{"id":20537095,"url":"https://github.com/afrouper/jlink-boot","last_synced_at":"2025-03-06T03:39:33.648Z","repository":{"id":193996910,"uuid":"689886642","full_name":"Afrouper/jlink-boot","owner":"Afrouper","description":"Create a secure custom JVM with link automatically","archived":false,"fork":false,"pushed_at":"2025-02-25T05:10:50.000Z","size":54,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-02-25T06:20:20.649Z","etag":null,"topics":["java","jdeps","jlink","jvm","secure"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Afrouper.png","metadata":{"files":{"readme":"README.MD","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-09-11T05:47:52.000Z","updated_at":"2025-02-25T05:10:50.000Z","dependencies_parsed_at":"2024-02-26T20:32:14.395Z","dependency_job_id":"ecfb480b-f281-45f4-84f4-33b49f2b9460","html_url":"https://github.com/Afrouper/jlink-boot","commit_stats":null,"previous_names":["afrouper/klink-boot"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Afrouper%2Fjlink-boot","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Afrouper%2Fjlink-boot/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Afrouper%2Fjlink-boot/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Afrouper%2Fjlink-boot/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Afrouper","download_url":"https://codeload.github.com/Afrouper/jlink-boot/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":242144500,"owners_count":20078964,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["java","jdeps","jlink","jvm","secure"],"created_at":"2024-11-16T00:38:54.649Z","updated_at":"2025-03-06T03:39:33.613Z","avatar_url":"https://github.com/Afrouper.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Using JLink to create a custom and secure JVM\n\nIt is recommended not to use a plain JDK (or much better a JRE) at production stage. You get all the\nstuff you did not need and also some critical vulnerabilities. As there are often CVEs in the desktop/client\nparts of the JVM you can simple remove them.\n\nThis is a example how to create a custom JVM with jlink for a application build with maven. In this\nsample we are using spring boot, but this does not matter and works also with Quarkus or plain Java\nprograms.\n\n## Extend Maven\nExtend Maven with a plugin to get a list or all maven java dependencies.\nUse the `maven-dependency-plugin` in the build section:\n\n```xml\n\u003cplugin\u003e\n    \u003cartifactId\u003emaven-dependency-plugin\u003c/artifactId\u003e\n    \u003cversion\u003e3.6.1\u003c/version\u003e\n    \u003cexecutions\u003e\n        \u003cexecution\u003e\n            \u003cid\u003ecopy-dependencies\u003c/id\u003e\n            \u003cphase\u003epackage\u003c/phase\u003e\n            \u003cgoals\u003e\n                \u003cgoal\u003ecopy-dependencies\u003c/goal\u003e\n            \u003c/goals\u003e\n            \u003cconfiguration\u003e\n                \u003coutputDirectory\u003e${project.build.directory}/dependency\u003c/outputDirectory\u003e\n            \u003c/configuration\u003e\n        \u003c/execution\u003e\n    \u003c/executions\u003e\n\u003c/plugin\u003e\n```\nThis will copy all JARs in the given folder.\n\n## Determine Java modules and create JVM\nWith the tool `jdeps` it is possible to create a list of Java modules which are needed from the\napplication:\n```shell\njdeps --ignore-missing-deps -q --recursive --multi-release 17 --print-module-deps --class-path 'target/dependency/*' target/*.jar \u003e target/deps.info\n```\n\nAfter getting a complete list of the used Java modules the tool `jlink` can create a custom JVM\ncontaining only the needed Java modules:\n```shell\njlink  --add-modules \"$(cat target/deps.info)\" --strip-debug --compress 2 --no-header-files --no-man-pages --output target/jvm\n```\n\nAfter this the JVM is placed in `target/jvm` and can be used.\n\n\u003e [!IMPORTANT]  \n\u003e The JVM is created for the system/architecture it is running for!\n\n# Additional Hints\n## Optimized build\nThe script `buildJvm.sh` contains all steps to create the custom JVM. It also uses the command\n`strip` to shrink the size of the created libraries to address a [bug](https://github.com/docker-library/openjdk/issues/217)\nin some jlink implementations which still exists.\n\n## Docker multistage build\nIn `Dockerfile` is shown how to create a custom JVM in a multistage docker build\n(this should worked in all environments) and use a very small [distroless](https://github.com/GoogleContainerTools/distroless)\nimage at runtime.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fafrouper%2Fjlink-boot","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fafrouper%2Fjlink-boot","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fafrouper%2Fjlink-boot/lists"}