Dockerfile-linux.template

{{
	def is_alpine:
		env.variant | startswith("alpine")
	;
	def alpine_version:
		env.variant | ltrimstr("alpine")
-}}
{{
	def is_oracle:
		env.variant | startswith("oraclelinux")
	;
	def oracle_version:
		env.variant | ltrimstr("oraclelinux")
-}}
{{
	def is_debian:
		is_alpine or is_oracle | not
	;
	def is_debian_slim:
		is_debian and (env.variant | startswith("slim-"))
	;
	def debian_suite:
		env.variant | ltrimstr("slim-")
-}}
{{
	if is_alpine then (
-}}
FROM alpine:{{ alpine_version }}

RUN apk add --no-cache java-cacerts

ENV JAVA_HOME /opt/openjdk-{{ env.version }}
{{
	) elif is_oracle then (
-}}
FROM oraclelinux:{{ oracle_version }}-slim

RUN set -eux; \
	microdnf install \
		gzip \
		tar \
		\
# jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351
# Error: java.io.IOException: Cannot run program "objcopy": error=2, No such file or directory
		binutils \
# java.lang.UnsatisfiedLinkError: /usr/java/openjdk-12/lib/libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
		freetype fontconfig \
	; \
	microdnf clean all

ENV JAVA_HOME /usr/java/openjdk-{{ env.version }}
{{
	) else (
-}}
FROM {{
	if is_debian_slim then
		"debian:" + debian_suite + "-slim"
	else
		"buildpack-deps:" + debian_suite + (
			if env.javaType == "jdk" then
				"-scm"
			else
				"-curl"
			end
		)
	end
}}

RUN set -eux; \
	apt-get update; \
	apt-get install -y --no-install-recommends \
{{ if is_debian_slim then "" else ( -}}
		bzip2 \
		unzip \
		xz-utils \
		\
# jlink --strip-debug on 13+ needs objcopy: https://github.com/docker-library/openjdk/issues/351
# Error: java.io.IOException: Cannot run program "objcopy": error=2, No such file or directory
		binutils \
		\
# java.lang.UnsatisfiedLinkError: /usr/local/openjdk-11/lib/libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
# java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
		fontconfig libfreetype6 \
		\
{{ ) end -}}
# utilities for keeping Debian and OpenJDK CA certificates in sync
		ca-certificates p11-kit \
	; \
	rm -rf /var/lib/apt/lists/*

ENV JAVA_HOME /usr/local/openjdk-{{ env.version }}
{{
	) end
-}}
ENV PATH $JAVA_HOME/bin:$PATH

{{ if is_alpine then "" else ( -}}
# Default to UTF-8 file.encoding
ENV LANG C.UTF-8

{{ ) end -}}
{{ def java_version: if is_alpine then .alpine.version else .version end -}}
# https://jdk.java.net/
# >
# > Java Development Kit builds, from Oracle
# >
ENV JAVA_VERSION {{ java_version }}
{{ if is_alpine then ( -}}
# "For Alpine Linux, builds are produced on a reduced schedule and may not be in sync with the other platforms."
{{ ) else "" end -}}

