|
| 1 | +# Containers & K8S |
| 2 | + |
| 3 | +## OpenJDK Container Images |
| 4 | + |
| 5 | +```BASH |
| 6 | +# Distroless Java Images |
| 7 | +# https://console.cloud.google.com/gcr/images/distroless/GLOBAL |
| 8 | +# https://github.com/GoogleContainerTools/distroless#what-images-are-available |
| 9 | +$ docker pull gcr.io/distroless/java-base-debian12:latest |
| 10 | +$ docker pull gcr.io/distroless/java21-debian12:latest |
| 11 | + |
| 12 | +# Distroless Static & Base |
| 13 | +$ docker pull gcr.io/distroless/static-debian12:latest |
| 14 | +$ docker pull gcr.io/distroless/base-debian12:latest |
| 15 | + |
| 16 | +# GraalVM native-image base |
| 17 | +$ docker pull cgr.dev/chainguard/graalvm-native:latest |
| 18 | +$ docker pull cgr.dev/chainguard/static:latest-glibc |
| 19 | +$ docker pull cgr.dev/chainguard/jdk:latest |
| 20 | + |
| 21 | +# Openjdk |
| 22 | +# https://github.com/docker-library/openjdk |
| 23 | +$ docker pull openjdk:24-slim |
| 24 | + |
| 25 | +# Eclipse Temurin |
| 26 | +# https://github.com/adoptium/containers#supported-images |
| 27 | +$ docker pull eclipse-temurin:23-jdk |
| 28 | +$ docker pull eclipse-temurin:23-alpine |
| 29 | + |
| 30 | +# Oracle OpenJDK |
| 31 | +$ docker pull container-registry.oracle.com/java/openjdk:latest |
| 32 | + |
| 33 | +# Oracle Java (NFTC) |
| 34 | +# https://github.com/oracle/docker-images/tree/main/OracleJava |
| 35 | +$ docker pull container-registry.oracle.com/java/jdk:latest |
| 36 | + |
| 37 | +# Azul Zulu |
| 38 | +# https://github.com/zulu-openjdk/zulu-openjdk |
| 39 | +$ docker pull azul/zulu-openjdk-debian:23-jre |
| 40 | +$ docker pull azul/zulu-openjdk-alpine:23-jre |
| 41 | +$ docker pull azul/prime-debian:latest |
| 42 | + |
| 43 | +# Amazon Corretto |
| 44 | +# https://github.com/corretto/corretto-docker |
| 45 | +$ docker pull amazoncorretto:23 |
| 46 | +$ docker pull amazoncorretto:23-alpine |
| 47 | + |
| 48 | +# Microsoft OpenJDK |
| 49 | +# https://learn.microsoft.com/en-us/java/openjdk/containers |
| 50 | +$ docker pull mcr.microsoft.com/openjdk/jdk:21-ubuntu |
| 51 | +$ docker pull mcr.microsoft.com/openjdk/jdk:21-distroless |
| 52 | + |
| 53 | +# Liberica |
| 54 | +# https://github.com/bell-sw/Liberica/tree/master/docker/repos/liberica-openjre-debian |
| 55 | +$ docker pull bellsoft/liberica-openjdk-debian:latest |
| 56 | +$ docker pull bellsoft/liberica-openjdk-alpine-musl:latest |
| 57 | +$ docker pull bellsoft/liberica-openjdk-alpine:latest (libc) |
| 58 | + |
| 59 | +# GraalVM CE & EE |
| 60 | +# https://github.com/graalvm/container |
| 61 | +$ docker pull ghcr.io/graalvm/graalvm-community:latest |
| 62 | +$ docker pull ghcr.io/graalvm/native-image-community:muslib |
| 63 | +$ docker pull container-registry.oracle.com/graalvm/native-image:latest |
| 64 | + |
| 65 | +# GraalVM CE Dev Builds (No docker images available) |
| 66 | +https://github.com/graalvm/graalvm-ce-dev-builds/releases/ |
| 67 | + |
| 68 | +# Jetbrains Runtime (No docker images available) |
| 69 | +https://github.com/JetBrains/JetBrainsRuntime/releases |
| 70 | + |
| 71 | +# Azul Zulu OpenJDK & Mission Control (Homebrew on MacOS) |
| 72 | +# https://github.com/mdogan/homebrew-zulu |
| 73 | +$ brew tap mdogan/zulu |
