Integrate the JLink workflow and scripts into the Ubi9 container sources

modules/jdk/11/module.yaml

@@ -25,6 +25,7 @@ envs:
 packages:
   install:
   - java-11-openjdk-devel
+  - java-11-openjdk-jmods
   - tzdata-java
 
 modules:

modules/jdk/17/module.yaml

@@ -25,6 +25,7 @@ envs:
 packages:
   install:
   - java-17-openjdk-devel
+  - java-17-openjdk-jmods
 
 modules:
   install:

modules/jlink/artifacts/opt/jboss/container/java/s2i/Dockerfile

@@ -0,0 +1,19 @@
+FROM    registry.access.redhat.com/ubi8/ubi-minimal:latest
+
+# binutils: objcopy
+RUN microdnf --setopt=install_weak_deps=0 --setopt=tsflags=nodocs install -y \
+    java-17-openjdk-headless java-17-openjdk-devel java-17-openjdk-jmods \
+    binutils \
+    && microdnf clean all \
+    && rpm -q \
+    java-17-openjdk-headless java-17-openjdk-devel java-17-openjdk-jmods
+
+ENV     JAVA_HOME=/usr/lib/jvm/jre
+WORKDIR /tmp
+COPY    generatejdkdeps.sh mkdeps.sh mkjreimage.sh mkstrippeddeps.sh runall.sh /tmp/
+
+# ?
+USER    1000
+RUN     mkdir -p /tmp/run/lib
+
+CMD     ./runall.sh

modules/jlink/artifacts/opt/jboss/container/java/s2i/README.md

@@ -0,0 +1,37 @@
+# jlink-openshift App builder
+
+This container bundles together scripts to analyse a Java application
+with `jdeps` and generate a stripped `jre` with only the required Java
+modules to run that application.
+
+## Usage
+
+### building
+
+    podman build -t jlink ./
+
+### running
+
+Assuming you have the following defined locally:
+
+ * `$jarfile`, a local web application JAR
+ * `$libdir`, directory containing auxillary Java libraries (JARs) for the above
+ * `$outputjre`, where to write the stripped JRE
+
+Invoke as follows
+
+    podman run --rm -ti \
+        -v "$jarfile":/tmp/run/app.jar \
+        -v "$libdir":/tmp/run/lib \
+        -v "$outputjre":/tmp/run/out \
+        jlink
+
+## Script details
+
+Most of the scripts require `$JAVA_HOME` to be defined.
+
+ * `mkdeps.sh`:          application       → jdeps     → deps.txt
+ * `mkstrippeddeps.sh`:  deps.txt          → filtering → stripped-deps.txt
+ * `generatejdkdeps.sh`: stripped-deps.txt → filtering → module-deps.txt
+ * `mkjreimage.sh`:      module-deps.txt   → jlink     → custom JDK
+ * `runall.sh`: runs all of the above

modules/jlink/artifacts/opt/jboss/container/java/s2i/generatejdkdeps.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+
+$JAVA_HOME/bin/java --list-modules > java-modules.txt
+< java-modules.txt sed "s/\\@.*//" > modules.txt
+grep -Fx -f stripped-deps.txt modules.txt | tr '\n' ',' | tr -d "[:space:]" > module-deps.txt
+echo "jdk.zipfs" >> module-deps.txt

modules/jlink/artifacts/opt/jboss/container/java/s2i/mkdeps.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+set -euo pipefail
+shopt -s globstar
+
+project="${project-spring-boot-sample-simple}"
+jarfile="${jarfile-$project/target/spring-boot-sample-simple-1.5.0.BUILD-SNAPSHOT.jar}"
+libdir="${libdir-$project/target/lib}"
+
+test -f "$jarfile"
+test -d "$libdir"
+
+# Create a temporary directory for a module path
+# This works around "Module java.xml.bind not found, required by java.ws.rs"
+mkdir dependencies
+find $libdir -type f -name '*.jar' -print0 | xargs -r0 cp -vt dependencies
+
+$JAVA_HOME/bin/jdeps --multi-release 11 -R -s \
+    --module-path dependencies \
+    "$jarfile" \
+    "$libdir"/**/*.jar \
+> deps.txt

modules/jlink/artifacts/opt/jboss/container/java/s2i/mkjreimage.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+set -euo pipefail
+
+outdir="${outdir-spring-boot-jre}"
+depsfile="module-deps.txt"
+
+test -f $depsfile
+modules="$(cat $depsfile)"
+
+$JAVA_HOME/bin/jlink --output "${outdir}/jre" \
+       	--add-modules "$modules" \
+	--strip-debug --no-header-files --no-man-pages \
+	--compress=2

modules/jlink/artifacts/opt/jboss/container/java/s2i/mkstrippeddeps.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+set -euo pipefail
+
+test -f deps.txt
+
+<deps.txt \
+  grep 'java\|jdk\.'  | # mostly removes target/, but also jdk8internals
+  sed -E "s/Warning: .*//" | #remove extraneous warnings
+  sed -E "s/.*-> //"  | # remove src of src -> dep
+  sed -E "s/.*\.jar//" | # remove extraneous dependencies
+  sed "s#/.*##"       | # delete anything after a slash. in practice target/..
+  sort | uniq |
+tee stripped-deps.txt

modules/jlink/artifacts/opt/jboss/container/java/s2i/runall.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+set -euo pipefail
+set -x
+
+jarfile="/tmp/run/app.jar"
+libdir="/tmp/run/lib"
+outdir="/tmp/run/out"
+
+test -e "$JAVA_HOME"
+
+export project jarfile libdir outdir
+
+bash -x ./mkdeps.sh
+bash -x ./mkstrippeddeps.sh
+bash -x ./generatejdkdeps.sh
+bash -x ./mkjreimage.sh

