alfresco / alfresco-docker-base-java

Alfresco base Java image

Alfresco Docker Base Java

This repository provides the base Docker images for Java LTS versions Centos 7, Rocky Linux 8/9 that are meant to be used within the Alfresco engineering to build Docker images for Java applications.

Flavours

Choose between one of the available flavours built from this repository:

Java version	Java flavour	OS	Image ref	Size
11	jre	Centos 7	alfresco/alfresco-base-java:jre11-centos7
17	jre	Rocky Linux 8	alfresco/alfresco-base-java:jre17-rockylinux8
11	jre	Rocky Linux 8	alfresco/alfresco-base-java:jre11-rockylinux8
17	jre	Rocky Linux 9	alfresco/alfresco-base-java:jre17-rockylinux9

The images are available on:

• Docker Hub, image name: alfresco/alfresco-base-java
• Quay (enterprise credentials required), image name: quay.io/alfresco/alfresco-base-java

Image pinning

To ensure the propagation of security fixes from upstream projects, all supported tags are mutable and undergo periodic rebuilding.

The suggested approach is to pin the sha256 digest for best reproducibility in your Dockerfile, for example:

FROM alfresco/alfresco-base-java:jre17-rockylinux9@sha256:b749868ceb42bd6f58ae2f143e8c16af4752fad7b40eb1085c014cbfcecb1ffc

To discover the latest image digest, just run docker pull <image-ref> and then run docker images --digests.

$ docker pull alfresco/alfresco-base-java:jre17-rockylinux9
489e1be6ce56: Already exists
66defdfd2e26: Download complete
41c3b80bc03b: Download complete
be4e433e73b5: Download complete
docker.io/alfresco/alfresco-base-java:jre17-rockylinux9

$ docker images --digests
REPOSITORY                    TAG                 DIGEST                                                                    IMAGE ID       CREATED          SIZE
alfresco/alfresco-base-java   jre17-rockylinux9   sha256:b749868ceb42bd6f58ae2f143e8c16af4752fad7b40eb1085c014cbfcecb1ffc   be4e433e73b5   14 minutes ago   410MB

This configuration approach is compatible with Dependabot.

Development

While any docker installation will produce valid images, building with BuildKit has proven being more efficient and clever with Multistage builds. If you are building images locally, we recommend enabling it.

Naming specs

The images built from this repository are named as follow:

<JAVA_DISTRIBUTION_TYPE><JAVA_MAJOR_VERSION>-<OS_DISTRIBUTION_NAME><OS_DISTRIBUTION_VERSION>

Build an image locally

To build a local version of the base java image follow the instructions below:

docker build -t alfresco-base-java . \
  --build-arg DISTRIB_NAME=$DISTRIB_NAME \
  --build-arg DISTRIB_MAJOR=$DISTRIB_MAJOR \
  --build-arg JAVA_MAJOR=$JAVA_MAJOR \
  --build-arg JDIST=$JDIST \
  --no-cache --target JAVA_BASE_IMAGE

Release

New images are built automatically on each new commit on master and on a weekly schedule.

Glossary

• What is a base image.

Downstream projects

Known projects currently using the base image:

• Alfresco Base Tomcat
• Alfresco ActiveMQ
• Alfresco Transform Core
• Alfresco Search Services
• Alfresco Connector for Hyland Experience Insight

alfresco-docker-base-java's Issues

Reduce image size by adding "yum clean all"

Noticed that just adding "yum clean all" to existing "yum -y update"

alfresco-docker-base-java/Dockerfile

Line 13 in f3de686

RUN yum -y update \

RUN yum -y update
nss-3.36.0-5.el7_5
bind-license-9.9.4-61.el7 \
curl-7.29.0-46.el7
systemd-219-57.el7
glibc-2.17-222.el7
openssl-libs-1.0.2k-12.el7
krb5-libs-1.15.1-19.el7
libgcc-4.8.5-28.el7_5.1
libstdc++-4.8.5-28.el7_5.1
procps-ng-3.3.10-17.el7_5.2 && yum clean all

helps in reducing image size from 512Mb to 461Mb for JRE 10.

