From 3d26403f6d5d290f9bd23fb6a68fec1c5ac54656 Mon Sep 17 00:00:00 2001 From: Tianon Gravi Date: Fri, 6 Sep 2019 11:41:35 -0700 Subject: [PATCH] Add Debian variants of Oracle-consuming versions These are images based on the official JDK artifacts for 12+ released on https://jdk.java.net/ with a Debian base in addition to Oracle. --- .travis.yml | 8 +++ 13/jdk/Dockerfile | 81 +++++++++++++++++++++++++++++++ 13/jdk/slim/Dockerfile | 80 ++++++++++++++++++++++++++++++ 14/jdk/Dockerfile | 81 +++++++++++++++++++++++++++++++ 14/jdk/slim/Dockerfile | 80 ++++++++++++++++++++++++++++++ Dockerfile-oracle-debian.template | 81 +++++++++++++++++++++++++++++++ Dockerfile-oracle-slim.template | 80 ++++++++++++++++++++++++++++++ update.sh | 18 ++++--- 8 files changed, 501 insertions(+), 8 deletions(-) create mode 100644 13/jdk/Dockerfile create mode 100644 13/jdk/slim/Dockerfile create mode 100644 14/jdk/Dockerfile create mode 100644 14/jdk/slim/Dockerfile create mode 100644 Dockerfile-oracle-debian.template create mode 100644 Dockerfile-oracle-slim.template diff --git a/.travis.yml b/.travis.yml index 6f9f6a55..1991da5f 100644 --- a/.travis.yml +++ b/.travis.yml @@ -5,6 +5,10 @@ matrix: include: - os: linux env: VERSION=14 VARIANT=oracle + - os: linux + env: VERSION=14 + - os: linux + env: VERSION=14 VARIANT=slim - os: linux env: VERSION=14 VARIANT=alpine - os: windows @@ -12,6 +16,10 @@ matrix: env: VERSION=14 VARIANT=windows/windowsservercore-1803 - os: linux env: VERSION=13 VARIANT=oracle + - os: linux + env: VERSION=13 + - os: linux + env: VERSION=13 VARIANT=slim - os: windows dist: 1803-containers env: VERSION=13 VARIANT=windows/windowsservercore-1803 diff --git a/13/jdk/Dockerfile b/13/jdk/Dockerfile new file mode 100644 index 00000000..3337a85f --- /dev/null +++ b/13/jdk/Dockerfile @@ -0,0 +1,81 @@ +FROM buildpack-deps:buster-scm + +RUN set -eux; \ + apt-get update; \ + apt-get install -y --no-install-recommends \ + bzip2 \ + unzip \ + xz-utils \ + \ +# utilities for keeping Debian and OpenJDK CA certificates in sync + ca-certificates p11-kit \ + \ +# jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351 +# Error: java.io.IOException: Cannot run program "objcopy": error=2, No such file or directory + binutils \ +# java.lang.UnsatisfiedLinkError: /usr/local/openjdk-11/lib/libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory +# java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager +# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077 + fontconfig libfreetype6 \ + ; \ + rm -rf /var/lib/apt/lists/* + +# Default to UTF-8 file.encoding +ENV LANG C.UTF-8 + +ENV JAVA_HOME /usr/java/openjdk-13 +ENV PATH $JAVA_HOME/bin:$PATH + +# backwards compatibility shim +RUN { echo '#/bin/sh'; echo 'echo "$JAVA_HOME"'; } > /usr/local/bin/docker-java-home && chmod +x /usr/local/bin/docker-java-home && [ "$JAVA_HOME" = "$(docker-java-home)" ] + +# https://jdk.java.net/ +ENV JAVA_VERSION 13 +ENV JAVA_URL https://download.java.net/java/GA/jdk13/5b8a42f3905b406298b72d750b6919f6/33/GPL/openjdk-13_linux-x64_bin.tar.gz +ENV JAVA_SHA256 5f547b8f0ffa7da517223f6f929a5055d749776b1878ccedbd6cc1334f4d6f4d + +RUN set -eux; \ + \ + wget -O openjdk.tgz "$JAVA_URL"; \ + echo "$JAVA_SHA256 */openjdk.tgz" | sha256sum -c -; \ + \ + mkdir -p "$JAVA_HOME"; \ + tar --extract \ + --file openjdk.tgz \ + --directory "$JAVA_HOME" \ + --strip-components 1 \ + --no-same-owner \ + ; \ + rm openjdk.tgz; \ + \ +# update "cacerts" bundle to use Debian's CA certificates (and make sure it stays up-to-date with changes to Debian's store) +# see https://github.com/docker-library/openjdk/issues/327 +# http://rabexc.org/posts/certificates-not-working-java#comment-4099504075 +# https://salsa.debian.org/java-team/ca-certificates-java/blob/3e51a84e9104823319abeb31f880580e46f45a98/debian/jks-keystore.hook.in +# https://git.alpinelinux.org/aports/tree/community/java-cacerts/APKBUILD?id=761af65f38b4570093461e6546dcf6b179d2b624#n29 + { \ + echo '#!/usr/bin/env bash'; \ + echo 'set -Eeuo pipefail'; \ + echo 'if ! [ -d "$JAVA_HOME" ]; then echo >&2 "error: missing JAVA_HOME environment variable"; exit 1; fi'; \ +# 8-jdk uses "$JAVA_HOME/jre/lib/security/cacerts" and 8-jre and 11+ uses "$JAVA_HOME/lib/security/cacerts" directly (no "jre" directory) + echo 'cacertsFile=; for f in "$JAVA_HOME/lib/security/cacerts" "$JAVA_HOME/jre/lib/security/cacerts"; do if [ -e "$f" ]; then cacertsFile="$f"; break; fi; done'; \ + echo 'if [ -z "$cacertsFile" ] || ! [ -f "$cacertsFile" ]; then echo >&2 "error: failed to find cacerts file in $JAVA_HOME"; exit 1; fi'; \ + echo 'trust extract --overwrite --format=java-cacerts --filter=ca-anchors --purpose=server-auth "$cacertsFile"'; \ + } > /etc/ca-certificates/update.d/docker-openjdk; \ + chmod +x /etc/ca-certificates/update.d/docker-openjdk; \ + /etc/ca-certificates/update.d/docker-openjdk; \ + \ +# https://github.com/docker-library/openjdk/issues/331#issuecomment-498834472 + find "$JAVA_HOME/lib" -name '*.so' -exec dirname '{}' ';' | sort -u > /etc/ld.so.conf.d/docker-openjdk.conf; \ + ldconfig; \ + \ +# https://github.com/docker-library/openjdk/issues/212#issuecomment-420979840 +# https://openjdk.java.net/jeps/341 + java -Xshare:dump; \ + \ +# basic smoke test + javac --version; \ + java --version + +# "jshell" is an interactive REPL for Java (see https://en.wikipedia.org/wiki/JShell) +CMD ["jshell"] diff --git a/13/jdk/slim/Dockerfile b/13/jdk/slim/Dockerfile new file mode 100644 index 00000000..e7f57cd3 --- /dev/null +++ b/13/jdk/slim/Dockerfile @@ -0,0 +1,80 @@ +FROM debian:buster-slim + +RUN set -eux; \ + apt-get update; \ + apt-get install -y --no-install-recommends \ +# utilities for keeping Debian and OpenJDK CA certificates in sync + ca-certificates p11-kit \ + ; \ + rm -rf /var/lib/apt/lists/* + +# Default to UTF-8 file.encoding +ENV LANG C.UTF-8 + +ENV JAVA_HOME /usr/java/openjdk-13 +ENV PATH $JAVA_HOME/bin:$PATH + +# backwards compatibility shim +RUN { echo '#/bin/sh'; echo 'echo "$JAVA_HOME"'; } > /usr/local/bin/docker-java-home && chmod +x /usr/local/bin/docker-java-home && [ "$JAVA_HOME" = "$(docker-java-home)" ] + +# https://jdk.java.net/ +ENV JAVA_VERSION 13 +ENV JAVA_URL