Java poses some interesting challenges when running inside of a container. Is the default memory chosen based on the container limits or actual limits of the box? What does it mean to give a JVM a partial share of a processor? Does it ever make sense to run a parallel garbage collector on a single processor container? What are the issues with checkpointing a JVM that you don't have when checkpointing a more generic Linux container? Is GraalVM the right choice for my application? We'll explore these issues and more.

1. 1
Java and Containers:
Christine H. Flood
Senior Principal Software Engineer
What’s there to Think About?

2. 2
Adventures with Containers
for JVM Hackers
Christine H. Flood
Senior Principal Software Engineer

3. 3
Evolution of Java (1990s)
Safe Duke

4. 4
Evolution of Java (2000s)
Fast Duke

5. 5
Evolution of Java (2010s)
Smooth Duke

6. 6
Evolution of Java (2020s)
Packed Duke

7. 7
What are we optimizing for now?
Smaller Footprint
Faster Startup
Smaller Image Size

8. 8
Command Line Parameters
Smaller Footprint Old School
-XX:+UseSerialGC
SerialGC has lower overhead than any of the other collectors
-XX:MinHeapFreeRatio
Default is 40 <=> Grow the heap if occupancy is > 60%
Recommend 20
-XX:MaxHeapFreeRatio
Default is 70 <=> Shrink the heap if occupancy is < 30%
Recommend 40
-XX:GCTimeRatio
Default is 99 <=> Target 1% of time in GC
Recommend 4 <=> 25%
-XX:AdaptiveSizePolicyWeight
Default is 10 <=> Scale of 0 to 100
Recommend 90

9. 9
Command Line Parameters
Smaller Footprint Old School
-XX:+UnlockDiagnosticVMOptions
-XX:NativeMemoryTracking=”summary”
-XX:+PrintNMTStatistics These options will print out the non-heap memory usage of your JVM.
-Xss228k This will decrease the size of your Java Stacks. The default is 1024.
java -XX:+UnlockDiagnosticVMOptions -XX:+PrintFlagsFinal -version

10. 10
Containerized TestRandom
FROM openjdk:16
WORKDIR /
Add TestRandom.class TestRandom.class
CMD ["java" , "-XshowSettings:system", "TestRandom", "100000", "10000000000"]
podman build -f OpenJDKDockerFile -t openjdk
podman run openjdk

11. 11
-XshowSettings:system
Operating System Metrics:
Provider: cgroupv2
Effective CPU Count: 8
CPU Period: -1
CPU Quota: -1
CPU Shares: -1
List of Processors: N/A
List of Effective Processors: N/A
List of Memory Nodes: N/A
List of Available Memory Nodes: N/A
Memory Limit: Unlimited
Memory Soft Limit: 0.00K
Memory & Swap Limit: Unlimited

12. 12
TestRandom 5 100
20
20
20
20
20

13. 13
What Can We Do?
Command Line Parameters
Checkpoint/Restore
SubstrateVM

14. 14
Checkpoint/Restore
Copies entire container to disk and can quickly restore it.
Avoids class initialization.
Can checkpoint after JIT is warmed up, classes are loaded, heap is fully gc’d.

15. 15
Checkpoint/Restore
sudo podman build -f OpenJDKDockerFile -t openjdk
sudo podman run openjdk
sudo podman container checkpoint -l
Stops the container
sudo podman container restore -l
Restarts the container

16. 16
Checkpoint/Restore
Doesn’t currently work with Fedora 31 due to Cgroups V2.
sudo dnf install grubby
sudo grubby --update-kernel=ALL –args="systemd.unified_cgroup_hierarchy=0"
Reboot
To run with Cgroups V1

17. 17
SubstrateVM
FROM quay.io/quarkus/ubi-quarkus-mandrel:20.2-java11
WORKDIR /tmp
ADD TestRandom.class TestRandom.class
RUN native-image -H:+ReportExceptionStackTraces -H:Name=TestRandom.out -H:Class=TestRandom.class TestRandom
RUN chmod +x /tmp/TestRandom.out
ENTRYPOINT ["/tmp/TestRandom.out", "10000", "1000000000"]
And then
Podman build -f MyDockerFile -t mydockerimage
Podman run mydockerimage
Or
podman run -v ./:/project:z --env LANG=C --user 1000:1000 --userns=keep-id --rm quay.io/quarkus/ubi-quarkus-mandrel:20.1-java11 -H:
+ReportExceptionStackTraces -H:Name=./TestRandom3.out -H:Class=./TestRandom.class TestRandom

18. 18
SubstrateVM vs OpenJDK
/usr/bin/time podman run nativeimage
Testing random number generator with upper bound = 10000 and sample size 1000000000
Max bin size = 101185 Min bin size = 10000 median bin size = 100000.0
0.11user 0.04system 0:28.63elapsed 0%CPU (0avgtext+0avgdata 58488maxresident)k
0inputs+656outputs (0major+9497minor)pagefaults 0swaps
[/usr/bin/time podman run openjdkbig
Testing random number generator with upper bound = 10000 and sample size 1000000000
Max bin size = 101305 Min bin size = 10000 median bin size = 100000.0
0.15user 0.05system 0:25.69elapsed 0%CPU (0avgtext+0avgdata 58388maxresident)k
0inputs+656outputs (0major+9500minor)pagefaults 0swaps

19. 19
Podman ps
[chf@dhcp111 containers]$ podman ps -as
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES SIZE
b83a9c004dd0 localhost/nativeimage:latest ./TestRandom.out ... 47 seconds ago Up 47 seconds ago relaxed_torvalds 0B (virtual 1.74GB)
ccbdb549ecf3 localhost/openjdkbig:latest java TestRandom 1... 51 seconds ago Exited (0) 23 seconds ago priceless_herschel 0B (virtual
502MB)

20. 20
Questions I didn’t address
What does it mean if you give podman constraints that the JVM doesn’t understand
Partial Share of a Processor
Run ParallelGC on a Single processor

21. 21
Contact Info
CHF@Redhat.com

22. CONFIDENTIAL Designator
linkedin.com/company/red-hat
youtube.com/user/
RedHatVideos
facebook.com/redhatinc
twitter.com/RedHat
22
Thank you
Red Hat is the world’s leading provider of
enterprise open source software solutions.
Award-winning support, training, and
consulting services make
Red Hat a trusted adviser to the Fortune 500.