Updates docker images to latest Java on Alpine 3.23.3 (#131)

codefromthecrypt · web-flow · commit 6b251ab7ec73 · 2026-03-22T12:35:54.000-04:00
Signed-off-by: Adrian Cole &lt;adrian@tetrate.io&gt;
diff --git a/.dockerignore b/.dockerignore
@@ -9,20 +9,32 @@
 !build-bin/docker/docker-healthcheck
 
 # Allow on-demand "mvn package".
+!armeria/src/main
 !armeria/src/main/**
+!armeria-kafka/src/main
 !armeria-kafka/src/main/**
+!jersey2-cassandra3/src/main
 !jersey2-cassandra3/src/main/**
+!netty4-grpc/src/main
 !netty4-grpc/src/main/**
+!webflux5-sleuth/src/main
 !webflux5-sleuth/src/main/**
+!webflux6-micrometer/src/main
 !webflux6-micrometer/src/main/**
+!webmvc3-jetty/src/main
 !webmvc3-jetty/src/main/**
+!webmvc4-boot/src/main
 !webmvc4-boot/src/main/**
+!webmvc4-jetty/src/main
 !webmvc4-jetty/src/main/**
+!webmvc5-sleuth/src/main
 !webmvc5-sleuth/src/main/**
+!webmvc25-jetty/src/main
 !webmvc25-jetty/src/main/**
 !**/pom.xml
 !/parent-pom.xml
 
