You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "merlimat (via GitHub)" <gi...@apache.org> on 2026/06/24 17:53:45 UTC
[PR] [improve][build] Trim unused JDK modules from the Docker image runtime [pulsar]
merlimat opened a new pull request, #26086:
URL: https://github.com/apache/pulsar/pull/26086
### Motivation
The `apachepulsar/pulsar` image already uses `jlink` to assemble its bundled JDK runtime, but it passes `--add-modules ALL-MODULE-PATH`, which keeps **every** JDK module. As a result the runtime still ships the full developer/build/debug toolchain that a running broker/bookie never uses: `javac` and its ~10 MB `ct.sym`, `javadoc`, `jdeps`, `jlink`, `jpackage`, the jshell/console REPL, and the `jdwp`/`jdi`/`hotspot-agent`/`jstatd` serviceability agents.
### Modifications
- In `docker/pulsar/Dockerfile`, replace `--add-modules ALL-MODULE-PATH` with an explicit list of the modules needed at runtime (one per line for easy maintenance), shared by both the primary (`--compress=2`) and the Java 24+ fallback (`--compress=zip-9`) `jlink` invocations.
- Add a comment documenting which module groups are intentionally excluded and why.
- Kept for live operations: `jdk.jcmd`, `jdk.jfr`, `jdk.management.agent`.
- `java.desktop` and `jdk.localedata` are **kept on purpose**: `jdeps` over the shipped jars shows Jetty, Jersey/HK2 and SnakeYAML statically call `java.beans.Introspector` (in `java.desktop`), and `localedata` is needed for non-English date/number formatting. Dropping them would be higher risk, so this change is limited to modules with no runtime exposure.
- The list is kept valid across the JDK versions we build with: `jdk.random` is intentionally not listed (it was folded into `java.base` and no longer exists as a separate module on JDK 25).
### Result
Measured `/opt/jvm` size, with the same `--strip-debug` / `--no-man-pages` / `--no-header-files` flags as today:
| | before (ALL-MODULE-PATH) | after | saving |
|---|---|---|---|
| JDK 25 (5.0.0-M2 build) | 104 MB | 78 MB | ~26 MB |
| JDK 21 (Dockerfile default) | 99 MB | 77 MB | ~22 MB |
Verified by building the `jvm` stage with `--build-arg IMAGE_JDK_MAJOR_VERSION=21` and `=25`: both build, resolve all 48 requested modules, run `java -version`, and no longer contain `ct.sym`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [improve][build] Trim unused JDK modules from the Docker image runtime [pulsar]
Posted by "merlimat (via GitHub)" <gi...@apache.org>.
merlimat commented on PR #26086:
URL: https://github.com/apache/pulsar/pull/26086#issuecomment-4793736855
@lhotari I've added back the async profiler module (which was removed by jlink, even before this PR).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [improve][build] Trim unused JDK modules from the Docker image runtime [pulsar]
Posted by "merlimat (via GitHub)" <gi...@apache.org>.
merlimat commented on code in PR #26086:
URL: https://github.com/apache/pulsar/pull/26086#discussion_r3470367333
##########
docker/pulsar/Dockerfile:
##########
@@ -59,10 +59,73 @@ FROM amazoncorretto:${IMAGE_JDK_MAJOR_VERSION}-alpine${ALPINE_VERSION} AS jvm
RUN apk add --no-cache binutils
-# Use JLink to create a slimmer JDK distribution (see: https://adoptium.net/blog/2021/10/jlink-to-produce-own-runtime/)
-# This still includes all JDK modules, though in the future we could compile a list of required modules
-# first try with Java 17/21 compatible jlink command and if it fails, fallback to Java 24+ compatible command
-RUN /usr/lib/jvm/default-jvm/bin/jlink --add-modules ALL-MODULE-PATH --compress=2 --no-man-pages --no-header-files --strip-debug --output /opt/jvm || /usr/lib/jvm/default-jvm/bin/jlink --module-path /usr/lib/jvm/default-jvm/jmods --add-modules ALL-MODULE-PATH --compress=zip-9 --no-man-pages --no-header-files --strip-debug --output /opt/jvm
+# Use JLink to create a slimmer JDK runtime (see: https://adoptium.net/blog/2021/10/jlink-to-produce-own-runtime/)
+# Include only the modules needed at runtime (one per line below for easy maintenance).
+#
+# Kept on purpose:
+# - java.desktop + jdk.localedata: Jetty/Jersey/SnakeYAML call java.beans.Introspector (in
+# java.desktop), and localedata is needed for non-English date/number formatting.
+# - jdk.jcmd, jdk.jfr, jdk.management.agent: live ops/diagnostics on a running broker.
