graalvm-docker/Dockerfile.distroless at master · SoftInstigate/graalvm-docker · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
# Distroless GraalVM Docker Image
# No shell, no package manager, no login capability
# Multi-arch: linux/amd64, linux/arm64
# Maximum security - only runtime dependencies
# Expected size: ~285MB

FROM debian:stable-slim AS downloader

ARG GRAALVM_VERSION=25.0.2
ARG TARGETARCH

WORKDIR /tmp

# Map Docker's TARGETARCH to GraalVM's architecture naming
RUN case "${TARGETARCH}" in \
      amd64) echo "linux-x64" > /tmp/graalvm_arch ;; \
      arm64) echo "linux-aarch64" > /tmp/graalvm_arch ;; \
      *) echo "Unsupported architecture: ${TARGETARCH}" && exit 1 ;; \
    esac

RUN apt-get update \
  && apt-get install -y --no-install-recommends \
    ca-certificates \
    curl \
  && rm -rf /var/lib/apt/lists/*

# Download and extract GraalVM directly
RUN GRAALVM_ARCH=$(cat /tmp/graalvm_arch) \
  && curl -fsSL "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-${GRAALVM_VERSION}/graalvm-community-jdk-${GRAALVM_VERSION}_${GRAALVM_ARCH}_bin.tar.gz" \
    -o graalvm.tar.gz \
  && mkdir -p /opt/graalvm \
  && tar -xzf graalvm.tar.gz -C /opt/graalvm --strip-components=1 \
  && rm graalvm.tar.gz

# Aggressive cleanup - remove everything not needed for runtime
# Remove GUI libraries since RESTHeart is a server application
RUN cd /opt/graalvm \
  && rm -rf \
    lib/src.zip \
    lib/visualvm \
    lib/static \
    lib/svm \
    jmods \
    man \
    demo \
    sample \
    include \
  && cd lib \
  && rm -rf \
    libjavafx*.so \
    libprism*.so \
    libglass*.so \
    libfx*.so \
    libjfx*.so \
    libgstreamer*.so \
    libsplashscreen.so \
    libnative-image*.so \
    ct.sym \
    2>/dev/null || true \
  && cd /opt/graalvm \
  && find . -name "*.diz" -delete \
  && find . -name "*.debuginfo" -delete 2>/dev/null || true

# Build minimal runtime deps layer
FROM debian:stable-slim AS runtime-deps

ARG TARGETARCH

RUN apt-get update \
  && apt-get install -y --no-install-recommends \
    zlib1g \
  && rm -rf /var/lib/apt/lists/*

# Copy libs to a common location based on architecture
RUN mkdir -p /staging/lib && \
    case "${TARGETARCH}" in \
      amd64) cp -P /lib/x86_64-linux-gnu/libz.so* /staging/lib/ || \
             cp -P /usr/lib/x86_64-linux-gnu/libz.so* /staging/lib/ ;; \
      arm64) cp -P /lib/aarch64-linux-gnu/libz.so* /staging/lib/ || \
             cp -P /usr/lib/aarch64-linux-gnu/libz.so* /staging/lib/ ;; \
    esac

# Use Google's distroless base - no shell, no package manager
FROM gcr.io/distroless/base-debian12:nonroot

LABEL maintainer="SoftInstigate <info@softinstigate.com>"
LABEL description="Distroless GraalVM image with no shell - maximum security"
LABEL org.opencontainers.image.source="https://github.com/SoftInstigate/graalvm-docker"

# Copy required runtime libraries
COPY --from=runtime-deps /staging/lib/* /lib/

# Copy only the JVM from builder
COPY --from=downloader /opt/graalvm /opt/graalvm

# Copy CA certificates for HTTPS
COPY --from=downloader /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/

ENV JAVA_HOME=/opt/graalvm
ENV PATH=/opt/graalvm/bin
ENV LANG=en_US.UTF-8
ENV JAVA_OPTS="-Djava.awt.headless=true"

WORKDIR /opt/app

# No shell available - direct Java execution only
ENTRYPOINT ["/opt/graalvm/bin/java"]