close

Filter

loading table of contents...

Deployment Manual / Version 2110

Table Of Contents

2.1.3.1 Building Distroless Images

For Kubernetes deployments, it might be interesting to build distroless images. These are images, that contain only the JVM and the application but no shell. These images are by nature more secure. To build a distroless image, a second Maven profile should be added:

    <profile>
      <id>distroless-image</id>
      <properties>
        <jib.skip>false</jib.skip>
        <application.image-base>gcr.io/distroless/java@sha256:65aa73135827584754f1f1949c59c3e49f1fed6c35a918fadba8b4638ebc9c5d</application.image-base> 1
      </properties>
      <build>
        <plugins>
          <plugin>
            <groupId>com.google.cloud.tools</groupId>
            <artifactId>jib-maven-plugin</artifactId>
            <configuration>
              <container>
                <jvmFlags> 2
                  <jvmFlag>-XX:+UseParallelGC</jvmFlag>
                  <jvmFlag>-XX:+ExitOnOutOfMemoryError</jvmFlag>
                  <jvmFlag>-XX:MinRAMPercentage=45.0</jvmFlag> 3
                  <jvmFlag>-XX:MaxRAMPercentage=85.0</jvmFlag> 4
                  <!--
                   | <jvmFlag>-XX:+HeapDumpOnOutOfMemoryError</jvmFlag>
                   | <jvmFlag>-XX:HeapDumpPath=/tmp/app.hprof</jvmFlag>
                  -->
                </jvmFlags>
              </container>
            </configuration>
          </plugin>
        </plugins>
      </build>
    </profile>

1

go to https://console.cloud.google.com/gcr/images/distroless/GLOBAL/java and pick a hash

2

When building a distroless based image, there is only the JVM included and only environment variables and jvm flags are supported.

3

In Kubernetes the JVM memory is controlled by Kubernetes. In order to allow that, we need to define the upper and lower bound of the allocated pod memory using MinRAMPercentage and MaxRAMPercentage.

Search Results

Table Of Contents
warning

Your Internet Explorer is no longer supported.

Please use Mozilla Firefox, Google Chrome, or Microsoft Edge.