 # We cannot share paths outside the current directory with the Docker context
 # (ex via symlinks). So, build-bin/configure_* overrides maven.repo.local
 !/m2repository
+!/m2repository/**
diff --git a/.github/deploy-template.yml b/.github/deploy-template.yml
@@ -6,7 +6,8 @@ on:
   # We deploy non-tagged pushes to master relevant for this project. We can't opt out of
   # documentation-only commits because GH actions does not permit paths and paths-ignore.
   push:
-    tags: ''
+    tags-ignore:
+      - '*'
     branches: master
     paths:
       - "build-bin/**"
diff --git a/.github/workflows/deploy-armeria-kafka.yml b/.github/workflows/deploy-armeria-kafka.yml
@@ -6,7 +6,8 @@ on:
   # We deploy non-tagged pushes to master relevant for this project. We can't opt out of
   # documentation-only commits because GH actions does not permit paths and paths-ignore.
   push:
-    tags: ''
+    tags-ignore:
+      - '*'
     branches: master
     paths:
       - "build-bin/**"
diff --git a/.github/workflows/deploy-armeria.yml b/.github/workflows/deploy-armeria.yml
@@ -6,7 +6,8 @@ on:
   # We deploy non-tagged pushes to master relevant for this project. We can't opt out of
   # documentation-only commits because GH actions does not permit paths and paths-ignore.
   push:
-    tags: ''
+    tags-ignore:
+      - '*'
     branches: master
     paths:
       - "build-bin/**"
diff --git a/.github/workflows/deploy-jersey2-cassandra3.yml b/.github/workflows/deploy-jersey2-cassandra3.yml
@@ -6,7 +6,8 @@ on:
   # We deploy non-tagged pushes to master relevant for this project. We can't opt out of
   # documentation-only commits because GH actions does not permit paths and paths-ignore.
   push:
-    tags: ''
+    tags-ignore:
+      - '*'
     branches: master
     paths:
       - "build-bin/**"
diff --git a/.github/workflows/deploy-netty4-grpc.yml b/.github/workflows/deploy-netty4-grpc.yml
@@ -6,7 +6,8 @@ on:
   # We deploy non-tagged pushes to master relevant for this project. We can't opt out of
   # documentation-only commits because GH actions does not permit paths and paths-ignore.
   push:
-    tags: ''
+    tags-ignore:
+      - '*'
     branches: master
     paths:
       - "build-bin/**"
diff --git a/.github/workflows/deploy-webflux5-sleuth.yml b/.github/workflows/deploy-webflux5-sleuth.yml
@@ -6,7 +6,8 @@ on:
   # We deploy non-tagged pushes to master relevant for this project. We can't opt out of
   # documentation-only commits because GH actions does not permit paths and paths-ignore.
   push:
-    tags: ''
+    tags-ignore:
+      - '*'
     branches: master
     paths:
       - "build-bin/**"
diff --git a/.github/workflows/deploy-webflux6-micrometer.yml b/.github/workflows/deploy-webflux6-micrometer.yml
@@ -6,7 +6,8 @@ on:
   # We deploy non-tagged pushes to master relevant for this project. We can't opt out of
   # documentation-only commits because GH actions does not permit paths and paths-ignore.
   push:
-    tags: ''
+    tags-ignore:
+      - '*'
     branches: master
     paths:
       - "build-bin/**"
diff --git a/.github/workflows/deploy-webmvc25-jetty.yml b/.github/workflows/deploy-webmvc25-jetty.yml
@@ -6,7 +6,8 @@ on:
   # We deploy non-tagged pushes to master relevant for this project. We can't opt out of
   # documentation-only commits because GH actions does not permit paths and paths-ignore.
   push:
-    tags: ''
+    tags-ignore:
+      - '*'
     branches: master
     paths:
       - "build-bin/**"
diff --git a/.github/workflows/deploy-webmvc3-jetty.yml b/.github/workflows/deploy-webmvc3-jetty.yml
@@ -6,7 +6,8 @@ on:
   # We deploy non-tagged pushes to master relevant for this project. We can't opt out of
   # documentation-only commits because GH actions does not permit paths and paths-ignore.
   push:
-    tags: ''
+    tags-ignore:
+      - '*'
     branches: master
     paths:
       - "build-bin/**"
diff --git a/.github/workflows/deploy-webmvc4-boot.yml b/.github/workflows/deploy-webmvc4-boot.yml
@@ -6,7 +6,8 @@ on:
   # We deploy non-tagged pushes to master relevant for this project. We can't opt out of
   # documentation-only commits because GH actions does not permit paths and paths-ignore.
   push:
-    tags: ''
+    tags-ignore:
+      - '*'
     branches: master
     paths:
       - "build-bin/**"
diff --git a/.github/workflows/deploy-webmvc4-jetty.yml b/.github/workflows/deploy-webmvc4-jetty.yml
@@ -6,7 +6,8 @@ on:
   # We deploy non-tagged pushes to master relevant for this project. We can't opt out of
   # documentation-only commits because GH actions does not permit paths and paths-ignore.
   push:
-    tags: ''
+    tags-ignore:
+      - '*'
     branches: master
     paths:
       - "build-bin/**"
diff --git a/.gitignore b/.gitignore
@@ -9,4 +9,5 @@ zipkin.jar
 
 # We cannot share paths outside the current directory with the Docker context
 # (ex via symlinks). So, build-bin/configure_* overrides maven.repo.local
-m2repository/
+/m2repository/*
+!/m2repository/.gitkeep
diff --git a/.mvn/wrapper/maven-wrapper.jar b/.mvn/wrapper/maven-wrapper.jar
diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties
@@ -1,20 +1,4 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-wrapperVersion=3.3.2
+wrapperVersion=3.3.4
 distributionType=bin
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.9/apache-maven-3.9.9-bin.zip
-wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.14/apache-maven-3.9.14-bin.zip
+wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar
diff --git a/build-bin/docker-compose-eureka.test.yml b/build-bin/docker-compose-eureka.test.yml
@@ -1,6 +1,3 @@
-# permit depends_on/condition: service_healthy
-version: '2.4'
-
 # This configures examples so that they use Eureka to discover the Zipkin
 # endpoint.
 services:
diff --git a/build-bin/docker-compose-kafka.test.yml b/build-bin/docker-compose-kafka.test.yml
@@ -1,6 +1,3 @@
-# permit depends_on/condition: service_healthy
-version: '2.4'
-
 # This configures examples so that they use Kafka to communicate.
 services:
   sut:
diff --git a/build-bin/docker-compose.base.yml b/build-bin/docker-compose.base.yml
@@ -1,6 +1,3 @@
-# permit depends_on/condition: service_healthy
-version: "2.4"
-
 # This is a base configuration *without depends-on* because docker-compose
 # officially doesn't support extending with depends-on even if some tools
 # allow it. See https://github.com/docker/compose/issues/7916
diff --git a/build-bin/docker-compose.test.yml b/build-bin/docker-compose.test.yml
@@ -1,6 +1,3 @@
-# permit depends_on/condition: service_healthy
-version: '2.4'
-
 services:
   sut:
     extends:
diff --git a/build-bin/docker/configure_docker_push b/build-bin/docker/configure_docker_push
@@ -12,13 +12,6 @@
 