modules/jlink/configure.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+# Configure module
+set -e
+
+SCRIPT_DIR=$(dirname $0)
+ARTIFACTS_DIR=${SCRIPT_DIR}/artifacts
+
+chown -R default:root $SCRIPT_DIR
+chmod -R ug+rwX $SCRIPT_DIR
+chmod ug+x ${ARTIFACTS_DIR}/opt/jboss/container/java/s2i/*
+
+pushd ${ARTIFACTS_DIR}
+cp -pr * /
+popd

modules/jlink/module.yaml

@@ -0,0 +1,14 @@
+schema_version: 1
+
+name: "jboss.container.java.jlink"
+version: "2.0"
+description: ^
+  "Provides support for building custom JREs with a slimmed
+  down set of modules by making use of Jdeps and Jlink"
+
+envs: 
+- name: JBOSS_CONTAINER_JAVA_JLINK_MODULE
+  value: /opt/jboss/container/java/jlink
+
+execute:
+- script: configure.sh

modules/s2i/bash/artifacts/usr/local/s2i/assemble

@@ -14,3 +14,52 @@ source "${JBOSS_CONTAINER_JAVA_S2I_MODULE}/maven-s2i-overrides"
 # invoke the build
 maven_s2i_build
 
+#TODO: Clean this up to call the scripts instead
+
+shopt -s globstar
+echo "Setting environment variables"
+jarfile="/deployments/*.jar"
+libdir="/deployments/lib"
+$JAVA_HOME/
+
+echo "Checking that jarfile and libdir exist"
+test -f "$jarfile"
+test -d "$libdir"
+
+# Create a temporary directory for a module path
+mkdir dependencies
+cp /deployments/lib/**/*.jar dependencies
+# Calculate dependencies
+$JAVA_HOME/bin/jdeps --module-path dependencies --ignore-missing-deps --multi-release 11 -R -s \
+    "$jarfile" \
+    "$libdir"/**/*.jar \
+> deps.txt
+# Clean up temporary directory
+rm -rf dependencies
+
+# Strip down the dependencies to the ones we're looking for
+<deps.txt \
+  grep 'java\|jdk\.'  | # mostly removes target/, but also jdk8internals
+  sed -E "s/Warning: .*//" | #remove extraneous warnings
+  sed -E "s/.*-> //"  | # remove src of src -> dep
+  sed -E "s/.*\.jar//" | # remove extraneous dependencies
+  sed "s#/.*##"       | # delete anything after a slash. in practice target/..
+  sort | uniq |
+tee stripped-deps.txt
+
+echo "Checking against jdk modules"
+$JAVA_HOME/bin/java --list-modules > java-modules.txt
+cat java-modules.txt | sed "s/\\@.*//" > modules.txt
+grep -Fx -f stripped-deps.txt modules.txt | tr '\n' ',' | tr -d "[:space:]" > module-deps.txt
+echo "jdk.zipfs" >> module-deps.txt
+
+echo "Linking jre"
+$JAVA_HOME/bin/jlink --output runtime-jre \
+      	--add-modules $(cat module-deps.txt) \
+        -G --no-header-files --no-man-pages
+
+rm *.txt
+echo "Repacking jre"
+INSTALL_BASE="/lib/jvm/java-11-openjdk"
+JDK_IMAGE="runtime-jre"
+echo -n "Replacing shared libraries from JDK image '$JDK_IMAGE' with shared libraries from '$INSTALL_BASE'... "

modules/s2i/bash/module.yaml

@@ -15,6 +15,7 @@ modules:
   - name: jboss.container.maven.s2i
   - name: jboss.container.java.run
   - name: jboss.container.util.logging
+  - name: jboss.container.java.jlink
 
 packages:
   install:

modules/s2i/core/artifacts/opt/jboss/container/s2i/core/s2i-core

@@ -33,6 +33,7 @@ function s2i_core_env_init() {
   S2I_IMAGE_SOURCE_MOUNTS="${S2I_IMAGE_SOURCE_MOUNTS:-${CUSTOM_INSTALL_DIRECTORIES}}"
   S2I_ENABLE_INCREMENTAL_BUILDS="${S2I_ENABLE_INCREMENTAL_BUILDS:-true}"
   S2I_DELETE_SOURCE="${S2I_DELETE_SOURCE:-true}"
+  S2I_ENABLE_JLINK="${S2I_ENABLE_JLINK:-true}"
 }
 
 # extensions may override this method to initialize environment variables

modules/s2i/core/module.yaml

@@ -112,6 +112,12 @@ envs:
     Delete source files at the end of build.  Defaults to true.
   example: "false"
 
+- name: S2I_ENABLE_JLINK_WORKFLOW
+  description: ^
+    Enables the Jdeps/JLink workflow to minimize JRE size
+  example: "false"
+  value: false
+
 run:
   cmd:
   - "/usr/local/s2i/run"

ubi9-openjdk-11.yaml

@@ -49,6 +49,7 @@ modules:
   - name: jboss.container.maven
     version: "3.8.11"
   - name: jboss.container.java.s2i.bash
+  - name: jboss.container.java.jlink
 
 help:
   add: true

ubi9-openjdk-17.yaml

@@ -49,6 +49,7 @@ modules:
   - name: jboss.container.maven
     version: "3.8.17"
   - name: jboss.container.java.s2i.bash
+  - name: jboss.container.java.jlink
 
 help:
   add: true