CON4429 - Java in a World of Containers [email protected] @PaulSandoz [email protected] Director, Java Virtual Machine @MiKaelVidstedt Copyright © 2017, Oracle and/or its affiliates. All rights reserved. 1 Agenda Producing images and running containers with JDK 9 Size analysis of JDK DocKer Images A quicK looK at startup me Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 2 Java 8 DocKer image • Official Java 8 SE (Server JRE) available on the docKer store • See also DockerFiles on GitHub Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 3 In a world of containers we expect… • Many distribuTons of Java runTmes • Forces that push towards – Smaller images – Faster execuTon using less resources (and respecTng resource constraints) Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 4 Java has plans for a world of containers • Official OpenJDK builds will make it easier to distribute Java runTmes • Java 9 tooling can produce custom Java runTmes that are smaller • Current and future Java tooling will produce applicaon-specific Java runTmes that startup faster Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 5 Producing DocKer images with a JDK • Very easy to create a DockerFile that copies (or adds) a tarball of a JDK – A resulTng DocKer image will be large (> 300MB) • Not necessarily good for development or execuTon – More stuff than required to build or run an applicaon Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 6 JDK 9 is modular • JDK 9 is modular and introduces modules to the Java plaorm • A module is a set of pacKages designed for reuse • Modules improve the reliability and maintainability of your programs • JDK 9 is itself composed of 79 modules Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 7 JDK 9 and custom Java runTmes • JDK 9 comes with jlink, a tool that can create custom Java runTmes – Such as, a Java runTme consisTng of just the java.base module • Note: the Java applicaon need not be modular Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 8 Project Portola and Alpine Linux • The OpenJDK Portola Project aims to provide a port of the JDK to the Alpine Linux distribuTon • Early access builds of the JDK port are available • jlink can be used to create custom Java runTmes for Alpine Linux Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 9 Demo Crea%ng Docker images with Alpine Linux, Java, and jlink Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 10 Running JDK 9 in DocKer containers • The JDK has not necessarily been a model ciTzen and respecTng resource constraints when running in a container • JDK 9 has a few improvements to respect resource constraints – These improvements have been bacK ported to a JDK 9 release Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 11 RespecTng memory limits • The JDK respects group memory limits set for the container (see docker run memory constraints) -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 12 RespecTng CPU constraints • The JDK respects some CPU constraints set for the container (see docker run cpuset constraint) • java.lang.Runtime.availableProcessors reports correct number of CPUs Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 13 Stable execuTon • The JVM ensures stable execuTon when resources change • G1 Garbage Collector operates on acTve CPU count discovered at JVM startup Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 14 Ongoing improvements planned for future releases • JDK-8146115 “Improve Docker container detecTon and resource configuraon usage” • More robust container detecTon logic – Evaluang support for further docKer run flags --cpus --cpu-quota --cpu-period --cpu-shares • New -XX:ActiveProcessorCount flag • Total and Avail memory extracted from cgroup /proc file system Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 15 Ongoing improvements planned for future releases • JDK-8186248 “Allow selecTng Heap % of available RAM” • Dra JEP: Container aware Java hp://openjdK.java.net/jeps/8182070 – Provide Java API access to container metrics Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 16 Demo Running Java (jshell), in a docker container, and respec%ng resource constraints Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 17 For a more comprehensive demonstraon… • See tutorial on running and monitoring a Java applicaon in a Kubernetes cluster • DocKer images can be created and published using Wercker Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 18 Size Analysis Viewer discreon advised: Bar charts ahead! Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 19 DocKer Image • DocKer image using DockerFile 800 568 – FROM oraclelinux:7 JDK 700 oraclelinux:7 – ADD jdK-9+181-linux-x64_bin.tar.gz 600 500 400 • Let’s opTmize! Size (MB) 300 200 229 100 0 Full JDK Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 20 Streamlining the JRE using jlinK • Full JDK – Default JDK (not jlinK:ed) 800 568 • JDK java.base 700 oraclelinux:7 – jlink —add-modules java.base 600 • “ney” 500 – A set of modules expected to be sufficient for many Java applicaons 400 • jlink --add-modules Size (MB) 300 java.base, 60 46 java.logging, java.management, 200 229 229 229 java.xml, jdk.management, 100 jdk.unsupported 0 – Note: Does not include the nery Full JDK “netty” java.base applicaon code! Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 21 Streamlining the base image 800 oraclelinux:7 vs oraclelinux:7-slim 568 700 568 JDK 600 • oraclelinux:7 (229 MB) Base – Contains Everything™ …and then 500 some 400 Size (MB) 300 – Certainly more than Java needs 46 60 200 229 229 229 • 46 60 oraclelinux:7-slim (118 MB) 100 118 118 118 – Streamlined to bare necessiTes 0 – Saves 111 MB • Further opTmizaon - Strip out oraclelinux:7 + “netty” oraclelinux:7 + Full JDK oraclelinux:7 + java.base oraclelinux:7-slim + “netty” individual files oraclelinux:7-slim + Full JDK oraclelinux:7-slim + java.base – Analyze shared libraries/dependency graph and strip out unneeded files Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 22 Small. Simple. Secure. Alpine Linux is a security-oriented, lightweight Linux distribuTon based on musl libc and busybox. – hrps://www.alpinelinux.org Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 23 DocKer Base Images Docker base image sizes 300 275 250 225 229 200 175 150 Size (MB) 125 100 117.6 75 50 25 3.966 0 oraclelinux:7 oraclelinux:7-slim alpine:3.6 Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 24 Java Images Based on alpine:3.6 400 350 300 JDK alpine:3.6 250 200 Size (MB) 150 100 50 0 Full JDK java.base “netty” Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 25 OpTmizing java.base with jlinK opTons 50 • default: no special opTons 46 JDK 45 alpine:3.6 • --compress=2 40 35 34 – ZIP compression of resources 31 30 • --strip-debug 25 – Remove all debug informaon Size (MB) 20 – Don’t try this at home! 15 10 5 4 4 4 0 default —compress=2 —compress=2 —strip-debug Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 26 …but wait, there’s more! • What’s the theoreTcal minimum? • What’s actually in a java.base JRE? Files Size (bytes) lib/modules 23,529,047 lib/server/libjvm.so 21,197,904 <other files> 1,545,818 Sum 46,272,769 Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 27 JVM Size Note: Numbers/sizes are approximate Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 28 JVM Size – JIT Compiler(s) Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 29 JVM Size – GC(s) Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 30 JVM Size – Let’s Keep one GC: Serial Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 31 JVM Size - Other Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 32 The “minimal” VM • The “minimal” VM weighs in at just Size of JVM variants 25.0 under 5MB – STll fully Java compliant 20.0 • But 15.0 – LacKs many/most of the addiTonal features Size(MB) 10.0 • No JIT compiler • Only Serial GC 5.0 • Very few debugging/serviceability features 0.0 server minimal • Probably not a good match for producTon use-cases, but an interesTng data point Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 33 A “minimal” DocKer image • HelloWorld in ~20MB – Including the Alpine base image “minimal” VM + java.base 40.0 • More extreme Java runTmes JDK 25.3 libjvm.so available can bring this down even 30.0 alpine:3.6 further (with some limitaons) – SubstrateVM from Oracle Labs 20.0 12.9 10.5 Size (MB) 10.0 4.8 4.8 4.8 4.0 4.0 4.0 0.0 default —compress=2 —strip-debug Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 34 Future: Stripping out unused classes • Not every class in a module is necessarily used by the applicaon • Finding out which classes to use is non-trivial #classes Size (bytes) – Indeterminism (halTng problem) All java.base classes 5714 19,178,884 Classes used by HelloWorld 506 8,796,290 – ReflecTon 9% 46% • Area of research, stay tuned Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 35 Sharing across instances Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | Sharing Across Instances • Micro-services and DocKer encourages running many processes on the same machine • Chances are many instances will be running the exact same applicaon • OS shared libraries allows for sharing nave data • libc, libjvm.so all get shared automacally by the OS & DocKer – Assuming same layer/file/inode • What about Java class data? Copyright © 2017, Oracle and/or its affiliates.