JDConf 2025 - Paketo Buildpacks : the best way to build Java container images
0 likes18 views
Buildpacks have been in use for more than 10 years. Initially, they were used to detect and build an application before deploying it to various PaaS platforms. Later, with the advent of their latest generation, Cloud Native Buildpacks (CNCF incubating), it became possible to create Docker (OCI) images. This session will explore whether buildpacks are a suitable alternative to the Dockerfile, explain what Paketo buildpacks are, and discuss the supporting community and their methods. The session will include demonstrations.
![Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom.
All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
What are buildpacks?
Detect and build!
===> DETECTING
[detector] paketo-buildpacks/ca-certificates
[detector] paketo-buildpacks/bellsoft-liberica
[detector] paketo-buildpacks/syft
[detector] paketo-buildpacks/maven
[detector] paketo-buildpacks/executable-jar
[detector] paketo-buildpacks/spring-boot
Java Buildpack ⚙
java –jar my-app.jar
===> BUILDING
[builder] Paketo Buildpack for BellSoft Liberica
[builder] Downloading from https://github.com/bell-sw/etc/bellsoft-jdk21.0.6+10-linux-aarch64.tar.gz
[builder] Paketo Buildpack for Maven
[builder] Executing mvnw --batch-mode -Dmaven.test.skip=true --no-transfer-progress package
[builder] Paketo Buildpack for Spring Boot
[builder] Downloading from https://repo1.maven.org/etc/2.0.4/spring-cloud-bindings-2.0.4.jar](https://image.slidesharecdn.com/jdconf2025-paketobuildpacksthebestwaytobuildjavacontainerimages-1-250410050951-b43e2c7b/85/JDConf-2025-Paketo-Buildpacks-the-best-way-to-build-Java-container-images-3-320.jpg)
![Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom.
All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
Why Paketo buildpacks over … the Dockerfile?
Benefit from maintainers expertise
FROM openjdk
COPY target/*runner.jar
/app/app-runner.jar
WORKDIR /app
EXPOSE 8080
ENTRYPOINT [ "java","-jar" ]
CMD ["app-runner.jar" ]
java –jar app-runner.jar
pack build my-app
--builder paketobuildpacks/build
er-jammy-base
Setting Active Processor Count to 5
Calculating JVM memory based on 15788052K available memory
Calculated JVM Memory Configuration: -XX:MaxDirectMemorySize=10M
-Xmx15397353K -XX:MaxMetaspaceSize=83498K
-XX:ReservedCodeCacheSize=240M -Xss1M (Total Memory: 15788052K,
Thread Count: 50, Loaded Class Count: 12328, Headroom: 0%)
Enabling Java Native Memory Tracking
Adding 137 container CA certificates to JVM truststore
Spring Cloud Bindings Enabled
Picked up JAVA_TOOL_OPTIONS:
-Djava.security.properties=/layers/paketo-buildpacks_bellsoft-libe
rica/java-security-properties/java-security.properties
-XX:+ExitOnOutOfMemoryError -XX:ActiveProcessorCount=5
-XX:MaxDirectMemorySize=10M -Xmx15397353K
-XX:MaxMetaspaceSize=83498K -XX:ReservedCodeCacheSize=240M -Xss1M
-XX:+UnlockDiagnosticVMOptions -XX:NativeMemoryTracking=summary
-XX:+PrintNMTStatistics
-Dorg.springframework.cloud.bindings.boot.enable=true](https://image.slidesharecdn.com/jdconf2025-paketobuildpacksthebestwaytobuildjavacontainerimages-1-250410050951-b43e2c7b/85/JDConf-2025-Paketo-Buildpacks-the-best-way-to-build-Java-container-images-7-320.jpg)
![Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom.
All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
Why Paketo buildpacks over … the Dockerfile?
