jlink runtime image size (specifically libjvm.so) created from openjdk is huge. Expected it to be much smaller.

[testphreak]

Description

When building a Docker image for a service based on OpenJDK base image, I noticed that the runtime image created is 346Mb (and specifically the file libjvm.so under /lib/security) in size as compared to OracleLinux base image which creates a runtime image of 49Mb. What is the reason for this huge disparity in size?

I have tried building from different variants of 10 and 11 base images, but I still see the large runtime size.

Configuration

Docker -

Client:
 Version:      18.03.1-ce
 API version:  1.37
 Go version:   go1.9.5
 Git commit:   9ee9f40
 Built:        Thu Apr 26 07:13:02 2018
 OS/Arch:      darwin/amd64
 Experimental: false
 Orchestrator: swarm

Server:
 Engine:
  Version:      18.03.1-ce
  API version:  1.37 (minimum version 1.12)
  Go version:   go1.9.5
  Git commit:   9ee9f40
  Built:        Thu Apr 26 07:22:38 2018
  OS/Arch:      linux/amd64
  Experimental: true

macOS - Sierra (10.12.6)

Dockerfile -

FROM openjdk:10.0.2-slim

RUN jlink \
    --add-modules java.xml.bind,java.sql,java.naming,java.management,java.instrument,java.security.jgss \
    --verbose \
    --strip-debug \
    --compress 2 \
    --no-header-files \
    --no-man-pages \
    --output /opt/jre-minimal

CMD du -sh /opt/jre-minimal

Actual Results

docker run --name ojdk -it openjdk_test
346M	/opt/jre-minimal

Digging a little deeper, it appears the primary reason for this bloat is libjvm.so.

docker run --rm --name openjdk_image_size -it openjdk_test ls -la /opt/jre-minimal/lib/server
total 308028
drwxr-xr-x 2 root root      4096 Jul 23 17:58 .
drwxr-xr-x 5 root root      4096 Jul 23 17:58 ..
-rw-r--r-- 1 root root      1322 Jul 23 17:58 Xusage.txt
-rw-r--r-- 1 root root     24992 Jul 23 17:58 libjsig.so
-rw-r--r-- 1 root root 315379056 Jul 23 17:58 libjvm.so

Expected Results
Expect a much smaller runtime image. For example if I use Oracle Linux as base image,

Dockerfile -

FROM oraclelinux:7-slim

RUN yum -y install wget tar gzip && yum clean all \
    && wget -q https://download.java.net/java/GA/jdk10/10.0.2/19aef61b38124481863b1413dce1855f/13/openjdk-10.0.2_linux-x64_bin.tar.gz \
        -P /opt/jdk \
    && tar -xzf /opt/jdk/openjdk-10.0.2_linux-x64_bin.tar.gz -C /opt/jdk \
    && rm /opt/jdk/openjdk-10.0.2_linux-x64_bin.tar.gz

ENV PATH=${PATH}:/opt/jdk/jdk-10.0.2/bin

RUN jlink \
    --add-modules java.xml.bind,java.sql,java.naming,java.management,java.instrument,java.security.jgss \
    --verbose \
    --strip-debug \
    --compress 2 \
    --no-header-files \
    --no-man-pages \
    --output /opt/jre-minimal

CMD du -sh /opt/jre-minimal

I get a 49Mb image size, which is expected.

docker run --name oracle_linux_jdk -it oraclelinux_jdk_test
49M	/opt/jre-minimal

[tianon]

For the slim images, we consume Debian's OpenJDK packages directly, so unfortunately there's not much we can do here besides recommending taking this up with the Debian package maintainer to try to determine why libjvm.so is so large.

[testphreak]

@tianon it is not just for the slim image. Even the regular images have the problem. Could you build an image from the Dockerfile I provided above to confirm the issue? Just want to make sure it's not machine or Docker specific.

[feskehau]

I have the exact same issue, runing the same jlink command on my local machine creates runtime of about 40 mb, the same command in a container creates a runtime image of 350 mb. Have been debuging all that i can, must be something with the image.

[feskehau]

Tried with slim and reguler, same issue

[panga]

I've verified and the problem started in OpenJDK 10.0.2 (10.0.1 works as expected, small size).
OpenJDK 11 (ea) is also affected.

Note: I couldn't reproduce this downloading the OpenJDK builds from http://jdk.java.net, the issue appears to be something with the OpenJDK builds used by the images on this repo.

[panga]

For comparison:

OpenJDK 11+23

dockerhub image:
404.5M ./lib/server/libjvm.so

downloaded from jdk.java.net:
22M ./lib/server/libjvm.so

[tianon]

We use Debian's packages, so this really needs to be filed at https://bugs.debian.org/src:openjdk-10 (since it's their packages which have the issue -- there's not really anything we can do to make that binary smaller).

[anthraxx]

Back reference to the debian ticket: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=905575

[robilad]

Yeah, in their 10.0.2 build, doko added * Configure with --with-native-debug-symbols=internal.
according to https://tracker.debian.org/news/974018/accepted-openjdk-10-100213-1-source-into-unstable/

See http://hg.openjdk.java.net/jdk/jdk11/raw-file/tip/doc/building.html#native-debug-symbols for details of the option.

[ddriddle]

As a workaround if you run strip on libjvm.so it cuts the file size from 421M down to only 18M!

$ strip -p --strip-unneeded lib/server/libjvm.so