 set -ue
 
-# Verify we are on an arch that can publish multi-arch images
-arch=$($(dirname "$0")/docker_arch)
-if [ "${arch}" != "amd64" ]; then
-  >&2 echo "multiarch/qemu-user-static doesn't support arch ${arch}"
-  exit 1
-fi
-
 # Enable experimental features on the server (multi-arch)
 echo '{ "experimental":true, "registry-mirrors": ["https://mirror.gcr.io"] }' | sudo tee /etc/docker/daemon.json
 
@@ -38,11 +31,9 @@ if [ -n "${DOCKERHUB_USER:-}" ]; then
 fi
 
 # Enable execution of different multi-architecture containers by QEMU and binfmt_misc
-# See https://github.com/multiarch/qemu-user-static
+# See https://github.com/tonistiigi/binfmt
 #
 # Mirrored image use to avoid docker.io pulls:
-# docker tag multiarch/qemu-user-static:7.2.0-1 ghcr.io/openzipkin/multiarch-qemu-user-static:latest
+# docker buildx imagetools create --tag ghcr.io/openzipkin/tonistiigi-binfmt-qemu:latest tonistiigi/binfmt:qemu-v10.2.1-65
 #
-# Note: This image only works on x86_64/amd64 architecture.
-# See: https://github.com/multiarch/qemu-user-static#supported-host-architectures
-docker run --rm --privileged ghcr.io/openzipkin/multiarch-qemu-user-static --reset -p yes
+docker run --privileged --rm ghcr.io/openzipkin/tonistiigi-binfmt-qemu --install all
diff --git a/build-bin/docker/docker_args b/build-bin/docker/docker_args
@@ -36,30 +36,26 @@ if [ -n "${DOCKER_TARGET}" ]; then
   docker_args="${docker_args} --target ${DOCKER_TARGET}"
 fi
 
-# When non-empty, becomes the layer that builds the maven projects.
-# e.g. ghcr.io/openzipkin/java:11.0.26_p4
+# When non-empty, becomes the base layer including tag appropriate for the image being built.
+# e.g. ghcr.io/openzipkin/java:21.0.10_p7-jre
 #
-# This must include maven and a full JDK.
+# This is not required to be a base (FROM scratch) image like ghcr.io/openzipkin/alpine:3.12.3
+# See https://docs.docker.com/glossary/#parent-image
 if [ -n "${DOCKER_BUILD_IMAGE}" ]; then
   docker_args="${docker_args} --build-arg docker_build_image=${DOCKER_BUILD_IMAGE}"
 fi
 
-# When non-empty, becomes the base layer including tag appropriate for the image being built.
-# e.g. ghcr.io/openzipkin/java:21.0.6_p7-jre
-#
-# This is not required to be a base (FROM scratch) image like ghcr.io/openzipkin/alpine:3.21.2
-# See https://docs.docker.com/glossary/#parent-image
 if [ -n "${DOCKER_PARENT_IMAGE}" ]; then
   docker_args="${docker_args} --build-arg docker_parent_image=${DOCKER_PARENT_IMAGE}"
 fi
 