+#
+# Left out (never used by a running broker):
+# - build/compile tools: java.compiler, jdk.compiler (also drops the ~10MB lib/ct.sym),
+# jdk.javadoc, jdk.jdeps, jdk.jlink, jdk.jpackage, jdk.jartool
+# - REPL/console: jdk.jshell, jdk.editpad, jdk.internal.ed, jdk.internal.le, jdk.jconsole
+# - debug agents: jdk.jdwp.agent, jdk.jdi, jdk.hotspot.agent, jdk.jstatd
Review Comment:
added it back.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [improve][build] Trim unused JDK modules from the Docker image runtime [pulsar]
Posted by "merlimat (via GitHub)" <gi...@apache.org>.
merlimat commented on code in PR #26086:
URL: https://github.com/apache/pulsar/pull/26086#discussion_r3470365870
##########
docker/pulsar/Dockerfile:
##########
@@ -59,10 +59,73 @@ FROM amazoncorretto:${IMAGE_JDK_MAJOR_VERSION}-alpine${ALPINE_VERSION} AS jvm
RUN apk add --no-cache binutils
-# Use JLink to create a slimmer JDK distribution (see: https://adoptium.net/blog/2021/10/jlink-to-produce-own-runtime/)
-# This still includes all JDK modules, though in the future we could compile a list of required modules
-# first try with Java 17/21 compatible jlink command and if it fails, fallback to Java 24+ compatible command
-RUN /usr/lib/jvm/default-jvm/bin/jlink --add-modules ALL-MODULE-PATH --compress=2 --no-man-pages --no-header-files --strip-debug --output /opt/jvm || /usr/lib/jvm/default-jvm/bin/jlink --module-path /usr/lib/jvm/default-jvm/jmods --add-modules ALL-MODULE-PATH --compress=zip-9 --no-man-pages --no-header-files --strip-debug --output /opt/jvm
+# Use JLink to create a slimmer JDK runtime (see: https://adoptium.net/blog/2021/10/jlink-to-produce-own-runtime/)
+# Include only the modules needed at runtime (one per line below for easy maintenance).
+#
+# Kept on purpose:
+# - java.desktop + jdk.localedata: Jetty/Jersey/SnakeYAML call java.beans.Introspector (in
+# java.desktop), and localedata is needed for non-English date/number formatting.
+# - jdk.jcmd, jdk.jfr, jdk.management.agent: live ops/diagnostics on a running broker.
+#
+# Left out (never used by a running broker):
+# - build/compile tools: java.compiler, jdk.compiler (also drops the ~10MB lib/ct.sym),
+# jdk.javadoc, jdk.jdeps, jdk.jlink, jdk.jpackage, jdk.jartool
+# - REPL/console: jdk.jshell, jdk.editpad, jdk.internal.ed, jdk.internal.le, jdk.jconsole
+# - debug agents: jdk.jdwp.agent, jdk.jdi, jdk.hotspot.agent, jdk.jstatd
+# - Graal/JVMCI compiler modules (jdk.graal.*): unused by the C2 JIT
+# - java.se aggregator: excluded so it does not transitively pull the above back in
+# - jdk.random: part of java.base on JDK 25, not a separate module
+#
+RUN JDK_MODULES="\
+java.base,\
+java.datatransfer,\
+java.xml,\
+java.prefs,\
+java.desktop,\
+java.instrument,\
+java.logging,\
+java.management,\
+java.security.sasl,\
+java.naming,\
+java.rmi,\
+java.management.rmi,\
+java.net.http,\
+java.scripting,\
+java.security.jgss,\
+java.transaction.xa,\
+java.sql,\
+java.sql.rowset,\
+java.xml.crypto,\
+java.smartcardio,\
Review Comment:
removed this and few others, after double checking
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [improve][build] Trim unused JDK modules from the Docker image runtime [pulsar]
Posted by "merlimat (via GitHub)" <gi...@apache.org>.
merlimat merged PR #26086:
URL: https://github.com/apache/pulsar/pull/26086
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [improve][build] Trim unused JDK modules from the Docker image runtime [pulsar]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on code in PR #26086:
URL: https://github.com/apache/pulsar/pull/26086#discussion_r3469494791
##########
docker/pulsar/Dockerfile:
##########
@@ -59,10 +59,73 @@ FROM amazoncorretto:${IMAGE_JDK_MAJOR_VERSION}-alpine${ALPINE_VERSION} AS jvm
RUN apk add --no-cache binutils
-# Use JLink to create a slimmer JDK distribution (see: https://adoptium.net/blog/2021/10/jlink-to-produce-own-runtime/)
-# This still includes all JDK modules, though in the future we could compile a list of required modules
-# first try with Java 17/21 compatible jlink command and if it fails, fallback to Java 24+ compatible command
-RUN /usr/lib/jvm/default-jvm/bin/jlink --add-modules ALL-MODULE-PATH --compress=2 --no-man-pages --no-header-files --strip-debug --output /opt/jvm || /usr/lib/jvm/default-jvm/bin/jlink --module-path /usr/lib/jvm/default-jvm/jmods --add-modules ALL-MODULE-PATH --compress=zip-9 --no-man-pages --no-header-files --strip-debug --output /opt/jvm
+# Use JLink to create a slimmer JDK runtime (see: https://adoptium.net/blog/2021/10/jlink-to-produce-own-runtime/)
+# Include only the modules needed at runtime (one per line below for easy maintenance).
+#
+# Kept on purpose:
+# - java.desktop + jdk.localedata: Jetty/Jersey/SnakeYAML call java.beans.Introspector (in
+# java.desktop), and localedata is needed for non-English date/number formatting.
+# - jdk.jcmd, jdk.jfr, jdk.management.agent: live ops/diagnostics on a running broker.
+#
+# Left out (never used by a running broker):
+# - build/compile tools: java.compiler, jdk.compiler (also drops the ~10MB lib/ct.sym),
+# jdk.javadoc, jdk.jdeps, jdk.jlink, jdk.jpackage, jdk.jartool
+# - REPL/console: jdk.jshell, jdk.editpad, jdk.internal.ed, jdk.internal.le, jdk.jconsole
+# - debug agents: jdk.jdwp.agent, jdk.jdi, jdk.hotspot.agent, jdk.jstatd
+# - Graal/JVMCI compiler modules (jdk.graal.*): unused by the C2 JIT
+# - java.se aggregator: excluded so it does not transitively pull the above back in
+# - jdk.random: part of java.base on JDK 25, not a separate module
+#
+RUN JDK_MODULES="\
+java.base,\
+java.datatransfer,\
+java.xml,\
+java.prefs,\
+java.desktop,\
+java.instrument,\
+java.logging,\
+java.management,\
+java.security.sasl,\
+java.naming,\
+java.rmi,\
+java.management.rmi,\
+java.net.http,\
+java.scripting,\
+java.security.jgss,\
+java.transaction.xa,\
+java.sql,\
+java.sql.rowset,\
+java.xml.crypto,\
+java.smartcardio,\
Review Comment:
is this required?
##########
docker/pulsar/Dockerfile:
##########
@@ -59,10 +59,73 @@ FROM amazoncorretto:${IMAGE_JDK_MAJOR_VERSION}-alpine${ALPINE_VERSION} AS jvm
RUN apk add --no-cache binutils
-# Use JLink to create a slimmer JDK distribution (see: https://adoptium.net/blog/2021/10/jlink-to-produce-own-runtime/)
-# This still includes all JDK modules, though in the future we could compile a list of required modules
-# first try with Java 17/21 compatible jlink command and if it fails, fallback to Java 24+ compatible command
-RUN /usr/lib/jvm/default-jvm/bin/jlink --add-modules ALL-MODULE-PATH --compress=2 --no-man-pages --no-header-files --strip-debug --output /opt/jvm || /usr/lib/jvm/default-jvm/bin/jlink --module-path /usr/lib/jvm/default-jvm/jmods --add-modules ALL-MODULE-PATH --compress=zip-9 --no-man-pages --no-header-files --strip-debug --output /opt/jvm
+# Use JLink to create a slimmer JDK runtime (see: https://adoptium.net/blog/2021/10/jlink-to-produce-own-runtime/)
+# Include only the modules needed at runtime (one per line below for easy maintenance).
+#
+# Kept on purpose:
+# - java.desktop + jdk.localedata: Jetty/Jersey/SnakeYAML call java.beans.Introspector (in
+# java.desktop), and localedata is needed for non-English date/number formatting.
+# - jdk.jcmd, jdk.jfr, jdk.management.agent: live ops/diagnostics on a running broker.
+#
+# Left out (never used by a running broker):
+# - build/compile tools: java.compiler, jdk.compiler (also drops the ~10MB lib/ct.sym),
+# jdk.javadoc, jdk.jdeps, jdk.jlink, jdk.jpackage, jdk.jartool
+# - REPL/console: jdk.jshell, jdk.editpad, jdk.internal.ed, jdk.internal.le, jdk.jconsole
+# - debug agents: jdk.jdwp.agent, jdk.jdi, jdk.hotspot.agent, jdk.jstatd
Review Comment:
support for debugging in the docker container would be useful to retain. I guess building a custom image to support the usecase is a way around it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org