jready is a set of minimalist Docker images that are ready to execute a JRE.
More than a small size, the goal of minimal Docker image is to enhance security by reducing the attack surface.
Note than theses images don't include a JRE:
- you can freely to choose the JRE vendor (eg Oracle or OpenJDK) and version (tested from 1.7 to 11)
- with JRE 9 and higher, you can freely build your own minimal JRE thanks to jlink. See example below.
An example below shows how a JRE can be integrated on top of theses images.
BusyBox based (busybox/Dockerfile)
Based on the offical BusyBox glibc image
Alpine based (alpine/Dockerfile)
Based on the offical Alpine image and Alpine GLIBC package
This example is based on OpenJDK 11. The example starts from the busybox
based image but alpine
can be used instead without any further changes in the Dockerfile.
Dockerfile
Create a minimal JRE image. If needed the JLINK_MODULES
list (comma-separated) can be completed to fit other needs.
FROM xfournet/jready:busybox
ARG JDK_URL=https://download.java.net/java/GA/jdk11/28/GPL/openjdk-11+28_linux-x64_bin.tar.gz
ARG JLINK_OPTIONS="--vm=server --compress=2 --no-header-files --no-man-pages"
ARG JLINK_MODULES="java.base"
ARG JRE_DIR="/opt/jre"
RUN \
# Download and extract JDK
wget ${JDK_URL} -O - | tar xz -C /tmp && \
# Build customized JRE
/tmp/jdk-*/bin/jlink --output ${JRE_DIR} --add-modules ${JLINK_MODULES} ${JLINK_OPTIONS} && \
# Remove JDK
rm -r /tmp/jdk-*
ENV PATH="${JRE_DIR}/bin:${PATH}"
Image build and test
docker build -t myjre .
docker run --rm -ti myjre
# in container
java --version