| 74 | +$ brew install <name> |
| 75 | +``` |
| 76 | + |
| 77 | +* https://hub.docker.com/_/openjdk |
| 78 | + |
| 79 | +* https://github.com/docker-library/docs/tree/master/openjdk |
| 80 | + |
| 81 | +* https://container-registry.oracle.com/java/openjdk |
| 82 | + |
| 83 | +* https://www.graalvm.org/docs/getting-started/container-images/ |
| 84 | + |
| 85 | +## Docker Commands |
| 86 | + |
| 87 | +* Docker Run ```BASH # Remove all unused images, not just dangling ones $ docker system prune -af # Docker Run $ docker run \ -it \ --rm \ --pull always \ --workdir /app \ --publish 8080:8080 \ --name app \ --mount type=bind,source=$PWD,destination=/app,readonly \ openjdk:24-slim ``` |
| 88 | + |
| 89 | +* Docker Image Size ```BASH # Compressed Size $ docker image save ghcr.io/sureshg/containers:openjdk-latest | gzip | wc -c | numfmt --to=si $ docker image save ghcr.io/sureshg/containers:nativeimage-latest | gzip | wc -c | numfmt --to=si # OR $ docker manifest inspect ghcr.io/sureshg/containers:openjdk-latest -v # Uncompressed Size $ docker inspect -f "{{ .Size }}" sureshg/jvm | numfmt --to=si $ docker history sureshg/jvm ``` |
| 90 | + |
| 91 | +## |
| 92 | + |
| 93 | +[Debug Container](https://github.com/iximiuz/cdebug) |
| 94 | + |
| 95 | +```BASH |
| 96 | +# On M1 mac |
| 97 | +$ docker run \ |
| 98 | + --platform linux/amd64 \ |
| 99 | + --pull always \ |
| 100 | + -it \ |
| 101 | + --rm \ |
| 102 | + -p 8080:80 \ |
| 103 | + --name openjdk-playground \ |
| 104 | + ghcr.io/sureshg/containers:openjdk-latest |
| 105 | + |
| 106 | +# Default busybox image should work. |
| 107 | +$ brew install cdebug |
| 108 | +$ cdebug exec \ |
| 109 | + --privileged \ |
| 110 | + -it \ |
| 111 | + --rm \ |
| 112 | + --platform linux/amd64 \ |
| 113 | + docker://openjdk-playground |
| 114 | + |
| 115 | +# Extract a file from the Docker environment and store it locally |
| 116 | +$ docker run \ |
| 117 | + --rm \ |
| 118 | + --entrypoint cat \ |
| 119 | + busybox:latest \ |
| 120 | + '/bin/ls' > ls |
| 121 | + |
| 122 | +# OR copy files from a container |
| 123 | +$ docker cp <CONTAINER>:/app/app/jar . |
| 124 | + |
| 125 | +# OR |
| 126 | +$ id=$(docker create ghcr.io/sureshg/containers:openjdk-latest) |
| 127 | +$ docker cp $id:/app/app.jar - > app.tar |
| 128 | +$ docker rm -v $id |
| 129 | +``` |
| 130 | + |
| 131 | +## JVM Ergonomics and Container logs |
| 132 | + |
| 133 | +```BASH |
| 134 | +$ cat << EOF >App.java |
| 135 | +import static java.lang.System.out; |
| 136 | +public class App { |
| 137 | + void main() { |
| 138 | + var version = "• Java %s running on %s %s".formatted( |
| 139 | + System.getProperty("java.version"), |
| 140 | + System.getProperty("os.name"), |
| 141 | + System.getProperty("os.arch")); |
| 142 | + out.println(version); |
| 143 | + long unit = 1024 * 1024L; |
| 144 | + long heapSize = Runtime.getRuntime().totalMemory(); |
| 145 | + long heapFreeSize = Runtime.getRuntime().freeMemory(); |
| 146 | + long heapUsedSize = heapSize-heapFreeSize; |
| 147 | + long heapMaxSize = Runtime.getRuntime().maxMemory(); |
| 148 | + |
| 149 | + out.println("• [CPU] Active Processors: " + Runtime.getRuntime().availableProcessors()); |
