Merge pull request #1 from hypertrace/java-base-images

Add docker jre images for java 11 and 14

Author: ravisingal

.circleci/config.yml

@@ -53,12 +53,6 @@ jobs:
     executor: gradle_docker
     steps:
       - setup_build_environment
-      - gradle:
-          args: :tag -Prelease
-      - add_ssh_keys:
-          fingerprints:
-            - '9f:bb:a7:39:fa:3d:39:04:bd:c6:66:27:79:b1:49:86'
-      - run: git push origin $(./gradlew -q :printVersion)
       - gradle:
           args: dockerPushImages
 
@@ -67,11 +61,11 @@ workflows:
   build-and-publish:
     jobs:
       - build
-#      - publish:
-#          context: hypertrace-publishing
-#          requires:
-#            - build
-#          filters:
-#            branches:
-#              only:
-#                - main
+      - publish:
+          context: hypertrace-publishing
+          requires:
+            - build
+          filters:
+            branches:
+              only:
+                - main

java-11/Dockerfile

@@ -1 +1,57 @@
-FROM gcr.io/distroless/java:11-debug
+ARG JAVA_VERSION
+FROM azul/zulu-openjdk-debian:${JAVA_VERSION} AS jre
+
+# Needed for --strip-debug
+RUN apt-get -y update && apt-get -y install binutils
+
+# Included modules cherrypicked from https://docs.oracle.com/en/java/javase/11/docs/api/
+#
+# jdk.unsupported is undocumented but contains Unsafe, which is used by several dependencies to
+# improve performance.
+RUN cd / && jlink --no-header-files --no-man-pages --compress=0 --strip-debug \
+    --add-modules java.base,java.logging,\
+# java.desktop includes java.beans which is used by Spring
+java.desktop,\
+java.sql,\
+# instrumentation
+java.instrument,\
+# we don't use JMX, but log4j2 errors without it: LOG4J2-716
+java.management,\
+# remote debug
+jdk.jdwp.agent,\
+# JVM metrics such as garbage collection
+jdk.management,\
+# prevents us from needing a different base layer for kafka-zookeeper
+# ZooKeeper needs jdk.management.agent, and adding it is 900K vs 200M for a different base layer
+jdk.management.agent,\
+# non-netty based DNS
+java.naming,jdk.naming.dns,\
+# TLS handehake with servers that use elliptic curve certificates
+jdk.crypto.ec,\
+# sun.misc.Unsafe and friends
+jdk.unsupported\
+ --output jre
+
+# We extract JRE's hard dependencies, libz and SSL certs, from the fat JRE image.
+FROM gcr.io/distroless/java:11-debug AS deps
+
+FROM gcr.io/distroless/cc:debug
+
+MAINTAINER Hypertrace "https://www.hypertrace.org/"
+
+SHELL ["/busybox/sh", "-c"]
+
+RUN ln -s /busybox/sh /bin/sh
+
+COPY --from=deps /etc/ssl/certs/java /etc/ssl/certs/java
+
+COPY --from=deps /lib/x86_64-linux-gnu/libz.so.1.2.8 /lib/x86_64-linux-gnu/libz.so.1.2.8
+RUN ln -s /lib/x86_64-linux-gnu/libz.so.1.2.8 /lib/x86_64-linux-gnu/libz.so.1
+
+COPY --from=jre /jre /usr/lib/jvm/zulu-11-amd64-slim
+RUN ln -s /usr/lib/jvm/zulu-11-amd64-slim/bin/java /usr/bin/java
+
+# set JAVA_HOME
+ENV JAVA_HOME=/usr/lib/jvm/zulu-11-amd64-slim
+
+ENTRYPOINT ["/usr/bin/java", "-jar"]

