Provide images for openjdk-8u191 (backports from java 10 concerning better docker support)

[ManfredSchenkIOSB]

According to the releasenotes of java 8 update 191 the docker-specific enhancements from java 10 were backported to java 8.

So it would be nice to have an image available which contains this enhanced support.

[yosifkit]

#150 (comment)

[stevespringett]

Yes please. The Alpine image on Docker Hub is still on 8u171 for some reason whereas the debian and other images are all on 8u181. But ideally, 191 would be preferred as I also need some of the backports that improve Docker compatibility.

[ManfredSchenkIOSB]

It seems that the openjdk-docker team is waiting for newer packages to appear in alpine. The alpine team is waiting for newer releases of IcedTea and on the IcedTea site I could not find anything about future releases. Not the best situation now...
The only way for production use seems to be: building even the "lower" images all by ourselves...

[ceeaspb]

Hi @ManfredSchenkIOSB
So I had a look at this also.
It turns out that as at today the alpine images is at 181, and that includes a backport of the container changes from 191 as part of the iced tea 3.9.0 build....
See backports section in http://blog.fuseyism.com/index.php/2018/10/01/security-icedtea-3-9-0-for-openjdk-8-released/

The demo is :

$ docker exec -ti 9ee1b463a218 /bin/sh -c "java -XX:+UnlockDiagnosticVMOptions -XX:+PrintFlagsFinal -version|grep UseContainerSupport"
     bool UseContainerSupport                       = true                                {product}
openjdk version "1.8.0_181"
OpenJDK Runtime Environment (IcedTea 3.9.0) (Alpine 8.181.13-r0)
OpenJDK 64-Bit Server VM (build 25.181-b13, mixed mode)

It should be possible to close this then.

[iperdomo]

The current version of the Debian package 8u181-b13-2~deb9u1 does not contain those changes.

$ docker inspect --format='{{index .RepoDigests 0}}' openjdk:8-jre
openjdk@sha256:44c6cec7f8fb83a9fff3dfd3cf24da20b50af22eb1e40e92a43dde00e6271ff8

$ docker run --rm -ti openjdk:8-jre /bin/sh -c "java -XX:+UnlockDiagnosticVMOptions -XX:+PrintFlagsFinal -version | grep -i UseContainerSupport"
openjdk version "1.8.0_181"
OpenJDK Runtime Environment (build 1.8.0_181-8u181-b13-2~deb9u1-b13)
OpenJDK 64-Bit Server VM (build 25.181-b13, mixed mode)

[ade90036]

@iperdomo , not sure what is the exact image you pulled over-there.

However, i just have tried it myself.

@ceeaspb was right the "UseContainerSupport" is in actual fact included.

The link provided for "IceTea 3.9.0" mentions in their changelog of feature: S8146115 which you can take a look at the details here, which is work around backporting the functionality for "UseContainerSupport"

Test:

docker run -i -t openjdk:8-jre-alpine /bin/sh

and the run:

/ # java -XX:+UnlockDiagnosticVMOptions -XX:+PrintFlagsFinal -version|grep UseContainerSupport
     bool UseContainerSupport                       = true                                {product}
openjdk version "1.8.0_181"
OpenJDK Runtime Environment (IcedTea 3.9.0) (Alpine 8.181.13-r0)

This seems to be fixed on the alpine based images.. not sure for the rest..

Regards

ade

[ghusta]

The details of the issue backported from v10 to v8u191 : JDK-8146115, and mentioning that UseContainerSupport is enabled by default.

[Geethree]

Any updates?

[deleted]

Since this appears to be waiting on icedTea / alpine, is there anything preventing the creation of a debian-based 8u191 image?

Debian appears to have openjdk packaged at 8u191-b12-2

[enrcor01]

When is the debian image gonna be created? Any updates?

[LewisWatson]

Since this appears to be waiting on icedTea / alpine, is there anything preventing the creation of a debian-based 8u191 image?

Debian appears to have openjdk packaged at 8u191-b12-2

8u191-b12-2 appears to only be in debians unstable repository -> https://packages.debian.org/unstable/java/openjdk-8-jre

Stable is still tracking 8u181-b13-2 -> https://packages.debian.org/stable/java/openjdk-8-jre

Interestingly the testing repo has the oldest version 8u171-b11-2 -> https://packages.debian.org/testing/java/openjdk-8-jre

[tompson]

Would be really great to get this!

[yosifkit]

This comment is a little out-of-date, but still applies (we no longer have an openjdk based on sid: #259).

Given the following I would not offer tags based on sid unless there is no other way to offer the main software of the image, ie golang itself.

sid is subject to massive changes and in-place library updates. This can result in a very unstable system which contains packages that cannot be installed due to missing libraries, dependencies that cannot be fulfilled etc. Use it at your own risk!

https://www.debian.org/releases/sid/

The only images that are FROM debian:sid are openjdk:10 and openjdk:11 (and images that build from them) since that was one of the only ways to get the newer jdk without multi-hour compile times (#150 (comment), #237). They are still offered since the new alternative is based on Oracle Linux (#235).

- docker-library/golang#244 (comment)

As for getting 8u191, the reason that it is not available on buster (aka testing) is that it fails to build on 5 different architectures so the automated migration from sid to buster is on hold until that is addressed (see the "testing migrations" https://tracker.debian.org/pkg/openjdk-8). Most likely that will be fixed by the time buster is released later this year as the new stable (no date yet). Until then, there is little we can do for the images here. Users are free to adapt the Dockerfiles to use sid for their own use.