| 150 | + out.println("• [Mem] Current Heap Size (Committed) : " + heapSize/unit + " MiB"); |
| 151 | + out.println("• [Mem] Current Free memeory in Heap : " + heapFreeSize/unit + " MiB"); |
| 152 | + out.println("• [Mem] Currently used memory : " + heapUsedSize/unit + " MiB"); |
| 153 | + out.println("• [Mem] Max Heap Size (-Xmx) : " + heapMaxSize/unit + " MiB"); |
| 154 | + } |
| 155 | +} |
| 156 | +EOF |
| 157 | + |
| 158 | +$ docker run \ |
| 159 | + -it \ |
| 160 | + --rm \ |
| 161 | + --cpus=2 \ |
| 162 | + --memory=512m \ |
| 163 | + --pull always \ |
| 164 | + --mount type=bind,source=$(pwd),destination=/app,readonly \ |
| 165 | + --mount type=bind,source=/,destination=/host,readonly \ |
| 166 | + --name openjdk \ |
| 167 | + openjdk:24-slim \ |
| 168 | + java \ |
| 169 | + --source 24 --enable-preview \ |
| 170 | + -XX:+UnlockExperimentalVMOptions \ |
| 171 | + -XX:+UnlockDiagnosticVMOptions \ |
| 172 | + -XX:+PrintFlagsFinal \ |
| 173 | + -XX:MaxRAMPercentage=0.8 \ |
| 174 | + -XX:-MaxFDLimit \ |
| 175 | + -Xlog:gc \ |
| 176 | + /app/App.java \ |
| 177 | + | grep -e "Use.*GC" -e "Active" -e "Using" -e "Max.*Limit" -e "Container" -e "•" |
| 178 | +``` |
| 179 | + |
| 180 | +Note: GC Logs & ActiveProcessorCount |
| 181 | + |
| 182 | +For container logs, add -Xlog:gc*,os=trace,os+container=trace option. |
| 183 | +Override the default container CPU quota detection -XX:ActiveProcessorCount= |
| 184 | + |
| 185 | +## JVM default GC |
| 186 | + |
| 187 | +```BASH |
| 188 | +# OpenJDK reverts to Serial GC when it detects < 2 CPUs or < 2GB RAM |
| 189 | +$ docker run -it --rm --cpus=1 --memory=1G openjdk:24-slim java -Xlog:gc --version |
| 190 | + #[0.007s][info][gc] Using Serial |
| 191 | +``` |
| 192 | + |
| 193 | +* [OpenJDK - is_server_class_machine](https://github.com/openjdk/jdk/blob/master/src/hotspot/share/runtime/os.cpp#:~:text=is_server_class_machine) |
| 194 | + |
| 195 | +* [Stop using CPU limits on Kubernetes](https://home.robusta.dev/blog/stop-using-cpu-limits) |
| 196 | + |
| 197 | +* [JVM ergonomics](https://www.youtube.com/watch?v=wApqCjHWF8Q) |
| 198 | + |
| 199 | +* https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
| 200 | + |
| 201 | +## Container Sandbox |
| 202 | + |
| 203 | +```BASH |
| 204 | +$ docker run \ |
| 205 | + -it --rm \ |
| 206 | + --cpus="0.5" \ |
| 207 | + --memory="512m" \ |
| 208 | + --memory-swap="640m" \ |
| 209 | + --pids-limit 512 \ |
| 210 | + --cap-drop=ALL \ |
| 211 | + --cap-add=DAC_OVERRIDE \ |
| 212 | + --security-opt=no-new-privileges \ |
| 213 | + --ulimit nproc=20:20 \ |
| 214 | + --ulimit fsize=1000000 \ |
| 215 | + --user nobody \ |
| 216 | + --network none \ |
| 217 | + --read-only \ |
| 218 | + --tmpfs /tmp \ |
| 219 | + --name sandboxed \ |
| 220 | + --workdir /app \ |
| 221 | + --mount type=bind,source=$PWD,destination=/app,readonly \ |
| 222 | + --mount type=bind,source=/var/run/docker.sock,destination=/var/run/docker.sock,readonly \ |
| 223 | + --mount type=bind,source=/usr/bin/docker,destination=/usr/bin/docker,readonly \ |
| 224 | + --mount type=bind,source=/proc/,target=/host/proc/,ro=true \ |
| 225 | + --mount type=bind,source=/sys/fs/cgroup/,target=/host/sys/fs/cgroup,ro=true \ |
| 226 | + openjdk:24-slim java --enable-preview src/App.java |
