grzesuav / jready

A set of Docker image that are ready to execute a JRE

JRE ready Docker image

jready is a set of minimalist Docker images that are ready to execute a JRE.

More than a small size, the goal of minimal Docker image is to enhance security by reducing the attack surface.

Note than theses images don't include a JRE:

• you can freely to choose the JRE vendor (eg Oracle or OpenJDK) and version (tested from 1.7 to 11)
• with JRE 9 and higher, you can freely build your own minimal JRE thanks to jlink. See example below.

An example below shows how a JRE can be integrated on top of theses images.

BusyBox based (busybox/Dockerfile)

Based on the offical BusyBox glibc image

Alpine based (alpine/Dockerfile)

Based on the offical Alpine image and Alpine GLIBC package

Example

This example is based on OpenJDK 11. The example starts from the busybox based image but alpine can be used instead without any further changes in the Dockerfile.

Dockerfile

Create a minimal JRE image. If needed the JLINK_MODULES list (comma-separated) can be completed to fit other needs.

FROM xfournet/jready:busybox

ARG JDK_URL=https://download.java.net/java/GA/jdk11/28/GPL/openjdk-11+28_linux-x64_bin.tar.gz
ARG JLINK_OPTIONS="--vm=server --compress=2 --no-header-files --no-man-pages"
ARG JLINK_MODULES="java.base"
ARG JRE_DIR="/opt/jre"

RUN \
    # Download and extract JDK
    wget ${JDK_URL} -O - | tar xz -C /tmp && \
    # Build customized JRE
    /tmp/jdk-*/bin/jlink --output ${JRE_DIR} --add-modules ${JLINK_MODULES} ${JLINK_OPTIONS} && \
    # Remove JDK
    rm -r /tmp/jdk-* 
    
ENV PATH="${JRE_DIR}/bin:${PATH}"    

Image build and test

docker build -t myjre .
docker run --rm -ti myjre

# in container
java --version