remove unnecessary packages from docker files (#460)

* remove zlib and libretls from alpine images * entrypoint.sh refactor * further edits * entrypoint comment * fixup * fixup test * sxa fixes
adoptium · Nov 9, 2023 · a6be406 · a6be406
1 parent 376294c
commit a6be406
Show file tree

Hide file tree

Showing 49 changed files with 199 additions and 149 deletions.
diff --git a/11/jdk/alpine/Dockerfile b/11/jdk/alpine/Dockerfile
@@ -27,16 +27,13 @@ ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
 RUN set -eux; \
     apk add --no-cache \
-        # bash is required for the entrypoint script
-        # see https://github.com/adoptium/containers/issues/415
-        bash \
-        # fontconfig and ttf-dejavu added to support serverside image generation by Java programs
+        # java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
+        # java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
+        # https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
         fontconfig ttf-dejavu \
-        # java-cacerts added to support adding CA certificates to the Java keystore
-        java-cacerts \
-        # fixes issues with apk del apk-tools
-        # see https://github.com/adoptium/containers/issues/136
-        libretls zlib \
+        # utilities for keeping Alpine and OpenJDK CA certificates in sync
+        # https://github.com/adoptium/containers/issues/293
+        ca-certificates p11-kit-trust \
         # locales ensures proper character encoding and locale-specific behaviors using en_US.UTF-8
         musl-locales musl-locales-lang \
         tzdata \

diff --git a/11/jdk/alpine/entrypoint.sh b/11/jdk/alpine/entrypoint.sh
@@ -1,5 +1,5 @@
-#!/usr/bin/env bash
-# Sheband needs to be `bash`, see https://github.com/adoptium/containers/issues/415 for details
+#!/usr/bin/env sh
+# Converted to POSIX shell to avoid the need for bash in the image
 
 set -e
 
@@ -9,15 +9,15 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     # Copy certificates from /certificates to the system truststore, but only if the directory exists and is not empty.
     # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
     # system location, for whatever reason.
-    if [ -d /certificates ] && [ "$(ls -A /certificates)" ]; then
+    if [ -d /certificates ] && [ -n "$(ls -A /certificates 2>/dev/null)" ]; then
         cp -a /certificates/* /usr/local/share/ca-certificates/
     fi
 
-    CACERT=$JAVA_HOME/lib/security/cacerts
+    CACERT="$JAVA_HOME/lib/security/cacerts"
 
     # JDK8 puts its JRE in a subdirectory
     if [ -f "$JAVA_HOME/jre/lib/security/cacerts" ]; then
-        CACERT=$JAVA_HOME/jre/lib/security/cacerts
+        CACERT="$JAVA_HOME/jre/lib/security/cacerts"
     fi
 
     # OpenJDK images used to create a hook for `update-ca-certificates`. Since we are using an entrypoint anyway, we

diff --git a/11/jdk/centos/Dockerfile b/11/jdk/centos/Dockerfile
@@ -33,10 +33,12 @@ RUN set -eux; \
         curl \
         wget \
         tzdata \
-        openssl \
         # utilities for keeping Centos and OpenJDK CA certificates in sync
         # https://github.com/adoptium/containers/issues/293
         ca-certificates \
+        # java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
+        # java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
+        # https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
         fontconfig \
     ; \
     rm -rf /var/cache/yum

diff --git a/11/jdk/ubi/ubi9-minimal/Dockerfile b/11/jdk/ubi/ubi9-minimal/Dockerfile
@@ -32,11 +32,13 @@ RUN set -eux; \
         # Required for objdump and also jlink
         binutils \
         tzdata \
-        openssl \
         wget \
         # utilities for keeping UBI and OpenJDK CA certificates in sync
         # https://github.com/adoptium/containers/issues/293
         ca-certificates \
+        # java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
+        # java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
+        # https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
         fontconfig \
         glibc-langpack-en \
     ; \

diff --git a/11/jdk/ubuntu/focal/Dockerfile b/11/jdk/ubuntu/focal/Dockerfile
@@ -31,6 +31,9 @@ RUN set -eux; \
         # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
         curl \
         wget \
+        # java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
+        # java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
+        # https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
         fontconfig \
         # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
         # https://github.com/adoptium/containers/issues/293