| 227 | + |
| 228 | +# --security-opt seccomp=my_sandbox |
| 229 | +# --cap-add=chown \ |
| 230 | +# --cap-add=setgid \ |
| 231 | +# --cap-add=setuid \ |
| 232 | +# --cap-add=sys_chroot \ |
| 233 | +# --cap-add=audit_write \ |
| 234 | +# --cap-add=kill \ |
| 235 | +# --cap-add=sys_tty_config \ |
| 236 | +# --cap-add=DAC_OVERRIDE - Needed to allow overwriting the file |
| 237 | + |
| 238 | +# Create nobody user |
| 239 | +# RUN useradd --shell /bin/sh --create-home --uid 65534 nobody |
| 240 | +``` |
| 241 | + |
| 242 | +* [Secure Computing Mode - seccomp](https://docs.docker.com/engine/security/seccomp/) |
| 243 | + |
| 244 | +* [https://run.mccue.dev](https://github.com/bowbahdoe/run-java-code/blob/main/ui/src/sandbox.rs#L109) |
| 245 | + |
| 246 | +## App Running on K8S/Docker |
| 247 | + |
| 248 | +```BASH |
| 249 | +# Check if running on docker container |
| 250 | +$ docker run \ |
| 251 | + -it \ |
| 252 | + --rm \ |
| 253 | + --pull always \ |
| 254 | + openjdk:24-slim \ |
| 255 | + sh -c "cat /proc/self/cgroup | grep -i '/docker'" |
| 256 | + |
| 257 | +# Check if running on Kubernets |
| 258 | +$ docker run \ |
| 259 | + -it \ |
| 260 | + --rm \ |
| 261 | + --pull always \ |
| 262 | + openjdk:24-slim \ |
| 263 | + sh -c "printenv | grep SERVICE" |
| 264 | +``` |
| 265 | + |
| 266 | +* [Check if the container is running inside K8S](https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/#environment-variables:~:text=printenv%20%7C%20grep%20SERVICE-,KUBERNETES_SERVICE_HOST,-%3D10.0.0.1%0AKUBERNETES_SERVICE_PORT%3D443) |
| 267 | + |
| 268 | +## Access Docker desktop LinuxKit VM on MacOS |
| 269 | + |
| 270 | +```BASH |
| 271 | +$ docker run -it --rm --memory=256m --cpus=1 --mount type=bind,source=/,destination=/host --name alpine alpine |
| 272 | + /# chroot /host |
| 273 | + # docker version |
| 274 | +``` |
| 275 | + |
| 276 | +## |
| 277 | + |
| 278 | +[Multi Architecture Support](https://docs.docker.com/desktop/multi-arch/) |
| 279 | + |
| 280 | +* [tonistiigi/binfmt](https://github.com/tonistiigi/binfmt) ```BASH $ docker run --rm --privileged tonistiigi/binfmt --install all ``` |
| 281 | + |
| 282 | +* [multiarch/qemu-user-static](https://github.com/multiarch/qemu-user-static) ```BASH $ docker run --rm --privileged multiarch/qemu-user-static --reset -p yes ``` |
| 283 | + |
| 284 | +* [Supported Targets - qemu-binfmt-conf.sh](https://github.com/qemu/qemu/blob/master/scripts/qemu-binfmt-conf.sh) |
| 285 | + |
| 286 | +* [Dockerhub Supported Archs](https://github.com/docker-library/official-images#architectures-other-than-amd64) |
| 287 | + |
| 288 | +* Examples ```BASH $ docker run -it --rm --platform=linux/aarch64 alpine uname -m aarch64 $ docker run -it --rm --platform=linux/amd64 alpine uname -m x86_64 $ docker run --rm arm64v8/alpine uname -a $ docker run --rm arm32v7/alpine uname -a $ docker run --rm ppc64le/alpine uname -a $ docker run --rm s390x/alpine uname -a $ docker run --rm tonistiigi/debian:riscv uname -a ``` |
| 289 | + |
| 290 | +## Netcat Webserver |
| 291 | + |
| 292 | +```BASH |
| 293 | +FROM alpine |
| 294 | + |
| 295 | +ENTRYPOINT while :; do nc -k -l -p $PORT -e sh -c 'echo -e "HTTP/1.1 200 OK\n\n hello, world"'; done |