JAVA package [serverjre-*.tar.gz] missing

I tried to build the image from the Dockerfile present here and it gives me below error -

docker build -t sujaypillai/java:alfrescobasejava .
Sending build context to Docker daemon 2.56kB
Step 1/6 : FROM centos:7.4.1708
7.4.1708: Pulling from library/centos
18b8eb7e7f01: Pull complete
Digest: sha256:2a61f8abd6250751c4b1dd3384a2bdd8f87e0e60d11c064b8a90e2e552fee2d7
Status: Downloaded newer image for centos:7.4.1708
---> 3afd47092a0e
Step 2/6 : LABEL name="Alfresco Base Java" vendor="Alfresco" license="Various" build-date="unset"
---> Running in c852b5df8679
Removing intermediate container c852b5df8679
---> 12f279e82815
Step 3/6 : RUN yum -y update nss-3.36.0-5.el7_5 bind-license-9.9.4-61.el7 curl-7.29.0-46.el7 systemd-219-57.el7 glibc-2.17-222.el7 openssl-libs-1.0.2k-12.el7 krb5-libs-1.15.1-19.el7 libgcc-4.8.5-28.el7_5.1 libstdc++-4.8.5-28.el7_5.1 procps-ng-3.3.10-17.el7_5.2
---> Running in 16887cc7860e
Loaded plugins: fastestmirror, ovl
Determining fastest mirrors

• base: mirror.as24220.net
• extras: mirror.as24220.net
• updates: mirror.as24220.net
  Resolving Dependencies
  --> Running transaction check
  ---> Package bind-license.noarch 32:9.9.4-50.el7 will be updated
  ---> Package bind-license.noarch 32:9.9.4-61.el7 will be an update
  ---> Package curl.x86_64 0:7.29.0-42.el7 will be updated
  ---> Package curl.x86_64 0:7.29.0-46.el7 will be an update
  --> Processing Dependency: libcurl = 7.29.0-46.el7 for package: curl-7.29.0-46.el7.x86_64
  ---> Package glibc.x86_64 0:2.17-196.el7 will be updated
  --> Processing Dependency: glibc = 2.17-196.el7 for package: glibc-common-2.17-196.el7.x86_64
  ---> Package glibc.x86_64 0:2.17-222.el7 will be an update
  ---> Package krb5-libs.x86_64 0:1.15.1-8.el7 will be updated
  ---> Package krb5-libs.x86_64 0:1.15.1-19.el7 will be an update
  ---> Package libgcc.x86_64 0:4.8.5-16.el7 will be updated
  ---> Package libgcc.x86_64 0:4.8.5-28.el7_5.1 will be an update
  ---> Package libstdc++.x86_64 0:4.8.5-16.el7 will be updated
  ---> Package libstdc++.x86_64 0:4.8.5-28.el7_5.1 will be an update
  ---> Package nss.x86_64 0:3.28.4-8.el7 will be updated
  --> Processing Dependency: nss = 3.28.4-8.el7 for package: nss-sysinit-3.28.4-8.el7.x86_64
  --> Processing Dependency: nss(x86-64) = 3.28.4-8.el7 for package: nss-tools-3.28.4-8.el7.x86_64
  ---> Package nss.x86_64 0:3.36.0-5.el7_5 will be an update
  --> Processing Dependency: nss-util >= 3.36.0-1 for package: nss-3.36.0-5.el7_5.x86_64
  --> Processing Dependency: nss-softokn(x86-64) >= 3.36.0-1 for package: nss-3.36.0-5.el7_5.x86_64
  --> Processing Dependency: nspr >= 4.19.0 for package: nss-3.36.0-5.el7_5.x86_64
  --> Processing Dependency: libnssutil3.so(NSSUTIL_3.31)(64bit) for package: nss-3.36.0-5.el7_5.x86_64
  ---> Package openssl-libs.x86_64 1:1.0.2k-8.el7 will be updated
  ---> Package openssl-libs.x86_64 1:1.0.2k-12.el7 will be an update
  ---> Package procps-ng.x86_64 0:3.3.10-16.el7 will be updated
  ---> Package procps-ng.x86_64 0:3.3.10-17.el7_5.2 will be an update
  ---> Package systemd.x86_64 0:219-42.el7 will be updated
  ---> Package systemd.x86_64 0:219-57.el7 will be an update
  --> Processing Dependency: systemd-libs = 219-57.el7 for package: systemd-219-57.el7.x86_64
  --> Processing Dependency: liblz4.so.1()(64bit) for package: systemd-219-57.el7.x86_64
  --> Running transaction check
  ---> Package glibc-common.x86_64 0:2.17-196.el7 will be updated
  ---> Package glibc-common.x86_64 0:2.17-222.el7 will be an update
  ---> Package libcurl.x86_64 0:7.29.0-42.el7 will be updated
  ---> Package libcurl.x86_64 0:7.29.0-46.el7 will be an update
  ---> Package lz4.x86_64 0:1.7.5-2.el7 will be installed
  ---> Package nspr.x86_64 0:4.13.1-1.0.el7_3 will be updated
  ---> Package nspr.x86_64 0:4.19.0-1.el7_5 will be an update
  ---> Package nss-softokn.x86_64 0:3.28.3-6.el7 will be updated
  ---> Package nss-softokn.x86_64 0:3.36.0-5.el7_5 will be an update
  --> Processing Dependency: nss-softokn-freebl(x86-64) >= 3.36.0-5.el7_5 for package: nss-softokn-3.36.0-5.el7_5.x86_64
  ---> Package nss-sysinit.x86_64 0:3.28.4-8.el7 will be updated
  ---> Package nss-sysinit.x86_64 0:3.36.0-5.el7_5 will be an update
  ---> Package nss-tools.x86_64 0:3.28.4-8.el7 will be updated
  ---> Package nss-tools.x86_64 0:3.36.0-5.el7_5 will be an update
  ---> Package nss-util.x86_64 0:3.28.4-3.el7 will be updated
  ---> Package nss-util.x86_64 0:3.36.0-1.el7_5 will be an update
  ---> Package systemd-libs.x86_64 0:219-42.el7 will be updated
  ---> Package systemd-libs.x86_64 0:219-57.el7 will be an update
  --> Running transaction check
  ---> Package nss-softokn-freebl.x86_64 0:3.28.3-6.el7 will be updated
  ---> Package nss-softokn-freebl.x86_64 0:3.36.0-5.el7_5 will be an update
  --> Finished Dependency Resolution