diff --git a/11/jdk/ubuntu/jammy/Dockerfile b/11/jdk/ubuntu/jammy/Dockerfile
@@ -31,6 +31,9 @@ RUN set -eux; \
         # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
         curl \
         wget \
+        # java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
+        # java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
+        # https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
         fontconfig \
         # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
         # https://github.com/adoptium/containers/issues/293

diff --git a/11/jre/alpine/Dockerfile b/11/jre/alpine/Dockerfile
@@ -27,16 +27,13 @@ ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
 RUN set -eux; \
     apk add --no-cache \
-        # bash is required for the entrypoint script
-        # see https://github.com/adoptium/containers/issues/415
-        bash \
-        # fontconfig and ttf-dejavu added to support serverside image generation by Java programs
+        # java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
+        # java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
+        # https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
         fontconfig ttf-dejavu \
-        # java-cacerts added to support adding CA certificates to the Java keystore
-        java-cacerts \
-        # fixes issues with apk del apk-tools
-        # see https://github.com/adoptium/containers/issues/136
-        libretls zlib \
+        # utilities for keeping Alpine and OpenJDK CA certificates in sync
+        # https://github.com/adoptium/containers/issues/293
+        ca-certificates p11-kit-trust \
         # locales ensures proper character encoding and locale-specific behaviors using en_US.UTF-8
         musl-locales musl-locales-lang \
         tzdata \

diff --git a/11/jre/alpine/entrypoint.sh b/11/jre/alpine/entrypoint.sh
@@ -1,5 +1,5 @@
-#!/usr/bin/env bash
-# Sheband needs to be `bash`, see https://github.com/adoptium/containers/issues/415 for details
+#!/usr/bin/env sh
+# Converted to POSIX shell to avoid the need for bash in the image
 
 set -e
 
@@ -9,15 +9,15 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     # Copy certificates from /certificates to the system truststore, but only if the directory exists and is not empty.
     # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
     # system location, for whatever reason.
-    if [ -d /certificates ] && [ "$(ls -A /certificates)" ]; then
+    if [ -d /certificates ] && [ -n "$(ls -A /certificates 2>/dev/null)" ]; then
         cp -a /certificates/* /usr/local/share/ca-certificates/
     fi
 
-    CACERT=$JAVA_HOME/lib/security/cacerts
+    CACERT="$JAVA_HOME/lib/security/cacerts"
 
     # JDK8 puts its JRE in a subdirectory
     if [ -f "$JAVA_HOME/jre/lib/security/cacerts" ]; then
-        CACERT=$JAVA_HOME/jre/lib/security/cacerts
+        CACERT="$JAVA_HOME/jre/lib/security/cacerts"
     fi
 
     # OpenJDK images used to create a hook for `update-ca-certificates`. Since we are using an entrypoint anyway, we

diff --git a/11/jre/centos/Dockerfile b/11/jre/centos/Dockerfile
@@ -33,10 +33,12 @@ RUN set -eux; \
         curl \
         wget \
         tzdata \
-        openssl \
         # utilities for keeping Centos and OpenJDK CA certificates in sync
         # https://github.com/adoptium/containers/issues/293
         ca-certificates \
+        # java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
+        # java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
+        # https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
         fontconfig \
     ; \
     rm -rf /var/cache/yum

diff --git a/11/jre/ubi/ubi9-minimal/Dockerfile b/11/jre/ubi/ubi9-minimal/Dockerfile
@@ -32,11 +32,13 @@ RUN set -eux; \
         # Required for objdump and also jlink
         binutils \
         tzdata \
-        openssl \
         wget \
         # utilities for keeping UBI and OpenJDK CA certificates in sync
         # https://github.com/adoptium/containers/issues/293
         ca-certificates \
+        # java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
+        # java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
+        # https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
         fontconfig \
         glibc-langpack-en \
     ; \

diff --git a/11/jre/ubuntu/focal/Dockerfile b/11/jre/ubuntu/focal/Dockerfile
@@ -31,6 +31,9 @@ RUN set -eux; \
         # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
         curl \
         wget \
+        # java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
+        # java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
+        # https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
         fontconfig \
         # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
         # https://github.com/adoptium/containers/issues/293