| 296 | +# https://github.com/jamesward/hello-netcat |
| 297 | +# docker build -t hello-netcat . |
| 298 | +# docker run -p 8080:80 -e PORT=80 -it hello-netcat |
| 299 | +``` |
| 300 | + |
| 301 | +Forwards Logs |
| 302 | + |
| 303 | +```BASH |
| 304 | +# forward request and error logs to docker log collector |
| 305 | +RUN ln -sf /dev/stdout /var/log/nginx/access.log \ |
| 306 | + && ln -sf /dev/stderr /var/log/nginx/error.log |
| 307 | + |
| 308 | +# OR output directly to |
| 309 | +/proc/self/fd/1 (STDOUT) |
| 310 | +/proc/self/fd/2 (STDERR) |
| 311 | + |
| 312 | +# https://docs.docker.com/config/containers/logging/configure/ |
| 313 | +``` |
| 314 | + |
| 315 | +[Shutdown signals and EnytryPoint](https://medium.com/@madflojo/shutdown-signals-with-docker-entry-point-scripts-5e560f4e2d45) |
| 316 | + |
| 317 | +```BASH |
| 318 | +#!/bin/bash |
| 319 | +## Entrypoint script for my-app. This script is to show how to write |
| 320 | +## an entrypoint script that actually passes down signals from Docker. |
| 321 | + |
| 322 | +## Load our DB Password into a runtime only Environment Variable |
| 323 | +if [ -f /run/secrets/password ] |
| 324 | +then |
| 325 | + echo "Loading DB password from secrets file" |
| 326 | + DB_PASS=$(cat /run/secrets/password) |
| 327 | + export DB_PASS |
| 328 | +fi |
| 329 | + |
| 330 | +## Run the Application |
| 331 | +exec my-app |
| 332 | +``` |
| 333 | + |
| 334 | +``` |
| 335 | +ENTRYPOINT ["../../myapp-entrypoint.sh"] |
| 336 | +``` |
| 337 | + |
| 338 | +* [Docker stats GraalVM app](https://github.com/vasilmkd/docker-stats-monitor/blob/master/Dockerfile) |
| 339 | + |
| 340 | +HTTP Proxy |
| 341 | + |
| 342 | +```BASH |
| 343 | +FROM debian:stable-slim |
| 344 | + |
| 345 | +ENV HTTP_PROXY="http://proxy.test.com:8080" |
| 346 | +ENV HTTPS_PROXY="http://proxy.test.com:8080" |
| 347 | +ENV NO_PROXY="*.test1.com,*.test2.com,127.0.0.1,localhost" |
| 348 | +``` |
| 349 | + |
| 350 | +## Container Runtime Interface |
| 351 | + |
| 352 | + |
| 353 | + |
| 354 | +## Container Tools |
| 355 | + |
| 356 | +* https://github.com/rancher-sandbox/rancher-desktop |
| 357 | + |
| 358 | +* https://github.com/beringresearch/macpine (Lightweight Linux VMs on MacOS) |
| 359 | + |
| 360 | +* https://github.com/containerd/containerd |
| 361 | + |
| 362 | +* https://github.com/lima-vm/lima (Linux on Mac) |
| 363 | + |
| 364 | +* https://github.com/containerd/nerdctl |
| 365 | + |
| 366 | +* https://github.com/k3s-io/k3s |
| 367 | + |
| 368 | +* https://github.com/rancher/k3d/ |
| 369 | + |
| 370 | +* https://kind.sigs.k8s.io/ |
| 371 | + |
| 372 | +* https://github.com/k0sproject/k0s |
| 373 | + |
| 374 | +* https://github.com/canonical/multipass (Running Ubuntu VM) |
| 375 | + |
| 376 | +* https://podman.io/blogs/2021/09/06/podman-on-macs.html |
| 377 | + |
| 378 | +* https://github.com/wagoodman/dive |
| 379 | + |
| 380 | +* https://github.com/google/cadvisor |
| 381 | + |
| 382 | +* https://github.com/google/go-containerregistry/tree/main/cmd/crane |
| 383 | + |
| 384 | +* [CoSign - Container Signing](https://github.com/sigstore/cosign) |
| 385 | + |
| 386 | +Warning: |
| 387 | +Download the latest version. |
| 388 | + |
0 commit comments