https://download.java.net/java/GA/jdk13/5b8a42f3905b406298b72d750b6919f6/33/GPL/openjdk-13_linux-x64_bin.tar.gz +ENV JAVA_SHA256 5f547b8f0ffa7da517223f6f929a5055d749776b1878ccedbd6cc1334f4d6f4d + +RUN set -eux; \ + \ + savedAptMark="$(apt-mark showmanual)"; \ + apt-get update; \ + apt-get install -y --no-install-recommends \ + wget \ + ; \ + rm -rf /var/lib/apt/lists/*; \ + \ + wget -O openjdk.tgz "$JAVA_URL"; \ + echo "$JAVA_SHA256 */openjdk.tgz" | sha256sum -c -; \ + \ + mkdir -p "$JAVA_HOME"; \ + tar --extract \ + --file openjdk.tgz \ + --directory "$JAVA_HOME" \ + --strip-components 1 \ + --no-same-owner \ + ; \ + rm openjdk.tgz; \ + \ + apt-mark auto '.*' > /dev/null; \ + [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \ + apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \ + \ +# update "cacerts" bundle to use Debian's CA certificates (and make sure it stays up-to-date with changes to Debian's store) +# see https://github.com/docker-library/openjdk/issues/327 +# http://rabexc.org/posts/certificates-not-working-java#comment-4099504075 +# https://salsa.debian.org/java-team/ca-certificates-java/blob/3e51a84e9104823319abeb31f880580e46f45a98/debian/jks-keystore.hook.in +# https://git.alpinelinux.org/aports/tree/community/java-cacerts/APKBUILD?id=761af65f38b4570093461e6546dcf6b179d2b624#n29 + { \ + echo '#!/usr/bin/env bash'; \ + echo 'set -Eeuo pipefail'; \ + echo 'if ! [ -d "$JAVA_HOME" ]; then echo >&2 "error: missing JAVA_HOME environment variable"; exit 1; fi'; \ +# 8-jdk uses "$JAVA_HOME/jre/lib/security/cacerts" and 8-jre and 11+ uses "$JAVA_HOME/lib/security/cacerts" directly (no "jre" directory) + echo 'cacertsFile=; for f in "$JAVA_HOME/lib/security/cacerts" "$JAVA_HOME/jre/lib/security/cacerts"; do if [ -e "$f" ]; then cacertsFile="$f"; break; fi; done'; \ + echo 'if [ -z "$cacertsFile" ] || ! [ -f "$cacertsFile" ]; then echo >&2 "error: failed to find cacerts file in $JAVA_HOME"; exit 1; fi'; \ + echo 'trust extract --overwrite --format=java-cacerts --filter=ca-anchors --purpose=server-auth "$cacertsFile"'; \ + } > /etc/ca-certificates/update.d/docker-openjdk; \ + chmod +x /etc/ca-certificates/update.d/docker-openjdk; \ + /etc/ca-certificates/update.d/docker-openjdk; \ + \ +# https://github.com/docker-library/openjdk/issues/331#issuecomment-498834472 + find "$JAVA_HOME/lib" -name '*.so' -exec dirname '{}' ';' | sort -u > /etc/ld.so.conf.d/docker-openjdk.conf; \ + ldconfig; \ + \ +# https://github.com/docker-library/openjdk/issues/212#issuecomment-420979840 +# https://openjdk.java.net/jeps/341 + java -Xshare:dump; \ + \ +# basic smoke test + javac --version; \ + java --version + +# "jshell" is an interactive REPL for Java (see https://en.wikipedia.org/wiki/JShell) +CMD ["jshell"] diff --git a/14/jdk/Dockerfile b/14/jdk/Dockerfile new file mode 100644 index 00000000..11b088db --- /dev/null +++ b/14/jdk/Dockerfile @@ -0,0 +1,81 @@ +FROM buildpack-deps:buster-scm + +RUN set -eux; \ + apt-get update; \ + apt-get install -y --no-install-recommends \ + bzip2 \ + unzip \ + xz-utils \ + \ +# utilities for keeping Debian and OpenJDK CA certificates in sync + ca-certificates