ubi8-openjdk-11 S2I Image not working with Quarkus in Openshift

[zg-riband]

• Given a repo with a basic untouched Quarkus app got from code.quarkus.io and committed for an example here:

https://github.com/zg-riband/testubi8jdk11s2iquarkus

(I added only .s2i directory with environment file)

• When I create a new app from oc CLI with ubi8/openjdk-11 image like this:

oc import-image ubi8-openjdk-11 --from=registry.access.redhat.com/ubi8/openjdk-11 --confirm
oc new-app ubi8-openjdk-11 https://github.com/zg-riband/testubi8jdk11s2iquarkus.git --name=ubi8-openjdk-11-app

• Than I got this error:
  INFO Performing Maven build in /tmp/src
  INFO Using MAVEN_OPTS -Xms32m -Xmx128m -XX:+UseParallelGC -XX:MinHeapFreeRatio=10 -XX:MaxHeapFreeRatio=20 -XX:GCTimeRatio=4 -XX:AdaptiveSizePolicyWeight=90 -XX:+ExitOnOutOfMemoryError
  ls: cannot access '/usr/bin/mvn': Operation not permitted
  Error: Could not find or load main class org.codehaus.plexus.classworlds.launcher.Launcher
  Caused by: java.lang.ClassNotFoundException: org.codehaus.plexus.classworlds.launcher.Launcher
  INFO Using
  INFO Running 'mvn -e -Popenshift -DskipTests -Dcom.redhat.xpaas.repo.redhatga -Dfabric8.skip=true -Djkube.skip=true --batch-mode -Djava.net.preferIPv4Stack=true -s /tmp/artifacts/configuration/settings.xml -Dmaven.repo.local=/tmp/artifacts/m2 package'
  ls: cannot access '/usr/bin/mvn': Operation not permitted
  Error: Could not find or load main class org.codehaus.plexus.classworlds.launcher.Launcher
  Caused by: java.lang.ClassNotFoundException: org.codehaus.plexus.classworlds.launcher.Launcher
  error: build error: non-zero (13) exit code from registry.access.redhat.com/ubi8/openjdk-11@sha256:e851770fd181ef49193111f7afcdbf872ad23f3a8234e0e07a742c4ca2882c3d

• But when I create a new app from oc CLI with openjdk/openjdk-11-rhel7 image like this:

oc import-image openjdk-openjdk-11-rhel7 --from=registry.access.redhat.com/openjdk/openjdk-11-rhel7 --confirm
oc new-app openjdk-11-rhel7 https://github.com/zg-riband/testubi8jdk11s2iquarkus.git --name=openjdk-openjdk-11-rhel7-app

• everything is ok and the app is created succesfully.

• The problem also occurs with ubi8-openjdk-17, which is the real reason why I write, since there is no openjdk17rhel8 yet and I intend to use my quarkus app with java 17.

Waiting for your kind reply, thank you.

[jmtd]

Can you confirm please the exact image versions that you have experienced this problem with (for example, registry.access.redhat.com/ubi8/openjdk-11:1.11-1 ?) and the OpenShift version you are running them on? My hunch is this is a permissions issue relating to the host, perhaps something to do with seccomp filters or selinux labels.

[zg-riband]

I tried today (unsuccessfully) with: registry.access.redhat.com/ubi8/openjdk-11:1.11-2

The server versions are:
OpenShift Master: v3.9.102
Kubernetes Master: v1.9.1+a0ce1bc657
OpenShift Web Console: v3.9.102

Thnx

[jerboaa]

You seem to be using an out-of-support version of OpenShift. The only still active version of the 3.x line is 3.11. See https://access.redhat.com/support/policy/updates/openshift_noncurrent

Can you reproduce this with a supported OpenShift version?

[zg-riband]

I tried with the following:

OpenShift Master:
v3.11.154
Kubernetes Master:
v1.11.0+d4cacc0
OpenShift Web Console:
v3.11.154
oc CLI
v3.11.633

Quarkus
2.7.1.Final

Ubi8 image
registry.access.redhat.com/ubi8/openjdk-11:1.11-2

Same results.

[mbonadonna]

Hi there, did you find a solution? I'm facing the same issue.

[sferich888]

carlossg/docker-maven#221 points to docker-library/openjdk#465 (comment) which points to this being a docker/podman (runc / security rules issue). However I can't see / trace down how that analysis was done or what actual issue these systems have that lead to this.

[jmtd]

I'm not entirely sure but if this is the same/similar issue to those reported at docker-maven and docker-library/openjdk (which are completely separate and unrelated images to here, fwiw), this could be to do with seccomp filters and a discrepancy between the calls used by the images and those in the filter policy on the host.

OpenShift 3.11's End of Maintenance Schedule is June, 2022, or just under two weeks time. After that point (unless something changes) we are likely to make changes to these images which are incompatible with running on OCP 3.11. I would strongly recommend migrating to OCP 4.

[zg-riband]

Hi there, did you find a solution? I'm facing the same issue.

No..