diff --git a/11/jre/ubuntu/jammy/Dockerfile b/11/jre/ubuntu/jammy/Dockerfile
@@ -31,6 +31,9 @@ RUN set -eux; \
         # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
         curl \
         wget \
+        # java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
+        # java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
+        # https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
         fontconfig \
         # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
         # https://github.com/adoptium/containers/issues/293

diff --git a/17/jdk/alpine/Dockerfile b/17/jdk/alpine/Dockerfile
@@ -27,16 +27,13 @@ ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
 RUN set -eux; \
     apk add --no-cache \
-        # bash is required for the entrypoint script
-        # see https://github.com/adoptium/containers/issues/415
-        bash \
-        # fontconfig and ttf-dejavu added to support serverside image generation by Java programs
+        # java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
+        # java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
+        # https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
         fontconfig ttf-dejavu \
-        # java-cacerts added to support adding CA certificates to the Java keystore
-        java-cacerts \
-        # fixes issues with apk del apk-tools
-        # see https://github.com/adoptium/containers/issues/136
-        libretls zlib \
+        # utilities for keeping Alpine and OpenJDK CA certificates in sync
+        # https://github.com/adoptium/containers/issues/293
+        ca-certificates p11-kit-trust \
         # locales ensures proper character encoding and locale-specific behaviors using en_US.UTF-8
         musl-locales musl-locales-lang \
         # jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351

diff --git a/17/jdk/alpine/entrypoint.sh b/17/jdk/alpine/entrypoint.sh
@@ -1,5 +1,5 @@
-#!/usr/bin/env bash
-# Sheband needs to be `bash`, see https://github.com/adoptium/containers/issues/415 for details
+#!/usr/bin/env sh
+# Converted to POSIX shell to avoid the need for bash in the image
 
 set -e
 
@@ -9,15 +9,15 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     # Copy certificates from /certificates to the system truststore, but only if the directory exists and is not empty.
     # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
     # system location, for whatever reason.
-    if [ -d /certificates ] && [ "$(ls -A /certificates)" ]; then
+    if [ -d /certificates ] && [ -n "$(ls -A /certificates 2>/dev/null)" ]; then
         cp -a /certificates/* /usr/local/share/ca-certificates/
     fi
 
-    CACERT=$JAVA_HOME/lib/security/cacerts
+    CACERT="$JAVA_HOME/lib/security/cacerts"
 
     # JDK8 puts its JRE in a subdirectory
     if [ -f "$JAVA_HOME/jre/lib/security/cacerts" ]; then
-        CACERT=$JAVA_HOME/jre/lib/security/cacerts
+        CACERT="$JAVA_HOME/jre/lib/security/cacerts"
     fi
 
     # OpenJDK images used to create a hook for `update-ca-certificates`. Since we are using an entrypoint anyway, we

diff --git a/17/jdk/centos/Dockerfile b/17/jdk/centos/Dockerfile
@@ -29,17 +29,19 @@ RUN set -eux; \
     yum install -y \
         gzip \
         tar \
+        # jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351
+        # Error: java.io.IOException: Cannot run program "objcopy": error=2, No such file or directory
+        binutils \
         # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
         curl \
         wget \
         tzdata \
-        openssl \
         # utilities for keeping Centos and OpenJDK CA certificates in sync
         # https://github.com/adoptium/containers/issues/293
         ca-certificates \
-        # jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351
-        # Error: java.io.IOException: Cannot run program "objcopy": error=2, No such file or directory
-        binutils \
+        # java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
+        # java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
+        # https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
         fontconfig \
     ; \
     rm -rf /var/cache/yum

diff --git a/17/jdk/ubi/ubi9-minimal/Dockerfile b/17/jdk/ubi/ubi9-minimal/Dockerfile
@@ -32,11 +32,13 @@ RUN set -eux; \
         # Required for objdump and also jlink
         binutils \
         tzdata \
-        openssl \
         wget \
         # utilities for keeping UBI and OpenJDK CA certificates in sync
         # https://github.com/adoptium/containers/issues/293
         ca-certificates \
+        # java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
+        # java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
+        # https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
         fontconfig \
         glibc-langpack-en \
     ; \