-# When non-empty, becomes the build-arg alpine_version. e.g. "3.12.3"
+# When non-empty, becomes the build-arg alpine_version. e.g. "3.23.3"
 # Used to align base layers from https://github.com/orgs/openzipkin/packages/container/package/alpine
 if [ -n "${ALPINE_VERSION}" ]; then
   docker_args="${docker_args} --build-arg alpine_version=${ALPINE_VERSION}"
 fi
 
-# When non-empty, becomes the build-arg java_version. e.g. "21.0.6_p7"
+# When non-empty, becomes the build-arg java_version. e.g. "21.0.10_p7"
 # Used to align base layers from https://github.com/orgs/openzipkin/packages/container/package/java
 if [ -n "${JAVA_VERSION}" ]; then
   docker_args="${docker_args} --build-arg java_version=${JAVA_VERSION}"
diff --git a/build-bin/docker_args b/build-bin/docker_args
@@ -8,38 +8,43 @@ else
   exit 1
 fi
 
-JAVA_VERSION=${JAVA_VERSION:-21.0.6_p7}
+JAVA_VERSION=${JAVA_VERSION:-21.0.10_p7}
 # DOCKER_ARCHS to eventually push to the registry
 DOCKER_ARCHS="amd64 arm64"
 
 case "${JRE_VERSION}" in
   6 )
-    DOCKER_BUILD_IMAGE=ghcr.io/openzipkin/java:11.0.26_p4
+    DOCKER_BUILD_IMAGE=ghcr.io/openzipkin/java:11.0.30_p7
     DOCKER_PARENT_IMAGE=ghcr.io/openzipkin/java:1.6.0-119
     # single arch image
     DOCKER_ARCHS=amd64
     ;;
   7 )
-    DOCKER_BUILD_IMAGE=ghcr.io/openzipkin/java:11.0.26_p4
+    DOCKER_BUILD_IMAGE=ghcr.io/openzipkin/java:11.0.30_p7
     DOCKER_PARENT_IMAGE=ghcr.io/openzipkin/java:1.7.0_352
     # single arch image
     DOCKER_ARCHS=amd64
     ;;
   8 )
-    DOCKER_BUILD_IMAGE=ghcr.io/openzipkin/java:11.0.26_p4
-    DOCKER_PARENT_IMAGE=ghcr.io/openzipkin/java:8.442.06-jre
+    DOCKER_BUILD_IMAGE=ghcr.io/openzipkin/java:11.0.30_p7
+    DOCKER_PARENT_IMAGE=ghcr.io/openzipkin/java:8.472.08-jre
     ;;
   11 )
-    DOCKER_BUILD_IMAGE=ghcr.io/openzipkin/java:11.0.26_p4
-    DOCKER_PARENT_IMAGE=ghcr.io/openzipkin/java:11.0.26_p4-jre
+    DOCKER_BUILD_IMAGE=ghcr.io/openzipkin/java:11.0.30_p7
+    DOCKER_PARENT_IMAGE=ghcr.io/openzipkin/java:11.0.30_p7-jre
     ;;
   17 )
-    DOCKER_BUILD_IMAGE=ghcr.io/openzipkin/java:21.0.6_p7
-    DOCKER_PARENT_IMAGE=ghcr.io/openzipkin/java:17.0.9_p8-jre
+    DOCKER_BUILD_IMAGE=ghcr.io/openzipkin/java:21.0.10_p7
+    DOCKER_PARENT_IMAGE=ghcr.io/openzipkin/java:17.0.18_p8-jre
     ;;
   21 )
-    DOCKER_BUILD_IMAGE=ghcr.io/openzipkin/java:21.0.6_p7
-    DOCKER_PARENT_IMAGE=ghcr.io/openzipkin/java:21.0.6_p7-jre
+    DOCKER_BUILD_IMAGE=ghcr.io/openzipkin/java:21.0.10_p7
+    DOCKER_PARENT_IMAGE=ghcr.io/openzipkin/java:21.0.10_p7-jre
+    ;;
+  21-jdk )
+    # jersey2-cassandra3 needs jdk.httpserver not in the JRE
+    DOCKER_BUILD_IMAGE=ghcr.io/openzipkin/java:21.0.10_p7
+    DOCKER_PARENT_IMAGE=ghcr.io/openzipkin/java:21.0.10_p7
     ;;
   * )
     echo "Invalid JRE_VERSION: ${JRE_VERSION}"
diff --git a/build-bin/maven/maven_unjar b/build-bin/maven/maven_unjar
@@ -58,7 +58,7 @@ fi
 
