You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by "mingyen066 (via GitHub)" <gi...@apache.org> on 2025/11/21 08:10:11 UTC
[PR] KAFKA-19876: Update default JDK image to eclipse-temurin:17-jdk-jammy [kafka]
mingyen066 opened a new pull request, #20945:
URL: https://github.com/apache/kafka/pull/20945
`sapmachine` doesn't support JDK, so we switched to use `eclipse-temurin` so that previous AK versions such as AK 3.9 can use the same image provider.
We also use symlinks to fix the java path problem for `eclipse-temurin`, based on a solution proposed by @unknowntpo.
# Java path problem and its solution
After switching to `eclipse-temurin`, we encountered a 'java not found' problem.
This was unexpected because we had already written PATH to `~/.ssh/environment` and set `PermitUserEnvironment yes` in `sshd_config`.
It turns out that the PAM (Pluggable Authentication Modules) re-reads `/etc/environment` after `~/.ssh/environment`. Unfortunately, there is a PATH variable in `/etc/environment` in ubuntu, which overwrites the PATH from `~/.ssh/environment`. Some images didn't have this problem because the java path was already in PATH before we changed it.
The possible solutions are:
* Prevent PAM from reading `/etc/environment` by editing `/etc/pam.d/sshd`
* Write PATH to `~/.pam_environment` (ref: [help.ubuntu article](https://help.ubuntu.com/community/EnvironmentVariables#A.2BAH4-.2F.pam_environment))
* Write PATH to `/etc/environment/`
* Add a symlink so that java is found without changing PATH
However, we think first two solutions are prone to being distribution-specific.
Modifying /etc/environment affects all users' PATH, which is not ideal.
Therefore, we adopt the symlink solution suggested by @unknowntpo
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-19876: Replace the base image since openjdk image is deprecated (trunk) [kafka]
Posted by "mingyen066 (via GitHub)" <gi...@apache.org>.
mingyen066 commented on code in PR #20945:
URL: https://github.com/apache/kafka/pull/20945#discussion_r2550240044
##########
tests/docker/Dockerfile:
##########
@@ -149,10 +149,13 @@ RUN useradd -u $UID -ms /bin/bash ducker \
&& mkdir -p /home/ducker/ \
&& rsync -aiq /root/.ssh/ /home/ducker/.ssh \
&& chown -R ducker /home/ducker/ /mnt/ /var/log/ \
- && echo "PATH=$(runuser -l ducker -c 'echo $PATH'):$JAVA_HOME/bin" >> /home/ducker/.ssh/environment \
- && echo 'PATH=$PATH:'"$JAVA_HOME/bin" >> /home/ducker/.profile \
&& echo 'ducker ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
+# Symlink all JDK binaries (java, jcmd, jps, etc.) to /usr/bin.
+# We don't add PATH env to ~/.ssh/environment because on some Linux distributions,
+# PAM (Pluggable Authentication Modules) may re-read /etc/environment, overwriting PATH.
+RUN cp -sn $JAVA_HOME/bin/* /usr/bin/
Review Comment:
The `.ssh/environment` files is already removed in the above command
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-19876: Replace the base image since openjdk image is deprecated (trunk) [kafka]
Posted by "chia7712 (via GitHub)" <gi...@apache.org>.
chia7712 merged PR #20945:
URL: https://github.com/apache/kafka/pull/20945
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-19876: Replace the base image since openjdk image is deprecated (trunk) [kafka]
Posted by "chia7712 (via GitHub)" <gi...@apache.org>.
chia7712 commented on code in PR #20945:
URL: https://github.com/apache/kafka/pull/20945#discussion_r2550185662
##########
tests/docker/Dockerfile:
##########
@@ -149,10 +149,13 @@ RUN useradd -u $UID -ms /bin/bash ducker \
&& mkdir -p /home/ducker/ \
&& rsync -aiq /root/.ssh/ /home/ducker/.ssh \
&& chown -R ducker /home/ducker/ /mnt/ /var/log/ \
- && echo "PATH=$(runuser -l ducker -c 'echo $PATH'):$JAVA_HOME/bin" >> /home/ducker/.ssh/environment \
- && echo 'PATH=$PATH:'"$JAVA_HOME/bin" >> /home/ducker/.profile \
&& echo 'ducker ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
+# Symlink all JDK binaries (java, jcmd, jps, etc.) to /usr/bin.
+# We don't add PATH env to ~/.ssh/environment because on some Linux distributions,
+# PAM (Pluggable Authentication Modules) may re-read /etc/environment, overwriting PATH.
+RUN cp -sn $JAVA_HOME/bin/* /usr/bin/
Review Comment:
Please remove the unused setting in env file
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-19876: Replace the base image since openjdk image is deprecated (trunk) [kafka]
Posted by "chia7712 (via GitHub)" <gi...@apache.org>.
chia7712 commented on PR #20945:
URL: https://github.com/apache/kafka/pull/20945#issuecomment-3564933713
trunk: https://github.com/apache/kafka/commit/99fafc44bae130f59abe896413641ce6538e9eab
4.2: https://github.com/apache/kafka/commit/58d9bf534f02ccacd3c7e3221e3cfbb354c87c3c
4.1: https://github.com/apache/kafka/commit/6b035a943cb072f779430293620e8d833bca244b
4.0: https://github.com/apache/kafka/commit/a114fc289ae10f0228b6a4aded51e1b28b754eb8
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org