Skip to content

Modernizes the OpenICF Docker images and broadens their multi-architecture build matrix#95

Open
vharseko wants to merge 1 commit into
OpenIdentityPlatform:masterfrom
vharseko:features/docker2
Open

Modernizes the OpenICF Docker images and broadens their multi-architecture build matrix#95
vharseko wants to merge 1 commit into
OpenIdentityPlatform:masterfrom
vharseko:features/docker2

Conversation

@vharseko

Copy link
Copy Markdown
Member

Summary

Modernizes the OpenICF Docker images and broadens their multi-architecture build matrix.

  • Ubuntu image (Dockerfile): switch the base image from eclipse-temurin:25-jre-jammy to eclipse-temurin:25-jre-noble (Ubuntu 22.04 → 24.04) and add linux/riscv64 to its build platforms.
  • Alpine image (Dockerfile-alpine): add linux/386 and linux/riscv64, and select the JDK per target architecture instead of hard-coding openjdk11-jre.
  • Apply the platform changes to both the build.yml and release.yml workflows.
  • Print the container log at the end of each "Docker test" step in build.yml.

Platform coverage

Image Platforms
Ubuntu / Noble (Dockerfile) linux/amd64, linux/arm64/8, linux/ppc64le, linux/s390x, linux/riscv64
Alpine (Dockerfile-alpine) linux/amd64, linux/arm64/8, linux/s390x, linux/ppc64le, linux/386, linux/riscv64

Conditional JDK on Alpine

Alpine's package repositories do not offer a single OpenJDK version that covers every target architecture:

  • 32-bit x86 (linux/386) only has openjdk11 (no 32-bit build of newer JDKs).
  • riscv64 only has openjdk21/openjdk25 (no openjdk11).

Dockerfile-alpine therefore declares ARG TARGETARCH and installs:

  • openjdk11-jre on linux/386
  • openjdk25-jre on every other architecture (aligns the Alpine runtime with the Ubuntu image's JRE 25)

Java 25 LDAP connector flag

Because the Alpine image now runs Java 25 on every architecture except linux/386, its OPENICF_OPTS gains --add-exports java.base/com.sun.jndi.ldap=ALL-UNNAMED, matching the Ubuntu image. The flag is required for the LDAP connector under Java's strong encapsulation and is harmless on Java 11.

Notes

  • linux/arm/v6 (armhf) and linux/arm/v7 (armv7) are intentionally not included: Alpine ships no OpenJDK for those architectures at any version, and eclipse-temurin does not publish them either, so an OpenICF image cannot be produced for them.

Testing

  • build-docker (Ubuntu/Noble) and build-docker-alpine jobs build successfully across all listed platforms, including the existing "Docker test" health-check smoke test (now followed by docker logs test).
  • JDK package selection verified per architecture: openjdk11-jre on linux/386, openjdk25-jre elsewhere.

- Bump Dockerfile base image from eclipse-temurin:25-jre-jammy to 25-jre-noble (Ubuntu 24.04)
- Add linux/riscv64 to the multi-arch build for the Ubuntu-based image
- Add linux/386 and linux/riscv64 to the Alpine image build
- Dockerfile-alpine: declare ARG TARGETARCH and select the JDK per target arch
  (openjdk11-jre on linux/386, openjdk25-jre on every other architecture)
- Add --add-exports java.base/com.sun.jndi.ldap=ALL-UNNAMED to the Alpine OPENICF_OPTS
  so the LDAP connector keeps working on Java 25
- Apply the platform changes to both build.yml and release.yml workflows
- Print container logs at the end of each "Docker test" step in build.yml
@vharseko vharseko requested a review from maximthomas June 23, 2026 18:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants