Skip to content

Commit c24b14c

Browse files
adamretteradamretter
committed
[feature] Switch from Google Cloud Platform distroless Docker base image to Chainguard distroless base image. We now have latest JDK 17 and nonroot user operation
1 parent be263d6 commit c24b14c

File tree

4 files changed

+72
-122
lines changed

4 files changed

+72
-122
lines changed

‎exist-docker/pom.xml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,10 @@
107107
<header>${project.parent.relativePath}/../elemental-parent/elemental-LGPL-21-ONLY-license.template.txt</header>
108108
<excludes>
109109
<exclude>pom.xml</exclude>
110-
<exclude>src/**</exclude>
110+
<exclude>src/assembly/**</exclude>
111+
<exclude>src/main/xslt/**</exclude>
112+
<exclude>src/test/**</exclude>
113+
<exclude>**.md</exclude>
111114
</excludes>
112115
</licenseSet>
113116

@@ -126,11 +129,7 @@
126129
</multi>
127130
<includes>
128131
<include>pom.xml</include>
129-
<include>src/main/resources-filtered/**</include>
130132
</includes>
131-
<excludes>
132-
<exclude>**.md</exclude>
133-
</excludes>
134133
</licenseSet>
135134

136135
<licenseSet>

‎exist-docker/src/main/resources-filtered/Dockerfile‎

Lines changed: 46 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -18,59 +18,53 @@
1818
# License along with this library; if not, write to the Free Software
1919
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
2020
#
21-
# NOTE: Parts of this file contain code from 'The eXist-db Authors'.
22-
# The original license header is included below.
23-
#
24-
# =====================================================================
25-
#
26-
# eXist-db Open Source Native XML Database
27-
# Copyright (C) 2001 The eXist-db Authors
28-
#
29-
# [email protected]
30-
# http://www.exist-db.org
31-
#
32-
# This library is free software; you can redistribute it and/or
33-
# modify it under the terms of the GNU Lesser General Public
34-
# License as published by the Free Software Foundation; either
35-
# version 2.1 of the License, or (at your option) any later version.
36-
#
37-
# This library is distributed in the hope that it will be useful,
38-
# but WITHOUT ANY WARRANTY; without even the implied warranty of
39-
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
40-
# Lesser General Public License for more details.
41-
#
42-
# You should have received a copy of the GNU Lesser General Public
43-
# License along with this library; if not, write to the Free Software
44-
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
45-
#
4621

47-
# Use Debian Bullseye (which is the base of gcr.io/distroless/java:17) for additional library dependencies that we need
48-
# FROM debian:bullseye-slim as debian-slim
49-
# RUN apt-get update && apt-get -y dist-upgrade
50-
# RUN apt-get install -y openjdk-17-jre-headless
51-
# RUN apt-get install -y expat fontconfig # Install tools required by FOP
22+
# Install latest JRE 17 in Chainguard Wolfi temporary builder image
23+
FROM cgr.dev/chainguard/wolfi-base AS builder
24+
25+
RUN apk update && apk upgrade
26+
# Install dependencies needed for JRE
27+
RUN apk add zlib libjpeg-turbo libpng lcms2 freetype ttf-dejavu fontconfig-config libfontconfig1 expat libuuid libbrotlicommon1 libbrotlidec1 libbrotlienc1 libcrypt1
28+
# Install latest JRE
29+
RUN apk add openjdk-17-jre
5230

53-
FROM gcr.io/distroless/java17:latest
31+
# Use Chainguard distroless glibc base for dynamically linked libraries
32+
FROM cgr.dev/chainguard/glibc-dynamic:latest
5433

