime stages separated when multi-stage is used.
- Keep compose services hardened with minimal privileges by default.
- Set
restart: "unless-stopped"as the default container restart policy. - Set
read_only: trueon all compose services. - Declare
tmpfsmounts for writable runtime directories such as/tmpwithnoexec,nosuidoptions whenread_only: trueis set. - Set
cap_drop: ["ALL"]on every compose service by default. - Set
security_opt: ["no-new-privileges:true"]on every compose service. - Run the Spring Boot application as a non-root user inside the container.
- Define a dedicated
appuserwith a non-zero UID for the application user. - Keep capability additions exceptional and justified inline for each service.
- Keep socket mounts read-only and justified by explicit runtime needs.
- Keep local container run flows documented per scenario (standalone app flow or shared infrastructure flow).
- Keep healthchecks explicit and service-appropriate (actuator endpoints for Spring apps, native probes for infrastructure services).
- Set healthcheck with
interval=30s,timeout=5s,retries=3, andstart_period=60sas defaults unless operational requirements differ. - Keep runtime configuration profile-aware and externalized.
- Activate the Spring profile via the
SPRING_PROFILES_ACTIVEenvironment variable. - Configure JVM flags via the
JAVA_TOOL_OPTIONSenvironment variable. - Expose port
8080in Dockerfile by default unless the application explicitly configures a different server port. - Set explicit CPU and memory resource limits (
cpus,mem_limit,mem_reservation) on every compose service.
Safety Guards
- Never bake profile selection into the Dockerfile layer.
- Never hardcode heap or memory flags in the
CMDorENTRYPOINTinstruction. - Never use
JAVA_OPTSas the JVM flags variable when usingENTRYPOINT ["java", "-jar"]; useJAVA_TOOL_OPTIONSinstead. - Never expose internal-only ports without explicit need and documentation.
- Never ship container defaults that bypass runtime safety controls.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 37 lines · 0 tokens per session scan A 3d9f60d60456
spring-boot-container is a cursor rule published in the GitHub repository lsampaioweb/ai-instructions (1 stars, last pushed 11d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 542 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
cli-error-handling
CLI command error handling patterns.
prefer-direct-imports-over-module-mocks
Prefer extracting a testable core over vi.mock / vi.resetModules when unit tests need to reach production logic entangled with config, env, or singletons.
control-plane-descriptors
Control plane descriptor and instance implementation patterns.
family-instance-domain-actions
Family instance domain action implementation patterns.