ghcr.io/openzipkin/java is a minimal OpenJDK Alpine Linux image.

GitHub Container Registry: ghcr.io/openzipkin/java includes:

• master tag: latest commit
• MAJOR.MINOR.PATCH tag: release corresponding to a Current OpenJDK Version

Tags ending in -jre include only a JRE where unqualified tags include the full JDK, Maven, and a few build utilities.

Using this image

This is an internal base layer primarily used in zipkin.

To try the image, run the java -version command:

$ docker run --rm ghcr.io/openzipkin/java:21.0.5_p11 -version
openjdk version "21.0.4" 2024-07-16
OpenJDK Runtime Environment (build 21.0.4+7-alpine-r0)
OpenJDK 64-Bit Server VM (build 21.0.4+7-alpine-r0, mixed mode, sharing)

Release process

Make sure you are on the right branch. If there is a branch prefixed JDK, it may have workarounds applied for the version in question. The master branch is always operable for the latest LTS JDKs that don't need workarounds.

Also, make sure you are using an LTS JDK. Any non-LTS would be an exception basis and are unlikely to be consumed by Zipkin (primary reason for this repo).

Make sure the Dockerfile has docker_parent_image set to the Current Alpine Version. If the image doesn't yet exist, release it here before continuing. Notably, this avoids missing CVE fixes by mistake.

Build the Dockerfile using the current version without the revision classifier from here:

• https://pkgs.alpinelinux.org/packages?name=openjdk21

# Note 21.0.5_p11 not 21.0.5_p11-r2!
./build-bin/build 21.0.5_p11

Next, verify the built image matches that version:

$ docker run --rm openzipkin/java:test -version
openjdk version "21.0.5" 2024-10-15
OpenJDK Runtime Environment (build 21.0.5+11-alpine-r0)
OpenJDK 64-Bit Server VM (build 21.0.5+11-alpine-r0, mixed mode, sharing)

To release the image, push a tag matching the arg to build-bin/build (ex 21.0.5_p11). This triggers a GitHub Actions job to push the image.

java.lang.ClassNotFoundException

The image ending in -jre is stripped to only retain the minimal modules needed by Zipkin. This is to make it as small as possible. If the zipkin or zipkin-slim images fail with a java.lang.ClassNotFoundException, it may be related to the modules linked in the Dockerfile.

If the package begins with java., sun. or com.sun., it is likely a JRE module. To verify, use javap without any other options. If a result is printed, you need to link a corresponding module.

For example, here's the result of javax.sql.rowset.serial.SerialException, which is in the module java.sql.rowset:

$ javap javax.sql.rowset.serial.SerialException
Compiled from "SerialException.java"
public class javax.sql.rowset.serial.SerialException extends java.sql.SQLException {
  static final long serialVersionUID;
  public javax.sql.rowset.serial.SerialException();
  public javax.sql.rowset.serial.SerialException(java.lang.String);
}

CVEs

This builds JDK and JRE images over our Alpine Linux base layer. If you have any platform CVEs that relate to the Alpine version, check there first and cut a new version as necessary.

Specifically, this adds Alpine's OpenJDK package as well as Maven (to reduce image layers). If there is a concern about CVEs, check to see if there is a newer JDK available and release it.

If the most recent has CVEs and the corresponding patch isn't yet released, check the issues list. You may find another issue already, and if not you can make one with context. Sites who have needs that cannot be met by open source support might consider building their own Java image and adding zipkin to that directly.