55-
# Copy over dependencies for Apache FOP, missing from GCR's JRE
56-
# COPY --from=debian-slim /usr/lib/x86_64-linux-gnu/libfreetype.so.6 /usr/lib/x86_64-linux-gnu/libfreetype.so.6
57-
# COPY --from=debian-slim /usr/lib/x86_64-linux-gnu/liblcms2.so.2 /usr/lib/x86_64-linux-gnu/liblcms2.so.2
58-
# COPY --from=debian-slim /usr/lib/x86_64-linux-gnu/libpng16.so.16 /usr/lib/x86_64-linux-gnu/libpng16.so.16
59-
# COPY --from=debian-slim /usr/lib/x86_64-linux-gnu/libfontconfig.so.1 /usr/lib/x86_64-linux-gnu/libfontconfig.so.1
34+
# Copy over dependencies for updated JRE from Wolfi
35+
COPY --from=builder /etc/ca-certificates /etc/ca-certificates
36+
COPY --from=builder /etc/ca-certificates.conf /etc/ca-certificates.conf
37+
COPY --from=builder /lib/libz.so.1 /lib/libz.so.1
38+
COPY --from=builder /usr/lib/libjpeg.so.8 /usr/lib/libjpeg.so.8
39+
COPY --from=builder /usr/lib/libturbojpeg.so.0 /usr/lib/libturbojpeg.so.0
40+
COPY --from=builder /usr/lib/libpng16.so.16 /usr/lib/libpng16.so.16
41+
COPY --from=builder /usr/lib/liblcms2.so.2 /usr/lib/liblcms2.so.2
42+
COPY --from=builder /usr/lib/libfreetype.so.6 /usr/lib/libfreetype.so.6
43+
COPY --from=builder /usr/share/fonts /usr/share/fonts
44+
COPY --from=builder /etc/fonts /etc/fonts
45+
COPY --from=builder /usr/share/fontconfig /usr/share/fontconfig
46+
COPY --from=builder /usr/share/gettext /usr/share/gettext
47+
COPY --from=builder /usr/share/xml /usr/share/xml
48+
COPY --from=builder /usr/lib/libfontconfig.so.1 /usr/lib/libfontconfig.so.1
49+
COPY --from=builder /usr/lib/libexpat.so.1 /usr/lib/libexpat.so.1
50+
COPY --from=builder /usr/lib/libuuid.so.1 /usr/lib/libuuid.so.1
51+
COPY --from=builder /usr/lib/libbrotlicommon.so.1 /usr/lib/libbrotlicommon.so.1
52+
COPY --from=builder /usr/lib/libbrotlidec.so.1 /usr/lib/libbrotlidec.so.1
53+
COPY --from=builder /usr/lib/libbrotlienc.so.1 /usr/lib/libbrotlienc.so.1
6054

61-
# Copy dependencies for Apache Batik (used by Apache FOP to handle SVG rendering)
62-
# COPY --from=debian-slim /etc/fonts /etc/fonts
63-
# COPY --from=debian-slim /lib/x86_64-linux-gnu/libexpat.so.1 /lib/x86_64-linux-gnu/libexpat.so.1
64-
# COPY --from=debian-slim /usr/share/fontconfig /usr/share/fontconfig
65-
# COPY --from=debian-slim /usr/share/fonts/truetype/dejavu /usr/share/fonts/truetype/dejavu
55+
# Copy over updated JRE from Wolfi
56+
COPY --from=builder /usr/lib/jvm/java-17-openjdk /usr/lib/jvm/java-17-openjdk
57+
58+
# Switch to nonroot user
59+
USER nonroot
6660

6761
# Copy Elemental
6862
COPY LICENSE /elemental/LICENSE
6963
COPY autodeploy /elemental/autodeploy
7064
COPY etc /elemental/etc
7165
COPY lib /elemental/lib
72-
COPY logs /elemental/logs
73-
66+
COPY --chown=nonroot logs /elemental/logs
67+
COPY --chown=nonroot logs /elemental/data
7468

7569
# Build-time metadata as defined at http://label-schema.org
7670
# and used by autobuilder @hooks/build
@@ -90,27 +84,15 @@ ARG CACHE_MEM
9084
ARG MAX_BROKER
9185
ARG JVM_MAX_RAM_PERCENTAGE
9286