Dependencies Resolved

Package Arch Version Repository Size

Updating:
bind-license noarch 32:9.9.4-61.el7 base 85 k
curl x86_64 7.29.0-46.el7 base 268 k
glibc x86_64 2.17-222.el7 base 3.6 M
krb5-libs x86_64 1.15.1-19.el7 updates 747 k
libgcc x86_64 4.8.5-28.el7_5.1 updates 101 k
libstdc++ x86_64 4.8.5-28.el7_5.1 updates 303 k
nss x86_64 3.36.0-5.el7_5 updates 835 k
openssl-libs x86_64 1:1.0.2k-12.el7 base 1.2 M
procps-ng x86_64 3.3.10-17.el7_5.2 updates 290 k
systemd x86_64 219-57.el7 base 5.0 M
Installing for dependencies:
lz4 x86_64 1.7.5-2.el7 base 98 k
Updating for dependencies:
glibc-common x86_64 2.17-222.el7 base 11 M
libcurl x86_64 7.29.0-46.el7 base 220 k
nspr x86_64 4.19.0-1.el7_5 updates 127 k
nss-softokn x86_64 3.36.0-5.el7_5 updates 315 k
nss-softokn-freebl x86_64 3.36.0-5.el7_5 updates 222 k
nss-sysinit x86_64 3.36.0-5.el7_5 updates 62 k
nss-tools x86_64 3.36.0-5.el7_5 updates 514 k
nss-util x86_64 3.36.0-1.el7_5 updates 78 k
systemd-libs x86_64 219-57.el7 base 402 k

Transaction Summary
Install ( 1 Dependent package)
Upgrade 10 Packages (+9 Dependent packages)

Total download size: 26 M
Downloading packages:
Delta RPMs disabled because /usr/bin/applydeltarpm not installed.
warning: /var/cache/yum/x86_64/7/base/packages/bind-license-9.9.4-61.el7.noarch.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY
Public key for bind-license-9.9.4-61.el7.noarch.rpm is not installed
Public key for krb5-libs-1.15.1-19.el7.x86_64.rpm is not installed