Benefit from the ecosystem for common use cases : custom CA certificate
FROM openjdk
WORKDIR /app
COPY custom-ca.crt /app
RUN keytool -importcert -file custom-ca.crt
EXPOSE 8080
ENTRYPOINT [ "java","-jar" ]
CMD ["app-runner.jar" ]
FROM golang:1.15 AS builder
RUN apk update
RUN apk add -U --no-cache ca-certificates &&
update-ca-certificates
WORKDIR /GreetingAPI
COPY . /greeting
WORKDIR /greeting
ENV GO111MODULE=on
RUN CGO_ENABLED =0 GOOS=linux go build -o greeting
FROM scratch
COPY --from=builder /etc/ssl/certs/ca-certificates.crt
/etc/ssl/certs/
COPY --from=builder /greeting .
CMD ["./greeting" ]
pack build my-app
--builder paketobuild
packs/builder-jammy-base
--volume
$PWD/ca-certs/:/bindings/my-cert
s
pack build my-app
--builder paketobuild
packs/builder-jammy-base
--volume
$PWD/ca-certs/:/bindings/my-cert
s](https://image.slidesharecdn.com/jdconf2025-paketobuildpacksthebestwaytobuildjavacontainerimages-1-250410050951-b43e2c7b/85/JDConf-2025-Paketo-Buildpacks-the-best-way-to-build-Java-container-images-8-320.jpg)
Ad
More Related Content
Similar to JDConf 2025 - Paketo Buildpacks : the best way to build Java container images (20)
More from Anthony Dahanne (16)
Ad
Recently uploaded (20)
![Get & Download Wondershare Filmora Crack Latest [2025]](https://cdn.slidesharecdn.com/ss_thumbnails/revolutionizingresidentialwi-fi-250422112639-60fb726f-250429170801-59e1b240-thumbnail.jpg?width=560&fit=bounds)
Ad
JDConf 2025 - Paketo Buildpacks : the best way to build Java container images
- 1. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. Paketo Buildpacks: The Best Way to Build Java Container Images? JDConf 2025 Thursday April 10th - 1:00PM SGT Anthony Dahanne, Software Developer @[email protected] @anthony.dahanne.net https://blog.dahanne.net Tanzu Division, Broadcom David O’Sullivan, Software Developer https://github.com/pivotal-david-osullivan
- 2. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. Agenda ● What are buildpacks? ● Compare some use cases with Dockerfiles ● Buildpacks usage
- 3. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. What are buildpacks? Detect and build! ===> DETECTING [detector] paketo-buildpacks/ca-certificates [detector] paketo-buildpacks/bellsoft-liberica [detector] paketo-buildpacks/syft [detector] paketo-buildpacks/maven [detector] paketo-buildpacks/executable-jar [detector] paketo-buildpacks/spring-boot Java Buildpack ⚙ java –jar my-app.jar ===> BUILDING [builder] Paketo Buildpack for BellSoft Liberica [builder] Downloading from https://github.com/bell-sw/etc/bellsoft-jdk21.0.6+10-linux-aarch64.tar.gz [builder] Paketo Buildpack for Maven [builder] Executing mvnw --batch-mode -Dmaven.test.skip=true --no-transfer-progress package [builder] Paketo Buildpack for Spring Boot [builder] Downloading from https://repo1.maven.org/etc/2.0.4/spring-cloud-bindings-2.0.4.jar
- 4. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. What are buildpacks? Many iterations across the years! https://buildpacks.io 2011 2014’ish 2018 Other kind of buildpacks exist too! ● Nixpacks ● Custom shell scripts!
