Merge pull request #7774 from gsmet/java11-default-image

Make GraalVM Java 11 the default image

core/deployment/src/main/java/io/quarkus/deployment/pkg/NativeConfig.java

@@ -139,7 +139,7 @@ public class NativeConfig {
     /**
      * The docker image to use to do the image build
      */
-    @ConfigItem(defaultValue = "quay.io/quarkus/ubi-quarkus-native-image:19.3.1-java8")
+    @ConfigItem(defaultValue = "quay.io/quarkus/ubi-quarkus-native-image:19.3.1-java11")
     public String builderImage;
 
     /**

docs/pom.xml

@@ -108,6 +108,7 @@
                         <quarkus-version>${project.version}</quarkus-version>
                         <surefire-version>${version.surefire.plugin}</surefire-version>
                         <graalvm-version>${graal-sdk.version-for-documentation}</graalvm-version>
+                        <graalvm-flavor>${graal-sdk.version-for-documentation}-java11</graalvm-flavor>
                         <restassured-version>${rest-assured.version}</restassured-version>
                         <keycloak-docker-image>${keycloak.docker.image}</keycloak-docker-image>
                         <!-- Project website home page -->

docs/src/main/asciidoc/README.adoc

@@ -44,5 +44,6 @@ complete list of externalized variables for use is given in the following table:
 |\{quickstarts-blob-url}|{quickstarts-blob-url}| Quickstarts URL to master blob source tree; used for referencing source files.
 |\{quickstarts-tree-url}|{quickstarts-tree-url}| Quickstarts URL to master source tree root; used for referencing directories.
 
-|\{graalvm-version}|{graalvm-version}| Recommended Graal VM version to use.
+|\{graalvm-version}|{graalvm-version}| Recommended GraalVM version to use.
+|\{graalvm-flavor}|{graalvm-flavor}| The full flavor of GraaVM to use e.g. `19.3.1-java11`.
 |===

docs/src/main/asciidoc/building-native-image.adoc

@@ -347,7 +347,7 @@ In this guide we will use the first stage to generate the native executable usin
 [source,dockerfile,subs=attributes+]
 ----
 ## Stage 1 : build with maven builder image with native capabilities
-FROM quay.io/quarkus/centos-quarkus-maven:{graalvm-version}-java8 AS build
+FROM quay.io/quarkus/centos-quarkus-maven:{graalvm-flavor} AS build
 COPY src /usr/src/app/src
 COPY pom.xml /usr/src/app
 USER root
@@ -369,8 +369,6 @@ Save this file in `src/main/docker/Dockerfile.multistage` as it is not included
 
 [WARNING]
 ====
-Replace the -java8 in the base image with -java11 if you want to use Java 11.
-
 Before launching our Docker build, we need to update the default `.dockerignore` file as it filters everything except the `target` directory and as we plan to build inside a container we need to be able to copy the `src` directory. So edit your `.dockerignore` and remove or comment its content.
 ====
 

docs/src/main/asciidoc/deploying-to-openshift-s2i.adoc

@@ -37,7 +37,7 @@ We are going to create an OpenShift `build` executing it:
 [source,shell, subs="attributes"]
 ----
 # To build the image on OpenShift
-oc new-app quay.io/quarkus/ubi-quarkus-native-s2i:{graalvm-version}-java8~{quickstarts-clone-url} --context-dir=getting-started --name=quarkus-quickstart-native
+oc new-app quay.io/quarkus/ubi-quarkus-native-s2i:{graalvm-flavor}~{quickstarts-clone-url} --context-dir=getting-started --name=quarkus-quickstart-native
 oc logs -f bc/quarkus-quickstart-native
 
 # To create the route
@@ -49,12 +49,6 @@ echo $URL
 curl $URL/hello/greeting/quarkus
 ----
 
-[TIP]
-====
-The `oc new-app` command above uses a builder image compatible with JDK 8.
-In order to create a JDK 11 native compatible image use `quay.io/quarkus/ubi-quarkus-native-s2i:{graalvm-version}-java11` as a builder image.
-====
-
 Your application is accessible at the printed URL.
 
 Note that GraalVM-based native build are more memory & CPU intensive than regular pure Java builds.
@@ -117,11 +111,9 @@ The end result is an image that is less than 40 MB in size (compressed) and does
 The minimal build is depending on the S2I build since it is using the output (native runnable application) from the S2I build. However, you do not need to create an application with `oc new-app`. Instead you could use `oc new-build` like this:
 [source, shell, subs="attributes"]
 ----
-oc new-build quay.io/quarkus/ubi-quarkus-native-s2i:{graalvm-version}-java8~{quickstarts-clone-url} \
+oc new-build quay.io/quarkus/ubi-quarkus-native-s2i:{graalvm-flavor}~{quickstarts-clone-url} \
     --context-dir=getting-started --name=quarkus-quickstart-native
 ----
-
-Like in previous commands, use `quay.io/quarkus/ubi-quarkus-native-s2i:{graalvm-version}-java11` for building a JDK 11 compatible image.
 ====
 
 == Deploying the application as Java application in OpenShift

docs/src/main/asciidoc/gradle-tooling.adoc

@@ -283,8 +283,13 @@ Note that in this case the build itself runs in a Docker container too, so you d
 
