Use distroless JDK17-image (#127)

Author: geir-waagboe

.github/workflows/dispatch.yaml

@@ -27,7 +27,7 @@ jobs:
         if: ${{ !env.found_image }}
         uses: actions/setup-java@v1
         with:
-          java-version: '11.x'
+          java-version: '17.x'
       - name: Checkout code
         if: ${{ !env.found_image }}
         uses: actions/checkout@v2
@@ -47,6 +47,15 @@ jobs:
           ORG_GRADLE_PROJECT_githubPassword: ${{ secrets.GITHUB_TOKEN }}
         run: |
           ./gradlew shadowJar -x test
+      - name: Install cosign
+        if: ${{ !env.found_image }}
+        uses: sigstore/cosign-installer@main
+        with:
+          cosign-release: 'v1.3.1'
+      - name: Verify distroless base image
+        if: ${{ !env.found_image }}
+        run: |
+          cosign verify --key distroless.pub gcr.io/distroless/java17
       - name: Build and publish Docker image if not already done
         if: ${{ !env.found_image }}
         env:

.github/workflows/main.yaml

@@ -13,7 +13,7 @@ jobs:
       - name: Setup java
         uses: actions/setup-java@v1
         with:
-          java-version: '11.x'
+          java-version: '17.x'
       - name: Checkout code
         uses: actions/checkout@v1
       - uses: actions/cache@v1
@@ -46,6 +46,13 @@ jobs:
           ORG_GRADLE_PROJECT_githubPassword: ${{ secrets.GITHUB_TOKEN }}
         run: |
           ./gradlew shadowJar -x test
+      - name: Install cosign
+        uses: sigstore/cosign-installer@main
+        with:
+          cosign-release: 'v1.3.1'
+      - name: Verify distroless base image
+        run: |
+          cosign verify --key distroless.pub gcr.io/distroless/java17
       - name: Build and publish Docker image
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Dockerfile

@@ -1,4 +1,8 @@
-FROM navikt/java:11
+FROM gcr.io/distroless/java17
+WORKDIR /app
 COPY build/libs/app.jar app.jar
-ENV JAVA_OPTS="-Dlogback.configurationFile=logback.xml"
-ENV APPLICATION_PROFILE="remote"
+ENV JDK_JAVA_OPTIONS="-XX:MaxRAMPercentage=75 -Dlogback.configurationFile=logback.xml"
+ENV TZ="Europe/Oslo"
+EXPOSE 8080
+USER nonroot
+CMD [ "app.jar" ]

build.gradle.kts

@@ -120,7 +120,7 @@ tasks {
     }
 
     withType<KotlinCompile> {
-        kotlinOptions.jvmTarget = "11"
+        kotlinOptions.jvmTarget = "17"
     }
 
     withType<Test> {

distroless.pub

@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWZzVzkb8A+DbgDpaJId/bOmV8n7Q
+OqxYbK0Iro6GzSmOzxkn+N2AKawLyXi84WSwJQBK//psATakCgAQKkNTAA==
+-----END PUBLIC KEY-----

src/main/kotlin/no/nav/syfo/App.kt

@@ -55,7 +55,7 @@ fun main() {
 
     applicationEngineEnvironment.monitor.subscribe(ApplicationStarted) { application ->
         applicationState.ready = true
-        application.environment.log.info("Application is ready")
+        application.environment.log.info("Application is ready, running Java VM ${Runtime.version()}")
         launchKafkaModule(
             applicationState = applicationState,
             environment = environment,