CON Java in a World of Containers

Transcription

1 CON Java in a World of Containers mikael.vidstedt@oracle.com Director, Java Virtual Copyright 2017, Oracle and/or its affiliates. All rights reserved. 1

2 Agenda Producing images and running containers with JDK 9 Size analysis of JDK Docker Images A quick look at startup Tme 2

3 Java 8 Docker image Official Java 8 SE (Server JRE) available on the docker store See also DockerFiles on GitHub 3

4 In a world of containers we expect Many distributons of Java runtmes Forces that push towards Smaller images Faster executon using less resources (and respectng resource constraints) 4

5 Java has plans for a world of containers Official OpenJDK builds will make it easier to distribute Java runtmes Java 9 tooling can produce custom Java runtmes that are smaller Current and future Java tooling will produce applicaton- specific Java runtmes that startup faster 5

6 Producing Docker images with a JDK Very easy to create a DockerFile that copies (or adds) a tarball of a JDK A resultng Docker image will be large (> 300MB) Not necessarily good for development or executon More stuff than required to build or run an applicaton 6

7 JDK 9 is modular JDK 9 is modular and introduces modules to the Java plagorm A module is a set of packages designed for reuse Modules improve the reliability and maintainability of your programs JDK 9 is itself composed of 79 modules 7

8 JDK 9 and custom Java runtmes JDK 9 comes with jlink, a tool that can create custom Java runtmes Such as, a Java runtme consistng of just the java.base module Note: the Java applicaton need not be modular 8

9 Project Portola and Alpine Linux The OpenJDK Portola Project aims to provide a port of the JDK to the Alpine Linux distributon Early access builds of the JDK port are available jlink can be used to create custom Java runtmes for Alpine Linux 9

10 Demo Crea%ng Docker images with Alpine Linux, Java, and jlink 10

11 Running JDK 9 in Docker containers The JDK has not necessarily been a model citzen and respectng resource constraints when running in a container JDK 9 has a few improvements to respect resource constraints These improvements have been back ported to a JDK 9 release 11

12 RespecTng memory limits The JDK respects group memory limits set for the container (see docker run memory constraints) -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap 12

13 RespecTng CPU constraints The JDK respects some CPU constraints set for the container (see docker run cpuset constraint) java.lang.runtime.availableprocessors reports correct number of CPUs 13

14 Stable executon The JVM ensures stable executon when resources change G1 Garbage Collector operates on actve CPU count discovered at JVM startup 14

15 Ongoing improvements planned for future releases JDK Improve Docker container detecton and resource configuraton usage More robust container detecton logic EvaluaTng support for further docker run flags --cpus --cpu-quota --cpu-period --cpu-shares New -XX:ActiveProcessorCount flag Total and Avail memory extracted from cgroup /proc file system 15

16 Ongoing improvements planned for future releases JDK Allow selectng Heap % of available RAM Draq JEP: Container aware Java hrp://openjdk.java.net/jeps/ Provide Java API access to container metrics 16

17 Demo Running Java (jshell), in a docker container, and respec%ng resource constraints 17

18 For a more comprehensive demonstraton See tutorial on running and monitoring a Java applicaton in a Kubernetes cluster Docker images can be created and published using Wercker 18

19 Size Analysis Viewer discre%on advised: Bar charts ahead! 19

20 Docker Image Docker image using DockerFile FROM oraclelinux:7 ADD jdk linux- x64_bin.tar.gz JDK oraclelinux:7 Let s optmize! Size (MB) Full JDK 20

21 Streamlining the JRE using jlink Full JDK Default JDK (not jlink:ed) java.base jlink add-modules java.base nery A set of modules expected to be sufficient for many Java applicatons jlink --add-modules java.base, java.logging, java.management, java.xml, jdk.management, jdk.unsupported Note: Does not include the nery applicaton code! Size (MB) JDK oraclelinux: Full JDK netty java.base 21

22 Streamlining the base image oraclelinux:7 vs oraclelinux:7- slim oraclelinux:7 (229 MB) Contains Everything and then some Certainly more than Java needs oraclelinux:7- slim (118 MB) Streamlined to bare necessites Saves 111 MB Further optmizaton - Strip out individual files Analyze shared libraries/dependency graph and strip out unneeded files 22 Size (MB) oraclelinux:7 + Full JDK oraclelinux:7-slim + Full JDK oraclelinux:7 + java.base oraclelinux:7-slim + java.base JDK Base oraclelinux:7 + netty oraclelinux:7-slim + netty

23 Small. Simple. Secure. Alpine Linux is a security- oriented, lightweight Linux distributon based on musl libc and busybox. hrps:// 23