diff --git a/17/jdk/ubuntu/focal/Dockerfile b/17/jdk/ubuntu/focal/Dockerfile
@@ -31,6 +31,9 @@ RUN set -eux; \
         # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
         curl \
         wget \
+        # java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
+        # java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
+        # https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
         fontconfig \
         # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
         # https://github.com/adoptium/containers/issues/293

diff --git a/17/jdk/ubuntu/jammy/Dockerfile b/17/jdk/ubuntu/jammy/Dockerfile
@@ -31,6 +31,9 @@ RUN set -eux; \
         # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
         curl \
         wget \
+        # java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
+        # java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
+        # https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
         fontconfig \
         # utilities for keeping Ubuntu and OpenJDK CA certificates in sync
         # https://github.com/adoptium/containers/issues/293

diff --git a/17/jre/alpine/Dockerfile b/17/jre/alpine/Dockerfile
@@ -27,16 +27,13 @@ ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
 RUN set -eux; \
     apk add --no-cache \
-        # bash is required for the entrypoint script
-        # see https://github.com/adoptium/containers/issues/415
-        bash \
-        # fontconfig and ttf-dejavu added to support serverside image generation by Java programs
+        # java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
+        # java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
+        # https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
         fontconfig ttf-dejavu \
-        # java-cacerts added to support adding CA certificates to the Java keystore
-        java-cacerts \
-        # fixes issues with apk del apk-tools
-        # see https://github.com/adoptium/containers/issues/136
-        libretls zlib \
+        # utilities for keeping Alpine and OpenJDK CA certificates in sync
+        # https://github.com/adoptium/containers/issues/293
+        ca-certificates p11-kit-trust \
         # locales ensures proper character encoding and locale-specific behaviors using en_US.UTF-8
         musl-locales musl-locales-lang \
         # jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351

diff --git a/17/jre/alpine/entrypoint.sh b/17/jre/alpine/entrypoint.sh
@@ -1,5 +1,5 @@
-#!/usr/bin/env bash
-# Sheband needs to be `bash`, see https://github.com/adoptium/containers/issues/415 for details
+#!/usr/bin/env sh
+# Converted to POSIX shell to avoid the need for bash in the image
 
 set -e
 
@@ -9,15 +9,15 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     # Copy certificates from /certificates to the system truststore, but only if the directory exists and is not empty.
     # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
     # system location, for whatever reason.
-    if [ -d /certificates ] && [ "$(ls -A /certificates)" ]; then
+    if [ -d /certificates ] && [ -n "$(ls -A /certificates 2>/dev/null)" ]; then
         cp -a /certificates/* /usr/local/share/ca-certificates/
     fi
 
-    CACERT=$JAVA_HOME/lib/security/cacerts
+    CACERT="$JAVA_HOME/lib/security/cacerts"
 
     # JDK8 puts its JRE in a subdirectory
     if [ -f "$JAVA_HOME/jre/lib/security/cacerts" ]; then
-        CACERT=$JAVA_HOME/jre/lib/security/cacerts
+        CACERT="$JAVA_HOME/jre/lib/security/cacerts"
     fi
 
     # OpenJDK images used to create a hook for `update-ca-certificates`. Since we are using an entrypoint anyway, we

diff --git a/17/jre/centos/Dockerfile b/17/jre/centos/Dockerfile
@@ -29,17 +29,19 @@ RUN set -eux; \
     yum install -y \
         gzip \
         tar \
+        # jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351
+        # Error: java.io.IOException: Cannot run program "objcopy": error=2, No such file or directory
+        binutils \
         # curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
         curl \
         wget \
         tzdata \
-        openssl \
         # utilities for keeping Centos and OpenJDK CA certificates in sync
         # https://github.com/adoptium/containers/issues/293
         ca-certificates \
-        # jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351
-        # Error: java.io.IOException: Cannot run program "objcopy": error=2, No such file or directory
-        binutils \
+        # java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
+        # java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
+        # https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
         fontconfig \
     ; \
     rm -rf /var/cache/yum