p11-kit \ + \ +# jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351 +# Error: java.io.IOException: Cannot run program "objcopy": error=2, No such file or directory + binutils \ +# java.lang.UnsatisfiedLinkError: /usr/local/openjdk-11/lib/libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory +# java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager +# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077 + fontconfig libfreetype6 \ + ; \ + rm -rf /var/lib/apt/lists/* + +# Default to UTF-8 file.encoding +ENV LANG C.UTF-8 + +ENV JAVA_HOME /usr/java/openjdk-14 +ENV PATH $JAVA_HOME/bin:$PATH + +# backwards compatibility shim +RUN { echo '#/bin/sh'; echo 'echo "$JAVA_HOME"'; } > /usr/local/bin/docker-java-home && chmod +x /usr/local/bin/docker-java-home && [ "$JAVA_HOME" = "$(docker-java-home)" ] + +# https://jdk.java.net/ +ENV JAVA_VERSION 14-ea+14 +ENV JAVA_URL https://download.java.net/java/early_access/jdk14/14/GPL/openjdk-14-ea+14_linux-x64_bin.tar.gz +ENV JAVA_SHA256 fc1aed4e0de423dbb27db449b63b25c61b06b80e275f7ef665cce6c61e736726 + +RUN set -eux; \ + \ + wget -O openjdk.tgz "$JAVA_URL"; \ + echo "$JAVA_SHA256 */openjdk.tgz" | sha256sum -c -; \ + \ + mkdir -p "$JAVA_HOME"; \ + tar --extract \ + --file openjdk.tgz \ + --directory "$JAVA_HOME" \ + --strip-components 1 \ + --no-same-owner \ + ; \ + rm openjdk.tgz; \ + \ +# update "cacerts" bundle to use Debian's CA certificates (and make sure it stays up-to-date with changes to Debian's store) +# see https://github.com/docker-library/openjdk/issues/327 +# http://rabexc.org/posts/certificates-not-working-java#comment-4099504075 +# https://salsa.debian.org/java-team/ca-certificates-java/blob/3e51a84e9104823319abeb31f880580e46f45a98/debian/jks-keystore.hook.in +# https://git.alpinelinux.org/aports/tree/community/java-cacerts/APKBUILD?id=761af65f38b4570093461e6546dcf6b179d2b624#n29 + { \ + echo '#!/usr/bin/env bash'; \ + echo 'set -Eeuo pipefail'; \ + echo 'if ! [ -d "$JAVA_HOME" ]; then echo >&2 "error: missing JAVA_HOME environment variable"; exit 1; fi'; \ +# 8-jdk uses "$JAVA_HOME/jre/lib/security/cacerts" and 8-jre and 11+ uses "$JAVA_HOME/lib/security/cacerts" directly (no "jre" directory) + echo 'cacertsFile=; for f in "$JAVA_HOME/lib/security/cacerts" "$JAVA_HOME/jre/lib/security/cacerts"; do if [ -e "$f" ]; then cacertsFile="$f"; break; fi; done'; \ + echo 'if [ -z "$cacertsFile" ] || ! [ -f "$cacertsFile" ]; then echo >&2 "error: failed to find cacerts file in $JAVA_HOME"; exit 1; fi'; \ + echo 'trust extract --overwrite --format=java-cacerts --filter=ca-anchors --purpose=server-auth "$cacertsFile"'; \ + } > /etc/ca-certificates/update.d/docker-openjdk; \ + chmod +x /etc/ca-certificates/update.d/docker-openjdk; \ + /etc/ca-certificates/update.d/docker-openjdk; \ + \ +# https://github.com/docker-library/openjdk/issues/331#issuecomment-498834472 + find "$JAVA_HOME/lib" -name '*.so' -exec dirname '{}' ';' | sort -u > /etc/ld.so.conf.d/docker-openjdk.conf; \ + ldconfig; \ + \ +# https://github.com/docker-library/openjdk/issues/212#issuecomment-420979840 +# https://openjdk.java.net/jeps/341 + java -Xshare:dump; \ + \ +# basic smoke test + javac --version; \ + java --version + +# "jshell" is an interactive REPL for Java (see https://en.wikipedia.org/wiki/JShell) +CMD ["jshell"] diff --git a/14/jdk/slim/Dockerfile b/14/jdk/slim/Dockerfile new file mode 100644 index 00000000..7889d266 --- /dev/null +++ b/14/jdk/slim/Dockerfile @@ -0,0 +1,80 @@ +FROM debian:buster-slim + +RUN set -eux; \ + apt-get update; \ + apt-get install -y --no-install-recommends \ +# utilities for keeping Debian and OpenJDK CA certificates in sync + ca-certificates p11-kit \ + ; \ + rm -rf /var/lib/apt/lists/* + +# Default to UTF-8 file.encoding +ENV LANG C.UTF-8 + +ENV JAVA_HOME /usr/java/openjdk-14 +ENV PATH $JAVA_HOME/bin:$PATH + +# backwards compatibility shim +RUN { echo '#/bin/sh'; echo 'echo "$JAVA_HOME"'; } > /usr/local/bin/docker-java-home && chmod +x /usr/local/bin/docker-java-home && [ "$JAVA_HOME" = "$(docker-java-home)" ] + +# https://jdk.java.net/ +ENV JAVA_VERSION 14-ea+14 +ENV JAVA_URL https://download.java.net/java/early_access/jdk14/14/GPL/openjdk-14-ea+14_linux-x64_bin.tar.gz +ENV JAVA_SHA256 fc1aed4e0de423dbb27db449b63b25c61b06b80e275f7ef665cce6c61e736726 + +RUN set -eux; \ + \ + savedAptMark="$(apt-mark showmanual)"; \ + apt-get update; \ + apt-get install -y --no-install-recommends \ + wget \ + ; \ + rm -rf /var/lib/apt/lists/*; \ + \ + wget -O openjdk.tgz "$JAVA_URL"; \ + echo "$JAVA_SHA256 */openjdk.tgz" | sha256sum -c -; \ + \ + mkdir -p "$JAVA_HOME"; \ + tar --extract \ + --file openjdk.tgz \ + --directory "$JAVA_HOME" \ + --strip-components 1 \ + --no-same-owner \ + ; \ + rm openjdk.tgz; \ + \ + apt-mark auto '.*' > /dev/null; \ + [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \ + apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \ + \ +# update "cacerts" bundle to use Debian's CA certificates (and make sure it stays up-to-date with changes to Debian's store) +# see https://github.com/docker-library/openjdk/issues/327 +# http://rabexc.org/posts/certificates-not-working-java#comment-4099504075 +# https://salsa.debian.org/java-team/ca-certificates-java/blob/3e51a84e9104823319abeb31f880580e46f45a98/debian/jks-keystore.hook.in +# https://git.alpinelinux.org/aports/tree/community/java-cacerts/APKBUILD?id=761af65f38b4570093461e6546dcf6b179d2b624#n29 + { \ + echo '#!/usr/bin/env bash'; \ + echo 'set -Eeuo pipefail'; \ + echo 'if ! [ -d "$JAVA_HOME" ]; then echo >&2 "error: missing JAVA_HOME environment variable"; exit 1; fi'; \ +# 8-jdk uses "$JAVA_HOME/jre/lib/security/cacerts" and 8-jre and 11+ uses "$JAVA_HOME/lib/security/cacerts" directly (no "jre" directory) + echo 'cacertsFile=; for f in "$JAVA_HOME/lib/security/cacerts" "$JAVA_HOME/jre/lib/security/cacerts"; do if [ -e "$f" ]; then cacertsFile="$f"; break; fi; done'; \ + echo 'if [ -z "$cacertsFile" ] || ! [ -f "$cacertsFile" ]; then echo >&2 "error: failed to find cacerts file in $JAVA_HOME"; exit 1; fi'; \ + echo 'trust extract --overwrite --format=java-cacerts --filter=ca-anchors --purpose=server-auth "$cacertsFile"'; \ + } > /etc/ca-certificates/update.d/docker-openjdk; \ + chmod +x /etc/ca-certificates/update.d/docker-openjdk; \ + /etc/ca-certificates/update.d/docker-openjdk; \ + \ +# https://github.com/docker-library/openjdk/issues/331#issuecomment-498834472 + find "$JAVA_HOME/lib" -name '*.so' -exec dirname '{}' ';' | sort -u > /etc/ld.so.conf.d/docker-openjdk.conf; \ + ldconfig; \ + \ +# https://github.com/docker-library/openjdk/issues/212#issuecomment-420979840 +# https://openjdk.java.net/jeps/341 + java -Xshare:dump; \ + \ +# basic smoke test + javac --version; \ + java --version + +# "jshell" is an interactive REPL for Java (see https://en.wikipedia.org/wiki/JShell) +CMD ["jshell"] diff --git a/Dockerfile-oracle-debian.template b/Dockerfile-oracle-debian.template new file mode 100644 index 00000000..1d484e7e --- /dev/null +++ b/Dockerfile-oracle-debian.template @@ -0,0 +1,81 @@ +FROM buildpack-deps:buster-scm + +RUN set -eux; \ + apt-get update; \ + apt-get install -y --no-install-recommends \ + bzip2 \ + unzip \ + xz-utils \ + \ +# utilities for keeping Debian and OpenJDK CA certificates in sync + ca-certificates p11-kit \ + \ +# jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351 +# Error: java.io.IOException: Cannot run program "objcopy": error=2, No such file or directory + binutils \ +# java.lang.UnsatisfiedLinkError: /usr/local/openjdk-11/lib/libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory +# java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager +# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077 + fontconfig libfreetype6 \ + ; \ + rm -rf /var/lib/apt/lists/* + +# Default to UTF-8 file.encoding +ENV LANG C.UTF-8 + +ENV JAVA_HOME placeholder +ENV PATH $JAVA_HOME/bin:$PATH + +# backwards compatibility shim +RUN { echo '#/bin/sh'; echo 'echo "$JAVA_HOME"'; } > /usr/local/bin/docker-java-home && chmod +x /usr/local/bin/docker-java-home && [ "$JAVA_HOME" = "$(docker-java-home)" ] + +# https://jdk.java.net/ +ENV JAVA_VERSION placeholder +ENV JAVA_URL placeholder +ENV JAVA_SHA256 placeholder + +RUN set -eux; \ + \ + wget -O openjdk.tgz "$JAVA_URL"; \ + echo "$JAVA_SHA256 */openjdk.tgz" | sha256sum -c -; \ + \ + mkdir -p "$JAVA_HOME"; \ + tar --extract \ + --file openjdk.tgz \ + --directory "$JAVA_HOME" \ + --strip-components 1 \ + --no-same-owner \ + ; \ + rm openjdk.tgz; \ + \ +# update "cacerts" bundle to use Debian's CA certificates (and make sure it stays up-to-date with changes to Debian's store) +# see https://github.com/docker-library/openjdk/issues/327 +# http://rabexc.org/posts/certificates-not-working-java#comment-4099504075 +# https://salsa.debian.org/java-team/ca-certificates-java/blob/3e51a84e9104823319abeb31f880580e46f45a98/debian/jks-keystore.hook.in +# https://git.alpinelinux.org/aports/tree/community/java-cacerts/APKBUILD?id=761af65f38b4570093461e6546dcf6b179d2b624#n29 + { \ + echo '#!