Total 2.3 MB/s | 26 MB 00:11
Retrieving key from file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
Importing GPG key 0xF4A80EB5:
Userid : "CentOS-7 Key (CentOS 7 Official Signing Key) [email protected]"
Fingerprint: 6341 ab27 53d7 8a78 a7c2 7bb1 24c6 a8a7 f4a8 0eb5
Package : centos-release-7-4.1708.el7.centos.x86_64 (@CentOS)
From : /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Updating : libgcc-4.8.5-28.el7_5.1.x86_64 1/39
Updating : glibc-common-2.17-222.el7.x86_64 2/39
Updating : nss-softokn-freebl-3.36.0-5.el7_5.x86_64 3/39
Updating : glibc-2.17-222.el7.x86_64 4/39
Updating : nspr-4.19.0-1.el7_5.x86_64 5/39
Updating : nss-util-3.36.0-1.el7_5.x86_64 6/39
Updating : nss-softokn-3.36.0-5.el7_5.x86_64 7/39
Updating : nss-sysinit-3.36.0-5.el7_5.x86_64 8/39
Updating : nss-3.36.0-5.el7_5.x86_64 9/39
Installing : lz4-1.7.5-2.el7.x86_64 10/39
Updating : systemd-libs-219-57.el7.x86_64 11/39
Updating : krb5-libs-1.15.1-19.el7.x86_64 12/39
Updating : 1:openssl-libs-1.0.2k-12.el7.x86_64 13/39
Updating : libcurl-7.29.0-46.el7.x86_64 14/39
Updating : curl-7.29.0-46.el7.x86_64 15/39
Updating : systemd-219-57.el7.x86_64 16/39
Updating : procps-ng-3.3.10-17.el7_5.2.x86_64 17/39
Updating : nss-tools-3.36.0-5.el7_5.x86_64 18/39
Updating : libstdc++-4.8.5-28.el7_5.1.x86_64 19/39
Updating : 32:bind-license-9.9.4-61.el7.noarch 20/39
Cleanup : nss-tools-3.28.4-8.el7.x86_64 21/39
Cleanup : curl-7.29.0-42.el7.x86_64 22/39
Cleanup : systemd-219-42.el7.x86_64 23/39
Cleanup : 32:bind-license-9.9.4-50.el7.noarch 24/39
Cleanup : libcurl-7.29.0-42.el7.x86_64 25/39
Cleanup : nss-sysinit-3.28.4-8.el7.x86_64 26/39
Cleanup : nss-3.28.4-8.el7.x86_64 27/39
Cleanup : nss-softokn-3.28.3-6.el7.x86_64 28/39
Cleanup : nss-util-3.28.4-3.el7.x86_64 29/39
Cleanup : 1:openssl-libs-1.0.2k-8.el7.x86_64 30/39
Cleanup : krb5-libs-1.15.1-8.el7.x86_64 31/39
Cleanup : libstdc++-4.8.5-16.el7.x86_64 32/39
Cleanup : procps-ng-3.3.10-16.el7.x86_64 33/39
Cleanup : systemd-libs-219-42.el7.x86_64 34/39
Cleanup : nspr-4.13.1-1.0.el7_3.x86_64 35/39
Cleanup : glibc-common-2.17-196.el7.x86_64 36/39
Cleanup : nss-softokn-freebl-3.28.3-6.el7.x86_64 37/39
Cleanup : glibc-2.17-196.el7.x86_64 38/39
Cleanup : libgcc-4.8.5-16.el7.x86_64 39/39
Verifying : curl-7.29.0-46.el7.x86_64 1/39
Verifying : nss-tools-3.36.0-5.el7_5.x86_64 2/39
Verifying : 1:openssl-libs-1.0.2k-12.el7.x86_64 3/39
Verifying : nss-util-3.36.0-1.el7_5.x86_64 4/39
Verifying : nss-sysinit-3.36.0-5.el7_5.x86_64 5/39
Verifying : systemd-libs-219-57.el7.x86_64 6/39
Verifying : glibc-common-2.17-222.el7.x86_64 7/39
Verifying : glibc-2.17-222.el7.x86_64 8/39
Verifying : libcurl-7.29.0-46.el7.x86_64 9/39
Verifying : libgcc-4.8.5-28.el7_5.1.x86_64 10/39
Verifying : lz4-1.7.5-2.el7.x86_64 11/39
Verifying : systemd-219-57.el7.x86_64 12/39
Verifying : krb5-libs-1.15.1-19.el7.x86_64 13/39
Verifying : 32:bind-license-9.9.4-61.el7.noarch 14/39
Verifying : procps-ng-3.3.10-17.el7_5.2.x86_64 15/39
Verifying : nss-softokn-freebl-3.36.0-5.el7_5.x86_64 16/39
Verifying : nspr-4.19.0-1.el7_5.x86_64 17/39
Verifying : nss-3.36.0-5.el7_5.x86_64 18/39
Verifying : libstdc++-4.8.5-28.el7_5.1.x86_64 19/39
Verifying : nss-softokn-3.36.0-5.el7_5.x86_64 20/39
Verifying : nspr-4.13.1-1.0.el7_3.x86_64 21/39
Verifying : libcurl-7.29.0-42.el7.x86_64 22/39
Verifying : nss-softokn-3.28.3-6.el7.x86_64 23/39
Verifying : libgcc-4.8.5-16.el7.x86_64 24/39
Verifying : nss-util-3.28.4-3.el7.x86_64 25/39
Verifying : nss-sysinit-3.28.4-8.el7.x86_64 26/39
Verifying : libstdc++-4.8.5-16.el7.x86_64 27/39
Verifying : curl-7.29.0-42.el7.x86_64 28/39
Verifying : systemd-libs-219-42.el7.x86_64 29/39
Verifying : 1:openssl-libs-1.0.2k-8.el7.x86_64 30/39
Verifying : 32:bind-license-9.9.4-50.el7.noarch 31/39
Verifying : systemd-219-42.el7.x86_64 32/39
Verifying : nss-3.28.4-8.el7.x86_64 33/39
Verifying : procps-ng-3.3.10-16.el7.x86_64 34/39
Verifying : nss-tools-3.28.4-8.el7.x86_64 35/39
Verifying : krb5-libs-1.15.1-8.el7.x86_64 36/39
Verifying : glibc-common-2.17-196.el7.x86_64 37/39
Verifying : nss-softokn-freebl-3.28.3-6.el7.x86_64 38/39
Verifying : glibc-2.17-196.el7.x86_64 39/39

