A 1.5MB Java Container App? Yes you can!

Presented at Devoxx Belgium 2022

Containers are increasing the way Java applications are packaged and deployed. There are lots of qualities desirable in a containerized application like fast startup and low memory and CPU requirements, but size and security are also important considerations. Moving big container images around a network will increase the time it takes to start up a new K8s pod or launch a container, and "just enough operating system" container images with reduced attack surface area are also preferable. So what’s the smallest possible Java container image? In this session we’ll demonstrate how to build containerized Java applications small as a mere 1.5MB! Using GraalVM Native Image ahead-of-time compilation and static linking with musl libc we can shrink down and strip out all the unnecessary bits that bloat a typical Java apps and deploy them in lightweight and security focused container images like Alpine and distroless–even scratch!

1. A 1.5MB Java Container App? Yes you can! Shaun Smith Senior Director Oracle Labs—GraalVM @ shaunMsmith

2. Copyright © 2022, Oracle and/or its affiliates 2

3. Let’s start at the end! Copyright © 2022, Oracle and/or its affiliates 3 Photo by 愚木混株 cdd20 on Unsplash

4. Hello World Copyright © 2022, Oracle and/or its affiliates 4

5. GraalVM Enterprise Native Image—Ahead-of-time compiler & runtime Copyright © 2022, Oracle and/or its affiliates 5 Windows Executable MacOS Executable Linux Executable .class .jar .class .jar

6. Copyright © 2022, Oracle and/or its affiliates 6

7. Copyright © 2022, Oracle and/or its affiliates 7 Demo 1.5 MB Hello World Container

8. Copyright © 2022, Oracle and/or its affiliates 8

9. 231 MB Container Minimal JDK with JVM required libs using Distroless Java 17 1.5 MB Container Only needed code Only needed JDK Required libs statically linked Self contained executable packaged in Scratch image Hello World Copyright © 2022, Oracle and/or its affiliates 9 Base OS Image JDK Modules shared libs JVM JDK Tools Application Code musl libc Required libs

10. Let’s go back to the start! Copyright © 2022, Oracle and/or its affiliates 10 Photo by 愚木混株 cdd20 on Unsplash

11. Copyright © 2022, Oracle and/or its affiliates 11 https:// blogs.oracle.com / javamagazine /post/java-18-simple-web-server

12. Copyright © 2022, Oracle and/or its affiliates 12 https:// blogs.oracle.com / javamagazine /post/java-18-simple-web-server

13. JDK on Debian 11 Slim Linux Copyright © 2022, Oracle and/or its affiliates 13 Debian 11-Slim JDK Modules JVM shared libs JDK Tools JDK 17 303 MB Debian 11 slim + 80 MB --------- 383 MB

14. " Distroless " images contain only your application and its runtime dependencies. They do not contain package managers, shells or any other programs you would expect to find in a standard Linux distribution. https:// github.com / GoogleContainerTools / distroless /blob/main/ README.md Copyright © 2022, Oracle and/or its affiliates 14

15. JDK on Distroless “Java 17” Copyright © 2022, Oracle and/or its affiliates 15 Debian JDK Modules JVM libs JVM JDK Tools Distroless JDK 17 231 MB

16. jlink on Distroless “Java Base” Copyright © 2022, Oracle and/or its affiliates 16 Debian JDK Modules JVM libs JVM Custom JRE 35.0 MB Distroless Java Base + 39.4 MB --------- 74.9 MB

17. Dynamically linked executable GraalVM Native Image with Distroless “Java Base” Copyright © 2022, Oracle and/or its affiliates 17 SVM Needed JDK Classes Debian JVM libs Native Executable 19.0 MB Distroless Java Base + 39.4 MB --------- ~58.7 MB

18. GraalVM Native Executable Linking and Containerization Options Copyright © 2022, Oracle and/or its affiliates 18 glibc stdlibc ++, zlib , etc. Application Code Fully Dynamic OS must include all dynamically linked libs Application Code Application Code glibc stdlibc ++, zlib , etc. Mostly Static musl libc stdlibc ++, zlib , etc. Fully Static OS only need provide libc . No libs provided by OS

19. Mostly statically linked executable GraalVM Native Image with Distroless “Base” Copyright © 2022, Oracle and/or its affiliates 19 glibc Required Libs Needed JDK Classes SVM Debian Native Executable 19.0 MB Distroless Base + 20.3 MB --------- ~39.7 MB

20. Alpine Linux is a security-oriented, lightweight Linux distribution based on musl libc and busybox . Copyright © 2022, Oracle and/or its affiliates 20

21. Statically linked executable GraalVM Native Image with Alpine Linux Copyright © 2022, Oracle and/or its affiliates 21 Required Libs Needed JDK Classes SVM Native Executable 19.00 MB Alpine + 5.54 MB --------- ~25 MB

22. Debian Statically linked executable GraalVM Native Image with Distroless “Static” Copyright © 2022, Oracle and/or its affiliates 22 Required Libs Needed JDK Classes SVM Native Executable 19.00 MB Distroless Static + ~2.36 MB --------- ~21.8 MB

23. This image is most useful in the context of building base...or super minimal images (that contain only a single binary and whatever it requires...)” Copyright © 2022, Oracle and/or its affiliates 23 scratch

24. Statically linked executable GraalVM Native Image on Scratch Copyright © 2022, Oracle and/or its affiliates 24 Required Libs Needed JDK Classes SVM Native Executable 19.00 MB Scratch + ~0 MB --------- ~19.4 MB

25. UPX A free, secure, portable, extendable, high-performance executable packer for several executable formats UPX: the Ultimate Packer for eXecutables Copyright © 2022, Oracle and/or its affiliates 25 Executable Executable

26. UPX A free, secure, portable, extendable, high-performance executable packer for several executable formats UPX: the Ultimate Packer for eXecutables Copyright © 2022, Oracle and/or its affiliates 26 Executable Executable 19 MB 5.45 MB

27. Statically linked executable compressed with UPX GraalVM Native Image on Scratch Copyright © 2022, Oracle and/or its affiliates 27 Required Libs Needed JDK Classes SVM Native Executable (Compressed) 5.45 MB Scratch + ~0 MB --------- ~5.45 MB

28. Copyright © 2022, Oracle and/or its affiliates 28 Container Image Sizes (MB) JVM GraalVM Native Image

29. GraalVM Native Image—Ideal for Cloud Native Applications Copyright © 2022, Oracle and/or its affiliates 29 Low Resource Usage Start Fast Small Container Image Minimize Vulnerability www.graalvm.org oracle.com / graalvm

30. More GraalVM @ Devoxx Copyright © 2022, Oracle and/or its affiliates 30

31. Learn More @ graalvm.org Shaun Smith Senior Director Oracle Labs—GraalVM @ shaunMsmith

32. Copyright © 2022, Oracle and/or its affiliates 32