24 Docker Base Images Docker base image sizes Size (MB) oraclelinux:7 oraclelinux:7-slim alpine:3.6 24

25 Java Images Based on alpine: Size (MB) JDK alpine: Full JDK java.base netty 25

26 OpTmizing java.base with jlink optons default: no special optons --compress=2 ZIP compression of resources --strip-debug Remove all debug informaton Don t try this at home! Size (MB) JDK alpine: default 4 compress=2 4 compress=2 strip-debug 26

27 but wait, there s more! What s the theoretcal minimum? What s actually in a java.base JRE? Files Size (bytes) lib/modules 23,529,047 lib/server/libjvm.so 21,197,904 <other files> 1,545,818 Sum 46,272,769 27

28 JVM Size Note: Numbers/sizes are approximate 28

29 JVM Size JIT Compiler(s) 29

30 JVM Size GC(s) 30

31 JVM Size Let s keep one GC: Serial 31

32 JVM Size - Other 32

33 The minimal VM 25.0 Size of JVM variants The minimal VM weighs in at just under 5MB STll fully Java compliant Size (MB) But Lacks many/most of the additonal features No JIT compiler Only Serial GC Very few debugging/serviceability features 0.0 server minimal Probably not a good match for producton use- cases, but an interestng data point 33

34 A minimal Docker image HelloWorld in ~20MB Including the Alpine base image minimal VM + java.base More extreme Java runtmes available can bring this down even further (with some limitatons) SubstrateVM from Oracle Labs Size (MB) JDK libjvm.so alpine: default compress=2 strip-debug 34

35 Future: Stripping out unused classes Not every class in a module is necessarily used by the applicaton Finding out which classes to use is non- trivial Indeterminism (haltng problem) ReflecTon Area of research, stay tuned #classes Size (bytes) All java.base classes ,178,884 Classes used by HelloWorld 506 8,796,290 9% 46% 35

36 Sharing across instances

37 Sharing Across Instances Micro- services and Docker encourages running many processes on the same machine Chances are many instances will be running the exact same applica%on OS shared libraries allows for sharing natve data libc, libjvm.so all get shared automatcally by the OS & Docker Assuming same layer/file/inode What about Java class data? 37

38 Class Data Sharing (CDS) Dump Tme Dump Tme process / training run Preload a set of classes Classes are parsed into their Java VM private internal representatons (class metadata) Metadata is split into read- only (RO) and read- write (RW) parts, and allocated in separate memory regions All loaded class metadata is saved to a file (the shared archive) New in JDK 9: Applica%on Class Data Sharing (AppCDS) ApplicaTon classes are supported B.class A.class C.class CDS archive 38

39 Class Data Sharing (CDS) - RunTme Archive is memory- mapped RO pages shared, RW pages are shared copy- on- write Classes read from mapped memory without overhead of searching, reading & parsing from JAR files Like shared libraries, archive can be shared across Docker containers 39

40 AppCDS Benefits - Startup Tme and Footprint Example: WebLogic Server Base Domain Time (s) Startup Time 7.7 Size (MB) - Note: Logarithmic! Footprint 4,634 No AppCDS AppCDS 4,073 4, , No AppCDS AppCDS 1 Unique Shared Total Sharing & savings increases with every instance With 10 instances there is ~10% saving in total memory footprint 40

41 Summary OpTmizing a Java Docker Image The naïve Java Docker image is large - 229MB base + 568MB JDK = 797MB Can be significantly reduced Using an appropriate base image 117MB for oraclelinux:7- slim 4MB for alpine:3.6 CreaTng a custom jlinked JRE ~60MB for nery ~46MB for java.base HelloWorld can be packaged with a full JVM in ~30MB AppCDS enables sharing class data across JVM instances and Docker containers 41

42 A quick look at startup Tme 42

43 Ahead- of- Time (AOT) compilaton Does with JIT compiled Java code what AppCDS does with Java class data Pre- compile to shared library: jaotc --output libhelloworld.so HelloWorld.class Use in subsequent runs: java -XX:AOTLibrary=libHelloWorld.so HelloWorld Experimental functonality introduced in JDK 9 Only on linux- x64, other plagorms to follow Benefits Startup performance Reduces Tme to peak performance Saves on footprint by sharing across instances Not- so- secret plan: use for enabling Java- based JIT compiler OpenJDK Project Metropolis aims to move JVM functonality to Java 43

44 Docker+Java startup Tme Example Applica%on Host java Create socket Setup java arguments for ProcessBuilder Start docker image with Java app Docker java Create socket and connect to host Send message and exit 44

45 ExecuTon Analysis Average Startup Time for 50 clients in ms Java no CDS or AOT Java with APPCDS & AOT 600 GO SVM Host Docker Run Docker Exec 45

