Follow

New post: Using jlink to cross-compile minimal JREs

jakewharton.com/using-jlink-to

I've been doing this inside Docker containers for a while to keep their size down, but recently needed it to target an embedded Linux ARM device with only 100MiB of storage.

@jw I tried that for some service we're deploying to kubernetes at work. It took far too much trial and error for me to feel safe that I didn't miss anything (to a point I ran into bugs of jlink in JDK16 or 17 can't remember exactly), and I decided it wasn't worth the effort. Yes, it reduces the attack surface due to less code, and there's faster download.. but do people really go the extra mile for Docker images?

I don't think you absolutely have to, but it takes some of my images from being 140MiB to 40MiB which is a nice reduction. The only problems I've really had are libraries which cause needless modules to be kept. But I suspect it varies based on the libraries you use and how much reflection/unsafe magic they're doing. I certainly have had more success with jlink than I've had with Graal native-image.

@jw IIRC it was sth like jetty not mentioning it required crypto for SSL (you'll realize at runtime) and one would need to stop Jackson pulling in things like sql and the desktop module because of java.bean residing there.

@oliver__t Yeah libraries with heavy usage of reflection or which try to conditionally adapt to the JDK do not always communicate clearly to the jdeps tool. It's easy enough to add an explicit entry, but I actually ended up swapping out Jetty because my service was very low throughput. Obviously not everyone has such freedoms.

Sign in to participate in the conversation
Mastodon

This server is a place for Jake Wharton. Are you Jake Wharton? This is your place. Are you not Jake Wharton? Well, at least you can find him here.