SpringOne Platform 2017 Ben Hale, Pivotal From a developer's perspective, running a Java application on Cloud Foundry appears to consist of pushing a compiled artifact and getting a running process. From the platform's perspective though, there's a whole lot more going on. In this talk, the lead developer of the Java Buildpack will walk you through what goes on during application staging and what the buildpack can do for you. It will cover everything from dependency resolution to memory calculation and will even discuss how to integrate with marketplace services with no application configuration.

1. Running Java Applications on
Cloud Foundry
Ben Hale, Lead Cloud Foundry Java Experience
@nebhale
1

2. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Here is my source code
Run it on the cloud for me
I do not care how
2

3. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
But I Do Care How!
It's quite useful to not care how an application runs
most of the time...
...but when things go wrong, it's helpful to know how
an application runs so that you can reason about the
problem.
3

4. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/ 4
Application
(exploded)
Buildpack
Staging Droplet

5. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Staging
• Staging is the act of transforming an application into
a droplet using a buildpack
• An application is the raw content as pushed to Cloud
Foundry
• A droplet is the output of the transformation, including
both a collection of files and a command line
5

6. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Buildpack
• Buildpacks have three phases
• detect
• Should buildpack stage application?
• compile
• Transform filesystem
• release
• Create command line
6

7. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Staging Output
7

8. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Java Buildpack
• The Java Buildpack is designed in a modular way
• Orthogonally divides the three lifecycles into components
• Three component types
• JRE
• Container
• Framework
8

9. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Dependency Resolution
• Most components contribute a dependency
• These dependencies are kept in repositories
accessed via HTTP
• Dependencies are declared with wildcards to ensure
the latest and safest possible versions of
dependencies
9

10. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Dependency Resolution
10

11. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Configuration
• Default configuration is read from config/*.yml
• Configuration can be overridden with
• Environment variables
• Buildpack fork
cf set-env <APP> JBP_CONFIG_OPEN_JDK_JRE
'{ jre: { version: 9.0.+ } }'
11

12. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
JREs
• JREs are responsible for contributing a working JRE
(not JDK) to the filesystem
• Four supported JREs
• OpenJDK, Oracle, IBM, and Azul
• JRE implementations typically contribute a memory
calculator as well
12

13. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
JRE Memory Calculator
• JREs have five major memory regions
• heap, metaspace, thread stacks, direct memory,
code cache
• Memory calculator takes information about the
container sizes, number of classes, and number of
threads and calculates a set of memory flags
13

14. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
JRE Memory Calculator
JVM Memory Configuration: -Xmx369054K -XX:MaxMetaspaceSize=116321K
-XX:ReservedCodeCacheSize=240M -XX:MaxDirectMemorySize=10M -Xss1M
• Formulas are experimentally derived
• Calculates constant "overhead", remainder to heap
• Changes in container size go only to heap
• Override with standard JVM flags
-XX:MaxMetaspaceSize=256M -Xss512k
14

15. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Containers
• Containers are the execution engine for a given
application
• Responsible for gluing everything together and building
command line
• Eight supported containers
• DistZIP, Groovy, Java Main, Play Framework, Spring
Boot, Spring Boot CLI, Tomcat
15

16. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Java Main
• The preferred container
• Must have a META-INF/MANIFEST.MF with Start-
Class defined
• Most flexible container
• Preferred because we provide the JRE, you provide
and configure the runtime
16

17. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Tomcat Container
• Most commonly used because so many migrated
applications are WARs
• Provide a Tomcat configuration optimized to work in
CF
• Various methods for configuring that Tomcat, but
none are as convenient as embedding Tomcat within
your application
17

18. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
DistZip Container
• The output format of Gradle Applications
• Start scripts, lib/ directory
• Many frameworks create this format
• Acts as a catch-all for most other Java frameworks
18

19. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Frameworks
• Frameworks are all other integrations with the buildpack
• They can range from contributing APM agents to enabling
hot code reloading
• 27 (and growing) Supported Frameworks
• AppDynamics, AspectJ, Client Certificate, Container
Customizer, Container Security Provider, Contrast Security,
Debug, Dyadic EKM, Dynatrace, Google Stackdriver, ...
19

20. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Service Integration
• The most common use of frameworks is zero-
configuration service integration
• Binding a service declares intent to use, buildpack
notices that intent in order to contribute
dependencies and configure integration
20

21. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
New Relic APM
• Detects a single service who's name label or tag has
newrelic as a substring
• Downloads latest version of agent
• Adds system properties from extracted from service
credentials payload
• Zero user configuration required
21

22. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Container Security Provider
• Detects existence of Diego Instance Identity
• $CF_INSTANCE_CERT and $CF_INSTANCE_KEY
• Downloads latest version of SecurityProvider
• Updates java.security to use SecurityProvider
• Watches for changes to container's mTLS identity and
trust artifacts and updates them in memory without restart
22

23. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Luna HSM Security Provider
• Detects a single service who's name label or tag has
luna as a substring
• Downloads latest version of SecurityProvider
• Adds system properties from extracted from service
credentials payload
• Writes configuration files on disk
• Zero user configuration required, JCE just works
23

24. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Debugger
• Use environment variable to enable debugger
cf set-env <APP> JBP_CONFIG_DEBUG
'{ enabled : true }'
• Adds system properties to start debugging
• User creates ssh tunnel to container and uses standard
remote debugging tools
cf ssh -N -T -L 8000:localhost:8000 <APP>
24

25. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
YourKit Profiler
• Use environment variable to enable profiler
cf set-env <APP> JBP_CONFIG_YOUR_KIT_PROFILER
'{ enabled : true }'
• Adds system properties to start profiler
• User creates ssh tunnel to container and uses YourKit for
real time profiling
cf ssh -N -T -L 10001:localhost:10001 <APP>
25

26. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Now I Know How!
• A buildpack is used to transform an application into
a droplet
• Modifies filesystem (compile)
• Generates command line (release)
26

27. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Now I Know How!
• The Java Buildpack is made up of components
• JREs that contribute a JRE and memory calculator
• Containers the are runtimes for applications
• Frameworks that integrate with external services,
JRE functionality, and more
27

28. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Java Buildpack
• The Java Buildpack's component system is available to
users
• You can fork the buildpack and add your own
functionality
• If broadly applicable, please submit a PR
• Or, just ask! We don't add integrations until someone
asks for them, so open an issue and we'll look at adding
28

29. Learn More. Stay Connected.
https://github.com/cloudfoundry/java-buildpack
29
#springone@s1p