Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

DCSF19 Docker Containers & Java: What I Wish I Had Been Told

378 views

Published on

Mohammed Aboullaite, xHub

Nowadays, containers are more than a cool new tool to play with - they've revolutionized the way we develop, architect and ship software and have become part of our day-to-day operations. On the other hand, Java has been around for more than 2 decades, dominating the entreprise world. Both advocate the "RUN anywhere" principal, but, is it that easy? No! Your perfect working local container will most probably fail on production because of MEMORY &/or CPU issues, since jvm apps assume they OWN the server they are running on.

This session will look at the gotchas of running JVM apps in containers & how to avoid costly pitfalls. We will cover:

_ what updates Java 10 brought to the table to improve container awareness and the issues related to prior versions, including how to address each one of them to avoid the mess.

- tips and tricks to obtain smaller images & best practices while writing your DockerFiles

- some plugins to helps non-containers experts integrate docker in their development process; and

- the concept of "Distroless" Docker Images and how to benefit from it.

Published in: Technology
  • Be the first to comment

DCSF19 Docker Containers & Java: What I Wish I Had Been Told

  1. 1. Docker containers & java What I wish I’ve been told!
  2. 2. Mohammed Aboullaite @laytoun Deputy CTO - xHub Docker containers & java!
  3. 3. Hi, I’m Fero!
  4. 4. Agenda ● Java in containers … a good idea ? ● Creating effective Java Docker Images: smaller, faster, secure. ● Tools and libraries: build, versioning, testing ● Going to production … what we should know !? ● Java & Docker Container features
  5. 5. Containers are everywhere!
  6. 6. Even if you don’t run containers … You’re in a container! You’re always in a container!
  7. 7. Docker Containers & Java
  8. 8. First try...
  9. 9. Your Java Runtime... ● Oracle JDK ● OpenJDK builds by Oracle ● AdoptOpenJDK builds ● AdoptOpenJDK OpenJ9 builds ● Linux (Red Hat, Debian, Fedora, Arch, Ubuntu) OpenJDK builds ● Azul Zulu ● Amazon Corretto ● SAP SapMachine ● Liberica from Bellsoft https://blog.joda.org/2018/09/time-to-look-beyond-oracles-jdk.html
  10. 10. Image size Java • Java Modularity • Code refactoring • Dependencies Docker • Smaller base image • Layers & Caching (dockerfilelint) • Clean up right away • Dockerignore (faster builds) • Multistage Build • docker-squash https://docs.docker.com/develop/develop-images/dockerfile_best-practices/
  11. 11. Did someone say alpine ?! Lightweight Linux distribution based on musl libc and busybox Project Portola: https://openjdk.java.net/projects/portola/
  12. 12. Did someone say alpine ?!
  13. 13. Java docker image size
  14. 14. Distroless Container Image “Distroless" images contain only your application and its runtime dependencies. They do not contain package managers, shells or any other programs you would expect to find in a standard Linux distribution.” ● Built using Google’s bazel tool ● Provide stripped down base image ● Support for: Java, Golang, Dotnet, Node, Python, C https://github.com/GoogleContainerTools/distroless
  15. 15. Why should I care ?! ● Effective tracking: Improves the signal to noise of scanners (e.g. CVE) ● Time and cost: Faster updates, less network costs ● Security: Less components that can be exploited and smaller attack surface Tips and tricks from Docker captains
  16. 16. Fast startup Java • Java 11 • Class-Data Sharing: since java 5 • Ahead-Of-Time compilation: since java 9 • Native image build: Graal VM
  17. 17. Demo https://github.com/aboullaite/java-docker
  18. 18. Containers are the executables of the cloud!
  19. 19. But ... Java jam jam Java
  20. 20. Maven ● fabric8-maven-plugin (Fabric8) ● dockerfile-maven-plugin (spotify) ● Maven exec plugin (Not elegant!) Maven fabric8 docker maven Maven spotify docker maven spotify docker client Maven maven exec
  21. 21. Gradle ● Docker Gradle Plugin (Benjamin Muschko) ● Docker Gradle Plugin (palantir) ● Docker Gradle Plugin (Transmode) Gradle palantir gradle docker Gradle Transmode gradle docker Docker java client Gradle Benjamin gradle docker Docker java client
  22. 22. Google Jib Fast for incremental builds Daemonless Pure Java Reproducible Maven and Gradle Support