Dependency Installed:
lz4.x86_64 0:1.7.5-2.el7

Updated:
bind-license.noarch 32:9.9.4-61.el7 curl.x86_64 0:7.29.0-46.el7
glibc.x86_64 0:2.17-222.el7 krb5-libs.x86_64 0:1.15.1-19.el7
libgcc.x86_64 0:4.8.5-28.el7_5.1 libstdc++.x86_64 0:4.8.5-28.el7_5.1
nss.x86_64 0:3.36.0-5.el7_5 openssl-libs.x86_64 1:1.0.2k-12.el7
procps-ng.x86_64 0:3.3.10-17.el7_5.2 systemd.x86_64 0:219-57.el7

Dependency Updated:
glibc-common.x86_64 0:2.17-222.el7
libcurl.x86_64 0:7.29.0-46.el7
nspr.x86_64 0:4.19.0-1.el7_5
nss-softokn.x86_64 0:3.36.0-5.el7_5
nss-softokn-freebl.x86_64 0:3.36.0-5.el7_5
nss-sysinit.x86_64 0:3.36.0-5.el7_5
nss-tools.x86_64 0:3.36.0-5.el7_5
nss-util.x86_64 0:3.36.0-1.el7_5
systemd-libs.x86_64 0:219-57.el7

Complete!
Removing intermediate container 16887cc7860e
---> 69dad8c44fac
Step 4/6 : ENV JAVA_PKG=serverjre-*.tar.gz JAVA_HOME=/usr/java/default
---> Running in ea26fc770700
Removing intermediate container ea26fc770700
---> e3b75bb256aa

Step 5/6 : ADD $JAVA_PKG /usr/java/
ADD failed: no source files were specified

CentOS 8: Wrong encoding

Hi there,

I discovered that transforming a file from csv to pdf with alfresco-transform-misc and umlauts is not working properly. After digging a bit around, I saw that the default encoding which is picked up by Java on the CentOS 8 image is ANSI_X3.4-1968 instead of UTF-8.

To reproduce the issue:

• Start a container from the alfresco-docker-base-java image (There will be some locale related warnings)
• When executing a simple Java method which prints System.getProperty("file.encoding"), ANSI_X3.4-1968 is returned instead of UTF-8.

I think adding the following environment variable to the Dockerfile should be enough to fix it.
ENV LC_ALL C.UTF-8

Thanks!

Question concerning use of AdoptOpenJDK JRE

Since the pull request #30 was eventually reverted / not accepted, the size of the Java Docker images is still quite large as they include a full JDK. Instead of using post-processing steps to trim down the size of the JDK - which was determined to be problematic from the licensing perspective - the image could simply use a JRE. Unfortunately, OpenJDK does not provide a JRE, but AdoptOpenJDK does (see https://adoptopenjdk.net/archive.html).
Before I invest time in preparing a PR for this and risking reversion again, I wanted to ask if this would be acceptable to Legal.

Provide multi-arch image with support for arm64

This image needs to evolve to provide arm64 builds for Alfresco docker images. The current limited/non-support is making it complicated for developers to use Alfresco docker images for customisation and product development on current ARM64 based machines.