java-11/build.gradle.kts

@@ -2,9 +2,15 @@ plugins {
   id("org.hypertrace.docker-publish-plugin")
 }
 
+var javaVersion = "11.0.8-11.41.23"
+
 hypertraceDocker {
   defaultImage {
     imageName.set("java")
-    setTagNameTransform { tag -> "11-${tag.name}" }
+    buildArgs.put("JAVA_VERSION", javaVersion)
+    tags.forEach { it.onlyIf { false } }
+    tag(javaVersion)
+    tag(javaVersion.split('-')[0])
+    tag(javaVersion.split('.')[0])
   }
-}
+}

java-14/Dockerfile

@@ -0,0 +1,57 @@
+ARG JAVA_VERSION
+FROM azul/zulu-openjdk-debian:${JAVA_VERSION} AS jre
+
+# Needed for --strip-debug
+RUN apt-get -y update && apt-get -y install binutils
+
+# Included modules cherrypicked from https://docs.oracle.com/en/java/javase/11/docs/api/
+#
+# jdk.unsupported is undocumented but contains Unsafe, which is used by several dependencies to
+# improve performance.
+RUN cd / && jlink --no-header-files --no-man-pages --compress=0 --strip-debug \
+    --add-modules java.base,java.logging,\
+# java.desktop includes java.beans which is used by Spring
+java.desktop,\
+java.sql,\
+# instrumentation
+java.instrument,\
+# we don't use JMX, but log4j2 errors without it: LOG4J2-716
+java.management,\
+# remote debug
+jdk.jdwp.agent,\
+# JVM metrics such as garbage collection
+jdk.management,\
+# prevents us from needing a different base layer for kafka-zookeeper
+# ZooKeeper needs jdk.management.agent, and adding it is 900K vs 200M for a different base layer
+jdk.management.agent,\
+# non-netty based DNS
+java.naming,jdk.naming.dns,\
+# TLS handehake with servers that use elliptic curve certificates
+jdk.crypto.ec,\
+# sun.misc.Unsafe and friends
+jdk.unsupported\
+ --output jre
+
+# We extract JRE's hard dependencies, libz and SSL certs, from the fat JRE image.
+FROM gcr.io/distroless/java:11-debug AS deps
+
+FROM gcr.io/distroless/cc:debug
+
+MAINTAINER Hypertrace "https://www.hypertrace.org/"
+
+SHELL ["/busybox/sh", "-c"]
+
+RUN ln -s /busybox/sh /bin/sh
+
+COPY --from=deps /etc/ssl/certs/java /etc/ssl/certs/java
+
+COPY --from=deps /lib/x86_64-linux-gnu/libz.so.1.2.8 /lib/x86_64-linux-gnu/libz.so.1.2.8
+RUN ln -s /lib/x86_64-linux-gnu/libz.so.1.2.8 /lib/x86_64-linux-gnu/libz.so.1
+
+COPY --from=jre /jre /usr/lib/jvm/zulu-14-amd64-slim
+RUN ln -s /usr/lib/jvm/zulu-14-amd64-slim/bin/java /usr/bin/java
+
+# set JAVA_HOME
+ENV JAVA_HOME=/usr/lib/jvm/zulu-14-amd64-slim
+
+ENTRYPOINT ["/usr/bin/java", "-jar"]

java-14/build.gradle.kts

@@ -0,0 +1,16 @@
+plugins {
+  id("org.hypertrace.docker-publish-plugin")
+}
+
+var javaVersion = "14.0.2-14.29.23"
+
+hypertraceDocker {
+  defaultImage {
+    imageName.set("java")
+    buildArgs.put("JAVA_VERSION", javaVersion)
+    tags.forEach { it.onlyIf { false } }
+    tag(javaVersion)
+    tag(javaVersion.split('-')[0])
+    tag(javaVersion.split('.')[0])
+  }
+}

java-8/Dockerfile

@@ -6,10 +6,5 @@ pluginManagement {
   }
 }
 
-plugins {
-  id("org.hypertrace.version-settings") version "0.1.5"
-}
-
-
-include(":java-8")
-include(":java-11")
+include(":java-11")
+include(":java-14")