/usr/bin/env bash'; \ + echo 'set -Eeuo pipefail'; \ + echo 'if ! [ -d "$JAVA_HOME" ]; then echo >&2 "error: missing JAVA_HOME environment variable"; exit 1; fi'; \ +# 8-jdk uses "$JAVA_HOME/jre/lib/security/cacerts" and 8-jre and 11+ uses "$JAVA_HOME/lib/security/cacerts" directly (no "jre" directory) + echo 'cacertsFile=; for f in "$JAVA_HOME/lib/security/cacerts" "$JAVA_HOME/jre/lib/security/cacerts"; do if [ -e "$f" ]; then cacertsFile="$f"; break; fi; done'; \ + echo 'if [ -z "$cacertsFile" ] || ! [ -f "$cacertsFile" ]; then echo >&2 "error: failed to find cacerts file in $JAVA_HOME"; exit 1; fi'; \ + echo 'trust extract --overwrite --format=java-cacerts --filter=ca-anchors --purpose=server-auth "$cacertsFile"'; \ + } > /etc/ca-certificates/update.d/docker-openjdk; \ + chmod +x /etc/ca-certificates/update.d/docker-openjdk; \ + /etc/ca-certificates/update.d/docker-openjdk; \ + \ +# https://github.com/docker-library/openjdk/issues/331#issuecomment-498834472 + find "$JAVA_HOME/lib" -name '*.so' -exec dirname '{}' ';' | sort -u > /etc/ld.so.conf.d/docker-openjdk.conf; \ + ldconfig; \ + \ +# https://github.com/docker-library/openjdk/issues/212#issuecomment-420979840 +# https://openjdk.java.net/jeps/341 + java -Xshare:dump; \ + \ +# basic smoke test + javac --version; \ + java --version + +# "jshell" is an interactive REPL for Java (see https://en.wikipedia.org/wiki/JShell) +CMD ["jshell"] diff --git a/Dockerfile-oracle-slim.template b/Dockerfile-oracle-slim.template new file mode 100644 index 00000000..511a2d6a --- /dev/null +++ b/Dockerfile-oracle-slim.template @@ -0,0 +1,80 @@ +FROM debian:buster-slim + +RUN set -eux; \ + apt-get update; \ + apt-get install -y --no-install-recommends \ +# utilities for keeping Debian and OpenJDK CA certificates in sync + ca-certificates p11-kit \ + ; \ + rm -rf /var/lib/apt/lists/* + +# Default to UTF-8 file.encoding +ENV LANG C.UTF-8 + +ENV JAVA_HOME placeholder +ENV PATH $JAVA_HOME/bin:$PATH + +# backwards compatibility shim +RUN { echo '#/bin/sh'; echo 'echo "$JAVA_HOME"'; } > /usr/local/bin/docker-java-home && chmod +x /usr/local/bin/docker-java-home && [ "$JAVA_HOME" = "$(docker-java-home)" ] + +# https://jdk.java.net/ +ENV JAVA_VERSION placeholder +ENV JAVA_URL placeholder +ENV JAVA_SHA256 placeholder + +RUN set -eux; \ + \ + savedAptMark="$(apt-mark showmanual)"; \ + apt-get update; \ + apt-get install -y --no-install-recommends \ + wget \ + ; \ + rm -rf /var/lib/apt/lists/*; \ + \ + wget -O openjdk.tgz "$JAVA_URL"; \ + echo "$JAVA_SHA256 */openjdk.tgz" | sha256sum -c -; \ + \ + mkdir -p "$JAVA_HOME"; \ + tar --extract \ + --file openjdk.tgz \ + --directory "$JAVA_HOME" \ + --strip-components 1 \ + --no-same-owner \ + ; \ + rm openjdk.tgz; \ + \ + apt-mark auto '.*' > /dev/null; \ + [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \ + apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \ + \ +# update "cacerts" bundle to use Debian's CA certificates (and make sure it stays up-to-date with changes to Debian's store) +# see https://github.com/docker-library/openjdk/issues/327 +# http://rabexc.org/posts/certificates-not-working-java#comment-4099504075 +# https://salsa.debian.org/java-team/ca-certificates-java/blob/3e51a84e9104823319abeb31f880580e46f45a98/debian/jks-keystore.hook.in +# https://git.alpinelinux.org/aports/tree/community/java-cacerts/APKBUILD?id=761af65f38b4570093461e6546dcf6b179d2b624#n29 + { \ + echo '#!