46 ====================================================================== CDS AOT GC Average start-up time for 50 iterations ====================================================================== NO NO Parallel task-clock (msec) # CPUs utilized ( % ) NO NO ParallelOld task-clock (msec) # CPUs utilized ( % ) NO NO G task-clock (msec) # CPUs utilized ( % ) NO NO Serial task-clock (msec) # CPUs utilized ( % ) NO YES Parallel task-clock (msec) # CPUs utilized ( % ) NO YES ParallelOld task-clock (msec) # CPUs utilized ( % ) NO YES G task-clock (msec) # CPUs utilized ( % ) NO YES Serial task-clock (msec) # CPUs utilized ( % ) YES NO Parallel task-clock (msec) # CPUs utilized ( % ) YES NO ParallelOld task-clock (msec) # CPUs utilized ( % ) YES NO G task-clock (msec) # CPUs utilized ( % ) YES NO Serial task-clock (msec) # CPUs utilized ( % ) YES YES Parallel task-clock (msec) # CPUs utilized ( % ) YES YES ParallelOld task-clock (msec) # CPUs utilized ( % ) YES YES G task-clock (msec) # CPUs utilized ( % ) YES YES Serial task-clock (msec) # CPUs utilized ( % ) 46

47 Q&A 47

48 Stay connected Join us: DevOps Corner (Developer Lounge Moscone West) Learn more: openjdk.java.net #JavaOne #DevOps 48

49

50 Example DockerFile (jdk-9-alpine.dockerfile) for building an image with JDK 9 # A JDK 9 development image for building FROM alpine:3.6 # Add the musl- based JDK 9 distribution RUN mkdir /opt # Download from ADD jdk- 9- ea+181_linux- x64- musl_bin.tar.gz /opt # Set up env variables ENV JAVA_HOME=/opt/jdk- 9 ENV PATH=$PATH:$JAVA_HOME/bin CMD ["java", "- version"] ConfidenTal Oracle Internal/Restricted/Highly Restricted 50

51 Example script (link.sh) using jlink to produce a smaller JDK 9 distributon #!/bin/sh rm - fr jdk- 9- base- ea+181_linux- x64- musl docker run - - rm \ - - volume $PWD:/out \ jdk- 9- alpine \ jlink - - module- path /opt/jdk- 9/jmods \ - - add- modules java.base \ - - compress 2 \ - - no- header- files \ - - output /out/jdk- 9- base- ea+181_linux- x64- musl ConfidenTal Oracle Internal/Restricted/Highly Restricted 51

52 Example DockerFile (jdk-9-base-alpine.dockerfile) for building an image with a custom JDK 9 distributon # Make a docker image with a jlink'ed JDK 9 FROM alpine:3.6 # Add jlink'ed JDK 9 ADD jdk- 9- base- ea+181_linux- x64- musl /opt/jdk- 9 # Set up env variables ENV JAVA_HOME=/opt/jdk- 9 ENV PATH=$PATH:$JAVA_HOME/bin CMD ["java", "- version"] ConfidenTal Oracle Internal/Restricted/Highly Restricted 52

53 Commands to build images # Build an image with JDK 9 docker build - t jdk- 9- alpine - f jdk- 9- alpine.dockerfile. # Create a custom JDK 9 distribution with just the java.base module bash link.sh # Build an image with the custom JDK 9 distribution docker build - t jdk- 9- base- alpine - f jdk- 9- base- alpine.dockerfile. # Run the image docker run - - rm jdk- 9- base- alpine java - - list- modules ConfidenTal Oracle Internal/Restricted/Highly Restricted 53

54 jshell snippets (snippets.txt) long javamaxmem() { return Runtime.getRuntime().maxMemory(); } import java.nio.file.*; long sysmaxmem() throws IOException { return Files.lines(Paths.get("/sys/fs/cgroup/memory/memory.limit_in_bytes")).mapToLong(Long::valueOf).findFirst().getAsLong(); } ConfidenTal Oracle Internal/Restricted/Highly Restricted 54

55 jshell in Docker executon commands # Run without resource restrictions docker run \ - - rm - it - - volume $PWD:/in jdk- 9- alpine \ jshell /in/snippets.txt # Run with resource restrictions but no Java configutation docker run - m=384m - - cpuset- cpus=0 \ - - rm - it - - volume $PWD:/in jdk- 9- alpine \ jshell /in/snippets.txt # Run with resource restrictions and Java configutation docker run - m=384m - - cpuset- cpus=0 \ - - rm - it - - volume $PWD:/in jdk- 9- alpine \ jshell /in/snippets.txt \ - J- XX:+UnlockExperimentalVMOptions - J- XX:+UseCGroupMemoryLimitForHeap \ - R- XX:+UnlockExperimentalVMOptions - R- XX:+UseCGroupMemoryLimitForHeap ConfidenTal Oracle Internal/Restricted/Highly Restricted 55