From cba3c0f461c756921486bf79abd07fd591f10a1c Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Wed, 28 Oct 2026 06:31:40 +0000
Subject: [PATCH] [#1238] Leave out of the Docker images what only AWT needs: the headless JRE on alpine, no fontconfig, freetype or brotli on the default image (#1239)
---
opendj-packages/opendj-docker/Dockerfile-alpine | 5 ++++-
.github/workflows/build.yml | 4 ++++
opendj-packages/opendj-docker/Dockerfile | 8 +++++++-
3 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d65e40c..8de66c6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -686,6 +686,10 @@
shell: bash
run: |
trap 'code=$?; echo "::group::container logs (test)"; docker logs test 2>&1 || true; echo "::endgroup::"; exit $code' ERR
+ # the image draws nothing: the OS carries none of what AWT needs to, freetype with brotli, X11 or ALSA.
+ # The temurin JRE of the default image keeps a freetype of its own in /opt/java, linking nothing but libc (#1238)
+ awt=$(docker run --rm --entrypoint sh localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}${{ matrix.suffix }} -c 'find / -xdev \( -name "libfreetype.so*" ! -path "/opt/java/*" -o -name "libbrotli*.so*" -o -name "libX11.so*" -o -name "libasound.so*" \) 2>/dev/null; true')
+ if [ -n "$awt" ]; then echo "::error::The image carries libraries only AWT needs:"; echo "$awt"; false; fi
docker run -it -d --memory="512m" --name=test localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}${{ matrix.suffix }}
# the bootstrap's server is down before the marker the health check waits for is
# written: the stop has logged its record by the time the marker is there
diff --git a/opendj-packages/opendj-docker/Dockerfile b/opendj-packages/opendj-docker/Dockerfile
index e0a549a..6c8dce4 100644
--- a/opendj-packages/opendj-docker/Dockerfile
+++ b/opendj-packages/opendj-docker/Dockerfile
@@ -55,6 +55,12 @@
#COPY opendj-*.zip $OPENDJ_DIST_FILENAME
+# The JRE of the base image has no headless variant, but it draws nothing here: X11 and ALSA are
+# not installed, and the freetype it renders fonts with is a copy of its own that links nothing
+# but libc. What the base image adds for it - fontconfig with the freetype of the OS, brotli and
+# the fonts - is purged along with curl and unzip, and --auto-remove takes the libraries they
+# pulled in (libcurl with its Kerberos, LDAP and SASL libraries among them). The GUI tools
+# (control-panel) are run outside the container, against its admin port.
RUN printf 'Acquire::ForceIPv4 "true";\nAcquire::Retries "5";\n' > /etc/apt/apt.conf.d/99-ci-network \
&& apt-get update \
&& DEBIAN_FRONTEND=noninteractive apt-get upgrade -y \
@@ -62,7 +68,7 @@
&& if [ -z "$VERSION" ] ; then VERSION="$(curl -i -o - --silent https://api.github.com/repos/OpenIdentityPlatform/OpenDJ/releases/latest | grep -m1 "\"name\"" | cut -d\" -f4)"; fi \
&& if [ ! -f "$OPENDJ_DIST_FILENAME" ]; then echo file exists && curl -L https://github.com/OpenIdentityPlatform/OpenDJ/releases/download/$VERSION/opendj-$VERSION.zip --output $OPENDJ_DIST_FILENAME; fi \
&& unzip $OPENDJ_DIST_FILENAME \
- && apt-get remove -y --purge curl unzip \
+ && apt-get purge -y --auto-remove curl unzip fontconfig libfreetype6 \
&& rm -rf /var/lib/apt/lists/* /etc/apt/apt.conf.d/99-ci-network \
&& rm -r $OPENDJ_DIST_FILENAME \
&& groupadd $OPENDJ_USER \
diff --git a/opendj-packages/opendj-docker/Dockerfile-alpine b/opendj-packages/opendj-docker/Dockerfile-alpine
index 44957c4..3dabe5f 100644
--- a/opendj-packages/opendj-docker/Dockerfile-alpine
+++ b/opendj-packages/opendj-docker/Dockerfile-alpine
@@ -57,9 +57,12 @@
#COPY opendj-*.zip $OPENDJ_DIST_FILENAME
+# The headless JRE: the server and the command-line tools do not draw, and the full JRE only
+# adds what AWT needs to - X11, ALSA, freetype with brotli, the image codecs - along with their
+# CVEs. The GUI tools (control-panel) are run outside the container, against its admin port.
RUN apk add --update --no-cache --virtual builddeps curl unzip \
&& apk upgrade --update --no-cache \
- && if [ "$TARGETARCH" = "386" ]; then JDK=openjdk11-jre; else JDK=openjdk25-jre; fi \
+ && if [ "$TARGETARCH" = "386" ]; then JDK=openjdk11-jre-headless; else JDK=openjdk25-jre-headless; fi \
&& apk add bash coreutils "$JDK" \
&& if [ -z "$VERSION" ] ; then VERSION="$(curl -i -o - --silent https://api.github.com/repos/OpenIdentityPlatform/OpenDJ/releases/latest | grep -m1 "\"name\"" | cut -d\" -f4)"; fi \
&& if [ ! -f "$OPENDJ_DIST_FILENAME" ]; then echo file exists && curl -L https://github.com/OpenIdentityPlatform/OpenDJ/releases/download/$VERSION/opendj-$VERSION.zip --output $OPENDJ_DIST_FILENAME; fi \
--
Gitblit v1.10.0