Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(jdk) Use of JRE image using multi-arch build #17866

Merged
merged 1 commit into from
Oct 1, 2020
Merged

feat(jdk) Use of JRE image using multi-arch build #17866

merged 1 commit into from
Oct 1, 2020

Conversation

benoitf
Copy link
Contributor

@benoitf benoitf commented Sep 15, 2020

What does this PR do?

Use a multi-arch build of OpenJDK/jre

$ docker images | grep jre
openjdk                                           11-jre-slim          a982abd9eead        5 days ago          204MB
adoptopenjdk/openjdk11                            jre                  d762b86b9a70        3 weeks ago         229MB
adoptopenjdk/openjdk11                            jre-11.0.8_10        d762b86b9a70        3 weeks ago         229MB
$ docker run --rm -it openjdk:11-jre-slim java --version                                                                                                                                  openjdk 11.0.8 2020-07-14
OpenJDK Runtime Environment 18.9 (build 11.0.8+10)
OpenJDK 64-Bit Server VM 18.9 (build 11.0.8+10, mixed mode)

$ docker run --rm -it adoptopenjdk/openjdk11:jre java --version
openjdk 11.0.8 2020-07-14
OpenJDK Runtime Environment AdoptOpenJDK (build 11.0.8+10)
OpenJDK 64-Bit Server VM AdoptOpenJDK (build 11.0.8+10, mixed mode)

Screenshot/screencast of this PR

image

Multi arch images

What issues does this PR fix or reference?

#16655

How to test this PR?

Usage of docker image built with JRE

PR Checklist

As the author of this Pull Request I made sure that:

Reviewers

Reviewers, please comment how you tested the PR when approving it.

Change-Id: I6fecbd6122398698688f72e3d7809fffd5cc8b5f
Signed-off-by: Florent Benoit fbenoit@redhat.com

@benoitf benoitf mentioned this pull request Sep 15, 2020
Closed
6 tasks
@che-bot che-bot added status/code-review This issue has a pull request posted for it and is awaiting code review completion by the community. kind/task Internal things, technical debt, and to-do tasks to be performed. labels Sep 15, 2020
@benoitf benoitf requested a review from skabashnyuk September 15, 2020 08:24
@che-bot
Copy link
Contributor

che-bot commented Sep 15, 2020

❌ E2E Happy path tests failed ❗

See Details

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

ℹ️ Use comment "[crw-ci-test]" to rerun happy path E2E test.

skabashnyuk
skabashnyuk approved these changes Sep 30, 2020
View reviewed changes
Copy link
Contributor

@skabashnyuk skabashnyuk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tested. See no error during che server startup
Знімок екрана 2020-09-30 о 11 32 44
Знімок екрана 2020-09-30 о 11 37 42

@benoitf
Copy link
Contributor Author

benoitf commented Oct 1, 2020

[crw-ci-test]

sparkoo
sparkoo reviewed Oct 1, 2020
View reviewed changes
dockerfiles/che/Dockerfile
@@ -19,7 +19,7 @@ FROM ${CHE_DASHBOARD_ORGANIZATION}/che-dashboard:${CHE_DASHBOARD_VERSION} as che
FROM ${CHE_DASHBOARD_NEXT_ORGANIZATION}/che-dashboard-next:${CHE_DASHBOARD_NEXT_VERSION} as che_dashboard_next
FROM ${CHE_WORKSPACE_LOADER_ORGANIZATION}/che-workspace-loader:${CHE_WORKSPACE_LOADER_VERSION} as che_workspace_loader_base

FROM openjdk:11-jre-slim
FROM adoptopenjdk/openjdk11:jre-11.0.8_10
Copy link
Member

@sparkoo sparkoo Oct 1, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would use adoptopenjdk/openjdk11:jre tag, to get latest security patches automatically.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

well we usually don't to be sure that we're always use a predefined image
like in 6months, maybe a new 'security/bugfix' might break che 7.20

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, it can break, but I think probability is very low. Question is, whether it's more probable that there will be new security vulnerability and we forget to update jdk, or that latest jdk breaks our code.

I guess in ideal world, we would use jre in master to get latest security release, and replace it with matching exact version tag or hash for a release.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what is used is dependabot that should trigger specific updates to the docker image when there is new image released.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

are you sure that dependabot will work here? (it maybe will, I don't know how dependabot actually works). Anyway, I'm not against merging it as is. I just think it's not the best we can have :)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe it's not configured properly but it's how it works
https://dependabot.com/docker/
https://dependabot.com/blog/dependabot-now-supports-docker/

@benoitf
Use of JRE image using multi-arch build
835852d 
Change-Id: I6fecbd6122398698688f72e3d7809fffd5cc8b5f
Signed-off-by: Florent Benoit <fbenoit@redhat.com>
@benoitf
Copy link
Contributor Author

benoitf commented Oct 1, 2020

rebasing to make it work with happy path

@benoitf
Copy link
Contributor Author

benoitf commented Oct 1, 2020

[crw-ci-test]

@eclipse-che eclipse-che deleted a comment from che-bot Oct 1, 2020
@eclipse-che eclipse-che deleted a comment from che-bot Oct 1, 2020
@che-bot
Copy link
Contributor

che-bot commented Oct 1, 2020

✅ E2E Happy path tests succeed 🎉

See Details

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

@benoitf benoitf merged commit 0b76e90 into eclipse-che:master Oct 1, 2020
@benoitf benoitf deleted the CHE-16655 branch October 1, 2020 13:34
@che-bot che-bot removed the status/code-review This issue has a pull request posted for it and is awaiting code review completion by the community. label Oct 1, 2020
@che-bot che-bot added this to the 7.20 milestone Oct 1, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sparkoo sparkoo sparkoo approved these changes

@skabashnyuk skabashnyuk skabashnyuk approved these changes

@l0rd l0rd Awaiting requested review from l0rd

@nickboldt nickboldt Awaiting requested review from nickboldt

Assignees
No one assigned
Labels
kind/task Internal things, technical debt, and to-do tasks to be performed.
Projects
None yet
Milestone
7.20
Development

Successfully merging this pull request may close these issues.
4 participants
@benoitf @che-bot @sparkoo @skabashnyuk