 if ! test -f ${artifact_id}.jar && [ ${is_release} = "true" ]; then
   mvn_get="mvn -q --batch-mode -Denforcer.fail=false \
-  org.apache.maven.plugins:maven-dependency-plugin:3.8.1:get \
+  org.apache.maven.plugins:maven-dependency-plugin:3.10.0:get \
   -Dtransitive=false -DgroupId=${group_id} -DartifactId=${artifact_id} -Dversion=${version}"
 
   if [ -n "${classifier}" ]; then
diff --git a/docker/Dockerfile b/docker/Dockerfile
@@ -2,32 +2,29 @@
 # non-root users and such as they are not intended to run in production anyway.
 
 # The image binaries this example builds are installed over
-ARG docker_parent_image=ghcr.io/openzipkin/java:21.0.6_p7
+ARG docker_parent_image=ghcr.io/openzipkin/java:21.0.10_p7
 ## Use JDK 11 to build projects, as that can still compile Java 6
-ARG docker_build_image=ghcr.io/openzipkin/java:11.0.26_p4
+ARG docker_build_image=ghcr.io/openzipkin/java:11.0.30_p7
 
-# We copy files from the context into a scratch container first to avoid a problem where docker and
-# docker compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
-# COPY --from= works around the issue.
-FROM scratch as scratch
-
-COPY . /code/
-
-FROM $docker_build_image as install
+FROM $docker_build_image AS install
 
 WORKDIR /code
-COPY --from=scratch /code .
-
 # version of the project, matching /code/$version/pom.xml. ex armeria or netty4-grpc
 ARG version=armeria
+COPY ${version}/pom.xml ${version}/
+COPY ${version}/src/main/ ${version}/src/main/
+COPY parent-pom.xml m2repository/ ./
+COPY build-bin/maven/maven_build build-bin/maven/maven_opts build-bin/maven/maven_unjar build-bin/maven/
+COPY build-bin/docker/docker-healthcheck build-bin/docker/
+COPY docker/bin/* docker/bin/
 
 # Build the project. This results in:
 # * /install - the version home
 # * /install/bin - scripts that should be copied into the search path
 RUN \
 # If we've seeded m2repository, copy it into the repository of our install image.
 # This prevents uncacheable downloads that occur during Docker build.
-test -d /code/m2repository && export MAVEN_OPTS="-Dmaven.repo.local=/code/m2repository"; \
+test -d /code/m2repository/de && export MAVEN_OPTS="-Dmaven.repo.local=/code/m2repository"; \
 /code/docker/bin/install-example $version
 
 # Make the final layer that the example will run in
diff --git a/docker/bin/post-install-example-cassandra b/docker/bin/post-install-example-cassandra
diff --git a/jersey2-cassandra3/pom.xml b/jersey2-cassandra3/pom.xml
diff --git a/jersey2-cassandra3/src/main/java/org/apache/cassandra/utils/ObjectSizes.java b/jersey2-cassandra3/src/main/java/org/apache/cassandra/utils/ObjectSizes.java
diff --git a/m2repository/.gitkeep b/m2repository/.gitkeep
diff --git a/mvnw b/mvnw
diff --git a/mvnw.cmd b/mvnw.cmd
diff --git a/parent-pom.xml b/parent-pom.xml
diff --git a/webflux6-micrometer/pom.xml b/webflux6-micrometer/pom.xml