93-
ENV ELEMENTAL_HOME "/elemental"
94-
ENV EXIST_HOME "/elemental"
95-
ENV CLASSPATH=/elemental/lib/${elemental.uber.jar.filename}
96-
97-
ENV JAVA_TOOL_OPTIONS \
98-
-Dfile.encoding=UTF8 \
99-
-Dsun.jnu.encoding=UTF-8 \
100-
-Djava.awt.headless=true \
101-
-Dorg.exist.db-connection.cacheSize=${CACHE_MEM:-256}M \
102-
-Dorg.exist.db-connection.pool.max=${MAX_BROKER:-20} \
103-
-Dlog4j.configurationFile=/elemental/etc/log4j2.xml \
104-
-Dexist.home=/elemental \
105-
-Dexist.configurationFile=/elemental/etc/conf.xml \
106-
-Djetty.home=/elemental \
107-
-Dexist.jetty.config=/elemental/etc/jetty/standard.enabled-jetty-configs \
108-
-XX:+UseNUMA \
109-
-XX:+UseZGC \
110-
-XX:+UseStringDeduplication \
111-
-XX:+UseContainerSupport \
112-
-XX:MaxRAMPercentage=${JVM_MAX_RAM_PERCENTAGE:-75.0} \
113-
-XX:+ExitOnOutOfMemoryError
87+
ENV ELEMENTAL_HOME="/elemental"
88+
ENV EXIST_HOME="/elemental"
89+
ENV CLASSPATH="/elemental/lib/${elemental.uber.jar.filename}"
90+
91+
ENV JAVA_HOME="/usr/lib/jvm/java-17-openjdk"
92+
93+
ENV JAVA_TOOL_OPTIONS="-Dfile.encoding=UTF8 -Dsun.jnu.encoding=UTF-8 -Djava.awt.headless=true -Dorg.exist.db-connection.cacheSize=${CACHE_MEM:-256}M -Dorg.exist.db-connection.pool.max=${MAX_BROKER:-20} -Dlog4j.configurationFile=/elemental/etc/log4j2.xml -Dexist.home=/elemental -Dexist.configurationFile=/elemental/etc/conf.xml -Djetty.home=/elemental -Dexist.jetty.config=/elemental/etc/jetty/standard.enabled-jetty-configs -XX:+UseNUMA -XX:+UseZGC -XX:+UseContainerSupport -XX:MaxRAMPercentage=${JVM_MAX_RAM_PERCENTAGE:-75.0} -XX:+ExitOnOutOfMemoryError"
94+
95+
ENV PATH="/usr/lib/jvm/java-17-openjdk/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
11496

11597
HEALTHCHECK CMD [ "java", \
11698
"org.exist.start.Main", "client", \

‎exist-docker/src/main/resources-filtered/Dockerfile-DEBUG‎

Lines changed: 21 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -18,44 +18,26 @@
1818
# License along with this library; if not, write to the Free Software
1919
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
2020
#
21-
# NOTE: Parts of this file contain code from 'The eXist-db Authors'.
22-
# The original license header is included below.
23-
#
24-
# =====================================================================
25-
#
26-
# eXist-db Open Source Native XML Database
27-
# Copyright (C) 2001 The eXist-db Authors
28-
#
29-
# [email protected]
30-
# http://www.exist-db.org
31-
#
32-
# This library is free software; you can redistribute it and/or
33-
# modify it under the terms of the GNU Lesser General Public
34-
# License as published by the Free Software Foundation; either
35-
# version 2.1 of the License, or (at your option) any later version.
36-
#
37-
# This library is distributed in the hope that it will be useful,
38-
# but WITHOUT ANY WARRANTY; without even the implied warranty of
39-
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
40-
# Lesser General Public License for more details.
41-
#
42-
# You should have received a copy of the GNU Lesser General Public
43-
# License along with this library; if not, write to the Free Software
44-
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
45-
#
4621

47-
# Use JDK 17 in Debian Bullseye (as our production image gcr.io/distroless/java:17 is based on Debian Bullseye with just a JRE)
48-
FROM debian:bullseye-slim
49-
RUN apt-get update && apt-get -y dist-upgrade
50-
RUN apt-get install -y openjdk-17-jdk-headless
51-
RUN apt-get install -y expat fontconfig # Install tools required by FOP
22+
# Use Chainguard Wolfi
23+
FROM cgr.dev/chainguard/wolfi-base
24+
25+
RUN apk update && apk upgrade
26+
# Install dependencies needed for JDK
27+
RUN apk add zlib libjpeg-turbo libpng lcms2 freetype ttf-dejavu fontconfig-config libfontconfig1 expat libuuid libbrotlicommon1 libbrotlidec1 libbrotlienc1 libcrypt1
28+
# Install latest JDK
29+
RUN apk add openjdk-17
30+
31+
# Switch to nonroot user
32+
USER nonroot
5233