 [TIP]
 ====
-By default, the native image will be generated using the `quay.io/quarkus/ubi-quarkus-native-image:{graalvm-version}-java8` Docker image which is only compatible with JDK 8.
-If you want to build a native image compatible with JDK 11, you will have to use the `-Dquarkus.native.builder-image=quay.io/quarkus/ubi-quarkus-native-image:{graalvm-version}-java11` build argument.
+By default, the native executable will be generated using the `quay.io/quarkus/ubi-quarkus-native-image:{graalvm-flavor}` Docker image.
+
+If you want to build a native executable with a different Docker image (for instance to use a different GraalVM version),
+use the `-Dquarkus.native.builder-image=<image name>` build argument.
+
+The list of the available Docker images can be found on https://quay.io/repository/quarkus/ubi-quarkus-native-image?tab=tags[quay.io].
+Be aware that a given Quarkus version might not be compatible with all the images available.
 ====
 
 Another way of customizing the native build image build process is to configure the task inside the Gradle build script. If for example it is required to set the `enableHttpUrlHandler`, it can be done like so:

docs/src/main/asciidoc/maven-tooling.adoc

@@ -371,8 +371,13 @@ Note that in this case the build itself runs in a Docker container too, so you d
 
 [TIP]
 ====
-By default, the native image will be generated using the `quay.io/quarkus/ubi-quarkus-native-image:{graalvm-version}-java8` Docker image which is only compatible with JDK 8.
-If you want to build a native image compatible with JDK 11, you will have to use the `-Dquarkus.native.builder-image=quay.io/quarkus/ubi-quarkus-native-image:{graalvm-version}-java11` build argument.
+By default, the native executable will be generated using the `quay.io/quarkus/ubi-quarkus-native-image:{graalvm-flavor}` Docker image.
+
+If you want to build a native executable with a different Docker image (for instance to use a different GraalVM version),
+use the `-Dquarkus.native.builder-image=<image name>` build argument.
+
+The list of the available Docker images can be found on https://quay.io/repository/quarkus/ubi-quarkus-native-image?tab=tags[quay.io].
+Be aware that a given Quarkus version might not be compatible with all the images available.
 ====
 
 You can follow the link:building-native-image[Build a native executable guide] as well as link:deploying-to-kubernetes[Deploying Application to Kubernetes and OpenShift] for more information.

docs/src/main/asciidoc/native-and-ssl.adoc

@@ -199,42 +199,31 @@ Don't forget to move your GraalVM directory back to where it was.
 
 === Working with containers
 
-When working with containers, the idea is to bundle both the SunEC library and the certificates in the container and to point your binary to them using the system properties mentioned above.
+When working with containers, the idea is to bundle the certificates in the container and to point your binary to them using the system property mentioned above.
 
 You can for example modify your `Dockerfile.native` as follows to copy the required files to your final image:
 
-==== Java 8
 [source, subs=attributes+]
 ----
-FROM quay.io/quarkus/ubi-quarkus-native-image:{graalvm-version}-java8 as nativebuilder
-RUN mkdir -p /tmp/ssl-libs/lib \
-  && cp /opt/graalvm/jre/lib/security/cacerts /tmp/ssl-libs \
-  && cp /opt/graalvm/jre/lib/amd64/libsunec.so /tmp/ssl-libs/lib/
+FROM quay.io/quarkus/ubi-quarkus-native-image:{graalvm-flavor} as nativebuilder
+RUN mkdir -p /tmp/ssl \
+  && cp /opt/graalvm/lib/security/cacerts /tmp/ssl/
 
 FROM registry.access.redhat.com/ubi8/ubi-minimal
 WORKDIR /work/
-COPY --from=nativebuilder /tmp/ssl-libs/ /work/
+COPY --from=nativebuilder /tmp/ssl/ /work/
 COPY target/*-runner /work/application
-RUN chmod 775 /work /work/application
-EXPOSE 8080
-CMD ["./application", "-Dquarkus.http.host=0.0.0.0", "-Djava.library.path=/work/lib", "-Djavax.net.ssl.trustStore=/work/cacerts"]
-----
 
-==== Java 11
-[source, subs=attributes+]
-----
-FROM quay.io/quarkus/ubi-quarkus-native-image:{graalvm-version}-java11 as nativebuilder
-RUN mkdir -p /tmp/ssl-libs/lib \
-  && cp /opt/graalvm/lib/security/cacerts /tmp/ssl-libs \
-  && cp /opt/graalvm/lib/libsunec.so /tmp/ssl-libs/lib/
+# set up permissions for user `1001`
+RUN chmod 775 /work /work/application \
+  && chown -R 1001 /work \
+  && chmod -R "g+rwX" /work \
+  && chown -R 1001:root /work
 
-FROM registry.access.redhat.com/ubi8/ubi-minimal
-WORKDIR /work/
-COPY --from=nativebuilder /tmp/ssl-libs/ /work/
-COPY target/*-runner /work/application
-RUN chmod 775 /work /work/application
 EXPOSE 8080
-CMD ["./application", "-Dquarkus.http.host=0.0.0.0", "-Djava.library.path=/work/lib", "-Djavax.net.ssl.trustStore=/work/cacerts"]
+USER 1001
+
+CMD ["./application", "-Dquarkus.http.host=0.0.0.0", "-Djavax.net.ssl.trustStore=/work/cacerts"]
 ----
 
 == Conclusion