Skip to content

Commit 075b1dc

Browse files
jbachorikclaude
jbachorik
and
claude
committed
ci: replace Liberica OpenJDK base images with debian:bullseye-slim + SDKMAN
Replace vendor-specific bellsoft/liberica-openjdk-* images with debian:bullseye-slim (Debian 11, glibc 2.31) for glibc builds and eclipse-temurin:21-jdk-alpine for musl builds. All images pinned by sha256 digest for reproducibility. JDK 21 (Temurin 21.0.3) and Maven are installed at image-build time via SDKMAN, keeping glibc 2.31 as the build baseline so produced native binaries require only glibc >=2.31 at runtime. Removes libclang-rt-dev (Ubuntu-only package) and maven from apt installs; maven pulled in default-jre-headless (Java 11) which would shadow the SDKMAN-managed JDK 21. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent d8238bd commit 075b1dc

File tree

3 files changed

+20
-10
lines changed

3 files changed

+20
-10
lines changed

‎.gitlab/base/Dockerfile‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
1-
ARG BASE_IMAGE=openjdk:11-slim-buster
1+
ARG BASE_IMAGE=debian:bullseye-slim@sha256:0083feb8da4f624e3a0245e7752af2517d4b81d8b8db50c725644672a132a31b
22
FROM ${BASE_IMAGE} as base
33
ARG CI_JOB_TOKEN
44
WORKDIR /root
55

66
RUN mkdir -p /usr/share/man/man1 # https://github.com/debuerreotype/docker-debian-artifacts/issues/24
7-
RUN (apt update && DEBIAN_FRONTEND=noninteractive apt install -y --no-install-recommends curl git moreutils awscli amazon-ecr-credential-helper gnupg2 npm build-essential wget bsdmainutils clang libclang-rt-dev jq zip unzip maven) || true
7+
RUN (apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends curl git moreutils awscli amazon-ecr-credential-helper gnupg2 npm build-essential wget bsdmainutils clang jq zip unzip) || true
88
RUN (apk update && apk add curl git moreutils aws-cli docker-credential-ecr-login gnupg alpine-sdk build-base wget npm hexdump linux-headers clang compiler-rt bash jq gradle zip unzip) || true
9+
# Install JDK 21 and Maven via SDKMAN when the base image does not bundle one (e.g. debian:bullseye-slim)
10+
RUN (command -v java >/dev/null 2>&1) || (curl -s "https://get.sdkman.io" | bash && bash -c "source /root/.sdkman/bin/sdkman-init.sh && sdk install java 21.0.3-tem && sdk install maven")
911
RUN npm install -g --save-dev @datadog/datadog-ci
1012
RUN rm -rf "/var/lib/apt/lists/*"

‎.gitlab/build-deploy/images.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,14 @@ stages:
22
- images
33
variables:
44
# Base images for the build docker images
5-
OPENJDK_BASE_IMAGE: bellsoft/liberica-openjdk-debian:21
6-
OPENJDK_BASE_IMAGE_ARM64: bellsoft/liberica-openjdk-debian:21-aarch64
7-
OPENJDK_BASE_IMAGE_MUSL: bellsoft/liberica-openjdk-alpine-musl:21
8-
OPENJDK_BASE_IMAGE_ARM64_MUSL: bellsoft/liberica-openjdk-alpine-musl:21
5+
# debian:bullseye-slim = Debian 11 (glibc 2.31); pinned by digest for reproducibility.
6+
# Multi-arch manifest covers both amd64 and arm64 — no separate arm64 tag needed.
7+
# JDK 21 is installed at image-build time via SDKMAN (see .gitlab/base/Dockerfile).
8+
OPENJDK_BASE_IMAGE: debian:bullseye-slim@sha256:0083feb8da4f624e3a0245e7752af2517d4b81d8b8db50c725644672a132a31b
9+
OPENJDK_BASE_IMAGE_ARM64: debian:bullseye-slim@sha256:0083feb8da4f624e3a0245e7752af2517d4b81d8b8db50c725644672a132a31b
10+
# eclipse-temurin:21-jdk-alpine = Alpine 3.x musl; arm64 manifest confirmed present.
11+
OPENJDK_BASE_IMAGE_MUSL: eclipse-temurin:21-jdk-alpine@sha256:c98f0d2e171c898bf896dc4166815d28a56d428e218190a1f35cdc7d82efd61f
12+
OPENJDK_BASE_IMAGE_ARM64_MUSL: eclipse-temurin:21-jdk-alpine@sha256:c98f0d2e171c898bf896dc4166815d28a56d428e218190a1f35cdc7d82efd61f
913
BASE_IMAGE_LIBC_2_17: centos:7
1014

1115
DOCKER_IMAGE: 486234852809.dkr.ecr.us-east-1.amazonaws.com/images/docker:24.0.4-gbi-focal

‎.gitlab/config.env‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,14 @@ JAVA_TEST_VERSION=21.0.3-tem
1010
JAVA_BENCHMARK_VERSION=21
1111

1212
# Docker Base Images
13-
OPENJDK_BASE_IMAGE_AMD64=bellsoft/liberica-openjdk-debian:21
14-
OPENJDK_BASE_IMAGE_ARM64=bellsoft/liberica-openjdk-debian:21-aarch64
15-
OPENJDK_BASE_IMAGE_AMD64_MUSL=bellsoft/liberica-openjdk-alpine-musl:21
16-
OPENJDK_BASE_IMAGE_ARM64_MUSL=bellsoft/liberica-openjdk-alpine-musl:21
13+
# debian:bullseye-slim = Debian 11 (glibc 2.31); pinned by digest for reproducibility.
14+
# Multi-arch manifests cover both amd64 and arm64.
15+
# JDK 21 is installed at image-build time via SDKMAN (see .gitlab/base/Dockerfile).
16+
OPENJDK_BASE_IMAGE_AMD64=debian:bullseye-slim@sha256:0083feb8da4f624e3a0245e7752af2517d4b81d8b8db50c725644672a132a31b
17+
OPENJDK_BASE_IMAGE_ARM64=debian:bullseye-slim@sha256:0083feb8da4f624e3a0245e7752af2517d4b81d8b8db50c725644672a132a31b
18+
# eclipse-temurin:21-jdk-alpine = Alpine 3.x musl; arm64 manifest confirmed present.
19+
OPENJDK_BASE_IMAGE_AMD64_MUSL=eclipse-temurin:21-jdk-alpine@sha256:c98f0d2e171c898bf896dc4166815d28a56d428e218190a1f35cdc7d82efd61f
20+
OPENJDK_BASE_IMAGE_ARM64_MUSL=eclipse-temurin:21-jdk-alpine@sha256:c98f0d2e171c898bf896dc4166815d28a56d428e218190a1f35cdc7d82efd61f
1721

1822
# AWS Configuration
1923
AWS_REGION=us-east-1

0 commit comments

Comments
 (0)