/usr/bin/env bash'; \ + echo 'set -Eeuo pipefail'; \ + echo 'if ! [ -d "$JAVA_HOME" ]; then echo >&2 "error: missing JAVA_HOME environment variable"; exit 1; fi'; \ +# 8-jdk uses "$JAVA_HOME/jre/lib/security/cacerts" and 8-jre and 11+ uses "$JAVA_HOME/lib/security/cacerts" directly (no "jre" directory) + echo 'cacertsFile=; for f in "$JAVA_HOME/lib/security/cacerts" "$JAVA_HOME/jre/lib/security/cacerts"; do if [ -e "$f" ]; then cacertsFile="$f"; break; fi; done'; \ + echo 'if [ -z "$cacertsFile" ] || ! [ -f "$cacertsFile" ]; then echo >&2 "error: failed to find cacerts file in $JAVA_HOME"; exit 1; fi'; \ + echo 'trust extract --overwrite --format=java-cacerts --filter=ca-anchors --purpose=server-auth "$cacertsFile"'; \ + } > /etc/ca-certificates/update.d/docker-openjdk; \ + chmod +x /etc/ca-certificates/update.d/docker-openjdk; \ + /etc/ca-certificates/update.d/docker-openjdk; \ + \ +# https://github.com/docker-library/openjdk/issues/331#issuecomment-498834472 + find "$JAVA_HOME/lib" -name '*.so' -exec dirname '{}' ';' | sort -u > /etc/ld.so.conf.d/docker-openjdk.conf; \ + ldconfig; \ + \ +# https://github.com/docker-library/openjdk/issues/212#issuecomment-420979840 +# https://openjdk.java.net/jeps/341 + java -Xshare:dump; \ + \ +# basic smoke test + javac --version; \ + java --version + +# "jshell" is an interactive REPL for Java (see https://en.wikipedia.org/wiki/JShell) +CMD ["jshell"] diff --git a/update.sh b/update.sh index 8e19d22a..f0674950 100755 --- a/update.sh +++ b/update.sh @@ -202,24 +202,26 @@ for javaVersion in "${versions[@]}"; do Dockerfile-oracle-alpine.template > "$dir/alpine/Dockerfile" fi - if [ -d "$dir/oracle" ]; then - downloadUrl="$(jdk-java-net-download-url "$javaVersion" '_linux-x64_bin.tar.gz')" - downloadSha256="$(wget -qO- "$downloadUrl.sha256")" - downloadVersion="$(jdk-java-net-download-version "$javaVersion" "$downloadUrl")" + downloadUrl="$(jdk-java-net-download-url "$javaVersion" '_linux-x64_bin.tar.gz')" + downloadSha256="$(wget -qO- "$downloadUrl.sha256")" + downloadVersion="$(jdk-java-net-download-version "$javaVersion" "$downloadUrl")" - echo "$javaVersion-$javaType: $downloadVersion (oracle)" + echo "$javaVersion-$javaType: $downloadVersion (oracle)" + for variant in oracle debian slim; do + [ "$variant" = 'debian' ] && variantDir="$dir" || variantDir="$dir/$variant" + [ -d "$variantDir" ] || continue sed -r \ -e 's!^(ENV JAVA_HOME) .*!\1 /usr/java/openjdk-'"$javaVersion"'!' \ -e 's!^(ENV JAVA_VERSION) .*!\1 '"$downloadVersion"'!' \ -e 's!^(ENV JAVA_URL) .*!\1 '"$downloadUrl"'!' \ -e 's!^(ENV JAVA_SHA256) .*!\1 '"$downloadSha256"'!' \ - Dockerfile-oracle-oracle.template > "$dir/oracle/Dockerfile" + "Dockerfile-oracle-$variant.template" > "$variantDir/Dockerfile" if [ "$javaVersion" = '12' ]; then # https://github.com/docker-library/openjdk/issues/351 - sed -ri '/objcopy|binutils/d' "$dir/oracle/Dockerfile" + sed -ri '/objcopy|binutils/d' "$variantDir/Dockerfile" fi - fi + done if [ -d "$dir/windows" ]; then downloadUrl="$(jdk-java-net-download-url "$javaVersion" '_windows-x64_bin.zip')"