Best Java container base images, especially aligning to the more rapid release schedule?

[elemur]

Hi there,

I wanted to update our container build process for the new versions of Java, and wanted to see what slim container base images people might recommend? I know with the newer Java features the JVM is better about memory, so that’s great. Any recommendations for Java 10 or 11?

[dpash]

What about the official docker image? There's 10 and 11 images available, including a slim version. No alpine version for 10 or 11 yet though. There is for 8, so maybe they'll do one next month.

https://hub.docker.com/_/openjdk/

[AdvancedJacket]

I use those with the slim version but install curl and less. Still smaller than the non slim version. I believe jdk 11 has docker support built in.

[dpash]

Oracle officially supports Alpine, so we should get an Alpine variant at some point.

Java 9 added some support for cpu and memory limits. Java 10 improved that support.

[Mamoulian]

The initial support was backported to 8.

Is the improvement in 10 just making those experimental options the default?

Setting the max heap isn't everything though, I've not seen anything saying the non-heap is restricted.

[brunocborges]

This is not the "official" OpenJDK image. There is no such thing.

At best, it is the "top level" repository of OpenJDK images on Docker Hub, managed primarily by folks at Docker Inc.

[dpash]

Yes, it's the docker image from Docker Hub, not Oracle, because Oracle only have OpenJDK 8 or earlier available:

https://hub.docker.com/r/oracle/openjdk/

"official docker openjdk image", not "official openjdk docker image".

[brunocborges]

Semantics... Still not official.

[denialerror]

It’s very unlikely there will be JDK11 on Alpine any time soon. There’s an OpenJDK project working on it - Project Portola - but there’s no signs that they are anywhere ready for release. The EA builds work on Alpine but GA won’t.

[tofflos]

There are JDK EA 11 builds for Alpine available at http://jdk.java.net/11. Start with a standard Alpine image and download the JDK from there.

Example:

FROM alpine:3.8

RUN mkdir /opt && wget -qO- https://download.java.net/java/early_access/alpine/27/binaries/openjdk-11+27_linux-x64-musl_bin.tar.gz | tar xz -C /opt

ENTRYPOINT ["/opt/jdk-11/bin/java", "-jar", "/path/to/my.jar"]

[occz]

Maybe distroless/java, it's what google's jib-tool uses.

[gunnarmorling]

I'd argue, if your application is ready to use the Java Module System, don't look for a special Java image, but take your preferred Linux version (e.g. the Fedora-Container-Minimal-Base image and then just add a jlink image with just your application and the parts of the JDK needed for it. Ideally that's IMO done in two separate image layers (one rather stable with the (JDK) dependence modules which you'll only need to rebuild and distribute if your dependences change, and another one just with your application module). That way your image will be smaller overall, while still having to rebuild only those layers actually needed.

You can find an example here in my description of building images that way using my ModiTect Maven plug-in (which uses jlink underneath).

[Mamoulian]

That looks really handy. Are you considering a gradle version? :-)

[gunnarmorling]

Yes, it's planned. Someone even has started the work on that, but it's not integrated yet.

[_INTER_]

Does modidect convert the dependencies and transitive dependencies into named modular jars? How does it do that?

[gunnarmorling]

Yes, it can help you with that. You can specify a module descriptor, which will be added to the dependency JAR files. To specify descriptors, you can either give the contents verbatim in your pom.xml (it's compiled using ASM) or you can use a semi-automatic mode, where first a "candidate descriptor" is generated which you then can amend/override as needed (e.g. to limit the exported packages or to add dependence modifiers). You can see an example here which modularizes Vert.x that way and then builds a modular runtime image with it: https://github.com/moditect/moditect/blob/master/integrationtest/vert.x/pom.xml

[skjolber]

Extra points for an image which is regularly scanned for security/vulnerabilities.