  23. 23. What it does ... FROM gcr.io/distroless/java COPY target/dependencies /app/dependencies COPY target/resources /app/resources COPY target/classes /app/classes ENTRYPOINT java -cp /app/dependencies/*:/app/resources:/app/classes my.app.Main
  24. 24. Image versioning ● Docker Tag command (Semver, Calver, ...) ● Append build number ○ https://www.mojohaus.org/buildnumber-maven-plugin/ ● Git commit hash ○ https://github.com/git-commit-id/maven-git-commit-id-plugin
  25. 25. Security ● Know what in your container ● Vulnerability scanning (Docker EE, Microscanner, Clair, ...) ● Docker Content Trust ● Least privilege ○ Change USER ○ Read-only filesystems ○ Limit ressources ● Minimal container OS (Minimal attack surface) ● Monitoring & Auditing Tips and tricks from the captains session
  26. 26. How about (Integration) testing! ● Real world isolated testing ● Can be run during development ● Reproducible ● As real as possible (databases, brokers, ...) ● Cross platform ● Spot issues before they appear in prod ● Easy to run & maintain!!!
  27. 27. TestContainers ● Java library ● Supports of JVM testing framework (JUnit, Spock, ...) ● Provides lightweight, throwaway instances of common databases ● Port randomisation ● Containers Cleanup on JVM shutdown GenericContainer redis = new GenericContainer( "redis:3.0.6") .withExposedPorts( 6379);
  28. 28. Let’s go to (pre-)production! ● Petclinic: Spring App ● Modernizing legacy app with containers ● Optimizing resources ● Easy scaling ● Cloud ready ● Orchestration
  29. 29. Demo https://github.com/aboullaite/java-docker
  30. 30. Epic fail!
  31. 31. A brief history of containers & ... Container Runtime and Image Format Standards - Jeff Borek & Stephen Walli - KubeCon 2017
  32. 32. … & Java! zeroturnaround - A Short History of Nearly Everything Java https://zeroturnaround.com/rebellabs/a-short-history-of-nearly-everything-java/
  33. 33. JVM ergonomics The JVM has plenty of ergonomics which are based on the underlying system ● Memory ● # CPUs ● Exact CPU model ● Garbage collector ● JIT Optimizations ⇒ -XX:+PrintFlagsFinal -XX:+PrintGCDetails https://docs.oracle.com/javase/8/docs/technotes/guides/vm/gctuning/ergonomics.html
  34. 34. Memory Eden Tenured Permanent / Metaspace S0 S1 Young generation Old generation Permanent generation Heap Off Heap
  35. 35. CPU ● VM internal thread pools ● fork/join pool (Streams API) ● Core.asynk ● Elasticsearch ● Tomcat ● Jetty ● Netty ● Wildfly ● ... Runtime.getRuntime().availableProcessors()
  36. 36. Java 8u121 and before … forget about it!
  37. 37. Fabric8 got it right https://github.com/fabric8io-images/run-java-sh
  38. 38. java 9, 8u131 ● -XX:ParallelGCThreads and -XX:CICompilerCount are set based on Containers CPU limits (can be overridden) ○ calculated from --cpuset-cpus ● Memory Configuration ○ -XX:+UnlockExperimentalVMOptions ○ -XX:+UseCGroupMemoryLimitForHeap ○ set -XX:MaxRAMFraction to 2 (default is 4)
  39. 39. Java 10+ & 8u191 + More container awareness ● Improve heap memory allocations [JDK-8196595]: ○ -XX:InitialRAMPercentage, -XX:MaxRAMPercentage and -XX:MinRAMPercentage ○ -XX:InitialRAMFraction, -XX:MaxRAMFraction, and -XX:MinRAMFraction are Deprecated ● The total number of CPUs available to the Java process is calculated from --cpus, --cpu-shares, --cpu-quota [JDK-8146115] ○ Use -XX:-UseContainerSupport to return to the old behavior ○ # processors that the JVM will use internally -XX:ActiveProcessorCount ● Attach in linux became be relative to /proc/pid/root and namespace aware (jcmd, jstack, etc)
  40. 40. Java 11 More container awareness ● Removes -XX:+UnlockExperimentalVMOptions, -XX:+UseCGroupMemoryLimitForHeap [JDK-8194086] ● jcmd -l and jps commands do not list JVMs in Docker containers [JDK-8193710] ● Container Metrics (-XshowSettings:system) [JDK-8204107] ● Update CPU count algorithm when both cpu shares and quotas are used [JDK-8197867] ○ -XX:+PreferContainerQuotaForCPUCount
  41. 41. JVM Troubleshooting & Monitoring ● Built-in tools by JVM: ○ jstat ○ jcmd ○ jmap (Not recommended) ○ jhat … ● Expose JMX port ○ VisualVM ○ jConsole ● Micrometer ● Others: New Relic, Stackify, AppDynamics, Dynatrace... ● Docker commands ○ stats ○ inspect ○ top ● Container aware tools ○ ctop ○ dstat ● CAdvisor ● Prometheus ● Docker EE, Datadog, Sysdig, ...
  42. 42. Key takeaways ● Java <3 Docker ● Start your java 11 journey (or at least 8u191+) ● Java has a rich ecosystem ● Know your tools: ○ Build Custom JRE ○ CDC ○ AOP ○ GraalVM & Substrate VM
  43. 43. Hallway Track Thank you! hallwaytrack.dockercon.com/h allway-tracks/41300/ Wednesday May 1st at 2:00 pm @laytoun

×