5334
# Copy Elemental
5435
COPY LICENSE /elemental/LICENSE
5536
COPY autodeploy /elemental/autodeploy
5637
COPY etc /elemental/etc
5738
COPY lib /elemental/lib
58-
COPY logs /elemental/logs
39+
COPY --chown=nonroot logs /elemental/logs
40+
COPY --chown=nonroot logs /elemental/data
5941

6042
# Build-time metadata as defined at http://label-schema.org
6143
# and used by autobuilder @hooks/build
@@ -76,28 +58,15 @@ ARG MAX_BROKER
7658
ARG JVM_MAX_RAM_PERCENTAGE
7759
ARG JVM_JDWP_SUSPEND
7860

79-
ENV ELEMENTAL_HOME "/elemental"
80-
ENV EXIST_HOME "/elemental"
81-
ENV CLASSPATH=/elemental/lib/${elemental.uber.jar.filename}
61+
ENV ELEMENTAL_HOME="/elemental"
62+
ENV EXIST_HOME="/elemental"
63+
ENV CLASSPATH="/elemental/lib/${elemental.uber.jar.filename}"
64+
65+
ENV JAVA_HOME="/usr/lib/jvm/java-17-openjdk"
66+
67+
ENV JAVA_TOOL_OPTIONS="-Dfile.encoding=UTF8 -Dsun.jnu.encoding=UTF-8 -Djava.awt.headless=true -Dorg.exist.db-connection.cacheSize=${CACHE_MEM:-256}M -Dorg.exist.db-connection.pool.max=${MAX_BROKER:-20} -Dlog4j.configurationFile=/elemental/etc/log4j2.xml -Dexist.home=/elemental -Dexist.configurationFile=/elemental/etc/conf.xml -Djetty.home=/elemental -Dexist.jetty.config=/elemental/etc/jetty/standard.enabled-jetty-configs -XX:+UseNUMA -XX:+UseZGC -XX:+UseContainerSupport -XX:MaxRAMPercentage=${JVM_MAX_RAM_PERCENTAGE:-75.0} -XX:+ExitOnOutOfMemoryError -agentlib:jdwp=transport=dt_socket,server=y,suspend=${JVM_JDWP_SUSPEND:-n},address=5005"
8268

83-
ENV JAVA_TOOL_OPTIONS \
84-
-Dfile.encoding=UTF8 \
85-
-Dsun.jnu.encoding=UTF-8 \
86-
-Djava.awt.headless=true \
87-
-Dorg.exist.db-connection.cacheSize=${CACHE_MEM:-256}M \
88-
-Dorg.exist.db-connection.pool.max=${MAX_BROKER:-20} \
89-
-Dlog4j.configurationFile=/elemental/etc/log4j2.xml \
90-
-Dexist.home=/elemental \
91-
-Dexist.configurationFile=/elemental/etc/conf.xml \
92-
-Djetty.home=/elemental \
93-
-Dexist.jetty.config=/elemental/etc/jetty/standard.enabled-jetty-configs \
94-
-XX:+UseNUMA \
95-
-XX:+UseZGC \
96-
-XX:+UseStringDeduplication \
97-
-XX:+UseContainerSupport \
98-
-XX:MaxRAMPercentage=${JVM_MAX_RAM_PERCENTAGE:-75.0} \
99-
-XX:+ExitOnOutOfMemoryError \
100-
-agentlib:jdwp=transport=dt_socket,server=y,suspend=${JVM_JDWP_SUSPEND:-n},address=5005
69+
ENV PATH="/usr/lib/jvm/java-17-openjdk/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
10170

10271
HEALTHCHECK CMD [ "java", \
10372
"org.exist.start.Main", "client", \

‎exist-docker/src/main/resources-filtered/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ ${project.description}
55

66
This module holds the source files for building a minimal docker image of the [Elemental](https://www.elemental.xyz)
77
NoSQL Database. Images are automatically updated as part of the build-test life-cycle.
8-
These images are based on Google Cloud Platform's ["Distroless" Docker Images](https://github.com/GoogleCloudPlatform/distroless).
8+
These images are based on Chainguard's ["Distroless" Docker Images](https://edu.chainguard.dev/chainguard/chainguard-images/about/getting-started-distroless/).
99

1010

1111
## Requirements

0 commit comments

Comments
 (0)