{{
	def arches:
		if is_alpine then .alpine else . end
		| .[env.javaType].arches
	;
	def get_arch_command:
		if is_alpine then
			"apk --print-arch"
		elif is_oracle then
			"rpm --query --queryformat='%{ARCH}' rpm"
		else
			"dpkg --print-architecture"
		end
	;
	def case_arch:
		# input is a bashbrew arch
		# - "amd64", "arm64v8", etc
		# output is a shell "case" expression for matching the output of running "get_arch_command"
		# - "i[3456]86", "aarch64", "x86_64", etc
		. as $bashbrewArch
		| if is_alpine then {
			amd64: "x86_64",
			arm64v8: "aarch64",
		} elif is_oracle then {
			amd64: "x86_64",
			arm64v8: "aarch64",
		} else {
			amd64: "amd64",
			arm64v8: "arm64",
		} end
		| .[$bashbrewArch] // error("unsupported bashbrew architecture: " + $bashbrewArch)
		| @sh
	;
	def wget_command:
		if is_oracle then
			"curl -fL -o"
		else
			[
				"wget",
				if is_alpine then empty else "--progress=dot:giga" end,
				"-O"
			] | join(" ")
		end
-}}
RUN set -eux; \
	\
	arch="$({{ get_arch_command }})"; \
	case "$arch" in \
{{
	[
		arches | to_entries[]
		| select(.key | startswith("windows-") | not)
		| .key as $bashbrewArch | .value
		| (
-}}
		{{ $bashbrewArch | case_arch }}) \
			downloadUrl={{ .url | @sh }}; \
{{ if .sha256 then ( -}}
			downloadSha256={{ .sha256 | @sh }}; \
{{ ) else "" end -}}
			;; \
{{
		)
	] | add
-}}
		*) echo >&2 "error: unsupported architecture: '$arch'"; exit 1 ;; \
	esac; \
	\
{{ if is_debian_slim then ( -}}
	savedAptMark="$(apt-mark showmanual)"; \
	apt-get update; \
	apt-get install -y --no-install-recommends \
		wget \
	; \
	rm -rf /var/lib/apt/lists/*; \
	\
{{ ) else "" end -}}
	{{ wget_command }} openjdk.tgz "$downloadUrl"; \
{{ if [ arches[] ] | any(has("sha256")) then ( -}}
	echo "$downloadSha256 *openjdk.tgz" | sha256sum {{ if is_alpine then "-c" else "--strict --check" end }} -; \
{{ ) else "" end -}}
	\
	mkdir -p "$JAVA_HOME"; \
	tar --extract \
		--file openjdk.tgz \
		--directory "$JAVA_HOME" \
		--strip-components 1 \
		--no-same-owner \
	; \
	rm openjdk.tgz*; \
	\
{{ if is_debian_slim then ( -}}
	apt-mark auto '.*' > /dev/null; \
	[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
	\
{{ ) else "" end -}}
{{ if is_alpine then ( -}}
	rm -rf "$JAVA_HOME/lib/security/cacerts"; \
# see "java-cacerts" package installed above (which maintains "/etc/ssl/certs/java/cacerts" for us)
	ln -sT /etc/ssl/certs/java/cacerts "$JAVA_HOME/lib/security/cacerts"; \
{{ ) elif is_oracle then ( -}}
	rm -rf "$JAVA_HOME/lib/security/cacerts"; \
# see "update-ca-trust" script which creates/maintains this cacerts bundle
	ln -sT /etc/pki/ca-trust/extracted/java/cacerts "$JAVA_HOME/lib/security/cacerts"; \
	\
# https://github.com/oracle/docker-images/blob/a56e0d1ed968ff669d2e2ba8a1483d0f3acc80c0/OracleJava/java-8/Dockerfile#L17-L19
	ln -sfT "$JAVA_HOME" /usr/java/default; \
	ln -sfT "$JAVA_HOME" /usr/java/latest; \
	for bin in "$JAVA_HOME/bin/"*; do \
		base="$(basename "$bin")"; \
		[ ! -e "/usr/bin/$base" ]; \
		alternatives --install "/usr/bin/$base" "$base" "$bin" 20000; \
	done; \
{{ ) else ( -}}
# update "cacerts" bundle to use Debian's CA certificates (and make sure it stays up-to-date with changes to Debian's store)
# see https://github.com/docker-library/openjdk/issues/327
#     http://rabexc.org/posts/certificates-not-working-java#comment-4099504075
#     https://salsa.debian.org/java-team/ca-certificates-java/blob/3e51a84e9104823319abeb31f880580e46f45a98/debian/jks-keystore.hook.in
#     https://git.alpinelinux.org/aports/tree/community/java-cacerts/APKBUILD?id=761af65f38b4570093461e6546dcf6b179d2b624#n29
	{ \
		echo '#!/usr/bin/env bash'; \
		echo 'set -Eeuo pipefail'; \
		echo 'trust extract --overwrite --format=java-cacerts --filter=ca-anchors --purpose=server-auth "$JAVA_HOME/lib/security/cacerts"'; \
	} > /etc/ca-certificates/update.d/docker-openjdk; \
	chmod +x /etc/ca-certificates/update.d/docker-openjdk; \
	/etc/ca-certificates/update.d/docker-openjdk; \
	\
# https://github.com/docker-library/openjdk/issues/331#issuecomment-498834472
	find "$JAVA_HOME/lib" -name '*.so' -exec dirname '{}' ';' | sort -u > /etc/ld.so.conf.d/docker-openjdk.conf; \
	ldconfig; \
{{ ) end -}}
	\
# https://github.com/docker-library/openjdk/issues/212#issuecomment-420979840
# https://openjdk.java.net/jeps/341
	java -Xshare:dump; \
	\
# basic smoke test
{{ if env.javaType == "jdk" then ( -}}
	fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java; \
	javac --version; \
	java --version

# "jshell" is an interactive REPL for Java (see https://en.wikipedia.org/wiki/JShell)
CMD ["jshell"]
{{ ) else ( -}}
	java --version
{{ ) end -}}