New Java SCC causing problems.

[jdmcclur]

I am seeing this new error in the openliberty/daily image. I assume this will hit the official images also soon. There is work to do getting the new java shared class cache working with ours. This causes a decent regression for startup time.

I see this option: -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal

I have already talked to @ymanton about this.

docker run openliberty/daily
JVMSHRC226E Error opening shared class cache file
JVMSHRC336E Port layer error code = -102
JVMSHRC337E Platform error message: Permission denied
JVMSHRC840E Failed to start up the shared cache.
JVMSHRC686I Failed to startup shared class cache. Continue without using it as -Xshareclasses:nonfatal is specified
Launching defaultServer (Open Liberty 20.0.0.11/wlp-1.0.46.cl201120200919-1900) on Eclipse OpenJ9 VM, version 1.8.0_265-b01 (en_US)
[AUDIT   ] CWWKE0001I: The server defaultServer has been launched.
[AUDIT   ] CWWKG0093A: Processing configuration drop-ins resource: /opt/ol/wlp/usr/servers/defaultServer/configDropins/defaults/keystore.xml
[AUDIT   ] CWWKG0093A: Processing configuration drop-ins resource: /opt/ol/wlp/usr/servers/defaultServer/configDropins/defaults/open-default-port.xml
[AUDIT   ] CWWKZ0058I: Monitoring dropins for applications.
[AUDIT   ] CWWKF0012I: The server installed the following features: [el-3.0, jsp-2.3, servlet-3.1].
[AUDIT   ] CWWKF0011I: The defaultServer server is ready to run a smarter planet. The defaultServer server started in 2.319 seconds.

[leochr]

@crpotter fyi, this issue should be addressed prior to the next release of images.

[ymanton]

I've opened #204 to fix this. It assumes that we want to use the SCC in the OpenJ9 container as the base SCC layer and add OpenLiberty SCC layers on top. The IBM JDK does not (currently) ship with an SCC so for that case we'll maintain the old behaviour of building the OL SCC layers in the old /output/.classCache directory.

[mpirvu]

FYI: currently the embedded SCC into the OpenJ9 containers has only root access (.scc directory too), so it may NOT be usable for a container launched as a non-root user.
AdoptOpenJDK/openjdk-docker#407 is supposed to fix that

[jdmcclur]

I think Websphere Liberty OpenJ9 images will have this same issue: https://github.com/WASdev/ci.docker/blob/master/ga/latest/kernel/Dockerfile.ubi.adoptopenjdk8

[jdmcclur]

@ymanton It did not work for me. It did build differently, but still see.
JVMSHRC226E Error opening shared class cache file
JVMSHRC336E Port layer error code = -102
JVMSHRC337E Platform error message: Permission denied
JVMSHRC840E Failed to start up the shared cache.
JVMSHRC686I Failed to startup shared class cache. Continue without using it as -Xshareclasses:nonfatal is specified

If I go to /opt/java/.scc I see:
ls: cannot access 'C290M4F1A64P_openj9_system_scc_G41L00': Permission denied
total 13312
-????????? ? ? ? ? ? C290M4F1A64P_openj9_system_scc_G41L00
-rw-rw-r-- 1 root root 13631488 Sep 28 18:48 C290M4F1A64P_openj9_system_scc_G41L01

[mpirvu]

It did work for me with the command: docker build -f Dockerfile.ubi.adoptopenjdk8 -t myopenliberty .
I see AOT loads happening and going inside the container the permissions are:

bash-4.4$ cd /opt/java
bash-4.4$ ls -la
total 20
drwxr-xr-x 1 root root 4096 Sep 14 17:09 .
drwxr-xr-x 1 root root 4096 Sep 28 21:07 ..
drwxr-xr-x 8 root root 4096 Sep 14 17:08 openjdk
drwxrwx--- 1 root root 4096 Sep 28 21:08 .scc

bash-4.4$ cd /opt/java/.scc
bash-4.4$ ls -l
total 26624
-rw-r--r-- 1 root root 13631488 Sep 14 17:10 C290M4F1A64P_openj9_system_scc_G41L00
-rw-rw-r-- 1 root root 13631488 Sep 28 21:08 C290M4F1A64P_openj9_system_scc_G41L01

It does help that the current user belongs to 'root' group

[mpirvu]

Note that there are 5 dockerfiles under releases/latest/kernel:

-rw-rw-r-- 1 mpirvu mpirvu   4041 Sep 28 09:13 Dockerfile.ubi.adoptopenjdk11
-rw-rw-r-- 1 mpirvu mpirvu   4041 Sep 28 09:13 Dockerfile.ubi.adoptopenjdk14
-rw-rw-r-- 1 mpirvu mpirvu   3928 Sep 28 17:00 Dockerfile.ubi.adoptopenjdk8
-rw-rw-r-- 1 mpirvu mpirvu   3959 Sep 28 09:13 Dockerfile.ubi.ibmjava8
-rw-rw-r-- 1 mpirvu mpirvu   3981 Sep 28 09:13 Dockerfile.ubuntu.adoptopenjdk8

The first 3 are based on the non-official OpenJ9 image from adoptopenjdk and they have the embedded scc.
Dockerfile.ubi.ibmjava8 is based on ibmjava:8-ubi image which does not even exist.
Dockerfile.ubuntu.adoptopenjdk8 is based on the official OpenJ9 image from adoptopenjdk and does not include the embedded SDK.

[mpirvu]

Some news: permission for the .scc directory have been fixed at adoptopenjdk (AdoptOpenJDK/openjdk-docker#407) and we should expect a new image probably tomorrow.