- 5. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. Where do they come from? A spec and CLI under the CNCF umbrella https://buildpacks.io https://github.com/buildpacks
- 6. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. What’s a Paketo? OSS buildpacks implementations https://paketo.io https://github.com/paketo-buildpacks
- 7. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. Why Paketo buildpacks over … the Dockerfile? Benefit from maintainers expertise FROM openjdk COPY target/*runner.jar /app/app-runner.jar WORKDIR /app EXPOSE 8080 ENTRYPOINT [ "java","-jar" ] CMD ["app-runner.jar" ] java –jar app-runner.jar pack build my-app --builder paketobuildpacks/build er-jammy-base Setting Active Processor Count to 5 Calculating JVM memory based on 15788052K available memory Calculated JVM Memory Configuration: -XX:MaxDirectMemorySize=10M -Xmx15397353K -XX:MaxMetaspaceSize=83498K -XX:ReservedCodeCacheSize=240M -Xss1M (Total Memory: 15788052K, Thread Count: 50, Loaded Class Count: 12328, Headroom: 0%) Enabling Java Native Memory Tracking Adding 137 container CA certificates to JVM truststore Spring Cloud Bindings Enabled Picked up JAVA_TOOL_OPTIONS: -Djava.security.properties=/layers/paketo-buildpacks_bellsoft-libe rica/java-security-properties/java-security.properties -XX:+ExitOnOutOfMemoryError -XX:ActiveProcessorCount=5 -XX:MaxDirectMemorySize=10M -Xmx15397353K -XX:MaxMetaspaceSize=83498K -XX:ReservedCodeCacheSize=240M -Xss1M -XX:+UnlockDiagnosticVMOptions -XX:NativeMemoryTracking=summary -XX:+PrintNMTStatistics -Dorg.springframework.cloud.bindings.boot.enable=true
- 8. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. Why Paketo buildpacks over … the Dockerfile? Benefit from the ecosystem for common use cases : custom CA certificate FROM openjdk WORKDIR /app COPY custom-ca.crt /app RUN keytool -importcert -file custom-ca.crt EXPOSE 8080 ENTRYPOINT [ "java","-jar" ] CMD ["app-runner.jar" ] FROM golang:1.15 AS builder RUN apk update RUN apk add -U --no-cache ca-certificates && update-ca-certificates WORKDIR /GreetingAPI COPY . /greeting WORKDIR /greeting ENV GO111MODULE=on RUN CGO_ENABLED =0 GOOS=linux go build -o greeting FROM scratch COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ COPY --from=builder /greeting . CMD ["./greeting" ] pack build my-app --builder paketobuild packs/builder-jammy-base --volume $PWD/ca-certs/:/bindings/my-cert s pack build my-app --builder paketobuild packs/builder-jammy-base --volume $PWD/ca-certs/:/bindings/my-cert s
- 9. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. Why Paketo buildpacks over … the Dockerfile? SBOM generation out of the box! pack sbom download myapp --output-dir ./app-sbom
- 10. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. Why Paketo buildpacks over … the Dockerfile? Third party agents integration! ● At build time, the agent is included ● At runtime, the agent is configured pack build apps/maven -e BP_DATADOG_ENABLED=true docker run apps/maven -e BPL_JMX_ENABLED=true -e BPL_JMX_PORT=8000 -e DD_ENV=paketo-prod -e DD_SERVICE=paketo-maven -e DD_VERSION=1.0 -e DD_PROFILING_ENABLED=true
- 11. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. Demo time! Let’s build some Java apps! ● Create a project from https://start.spring.io ○ Use the pack CLI to build the container image ■ pack build my-app -B builder-jammy-java-tiny ■ docker run my-app ○ Use Spring Boot plugin to build the container image ■ ./mvnw spring-boot:build-image ■ docker run demo:0.0.1-SNAPSHOT ○ Done!
- 12. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. Pack CLI Build Demo
- 13. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. Spring Boot Plugin Demo
- 14. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. Java Paketo Buildpacks goodies Building java container images, the best way ● Choose your Java version easily! ○ BP_JVM_VERSION=24 ● Choose your Java vendor easily! <buildpacks> <buildpack>gcr.io/paketo-buildpacks/microsoft-openjdk-/buildpack> <buildpack>urn:cnb:builder:paketo-buildpacks/java-/buildpack> -/buildpacks> ● Rely on Memory Calculator to customize your JVM arguments ● Spring Boot optimizations ○ spring-cloud-bindings ○ Class Data Sharing training run ○ Spring generation ● Let’s see those in action, in the project spring-restbucks ○ https://github.com/odrotbohm/spring-restbucks
- 15. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
- 16. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. How to integrate them to my existing pipelines? Are there some tools that can run buildpacks for me? ● Spring Boot Maven / Gradle plugins ○ Quarkus too! ● Building images natively from Kubernetes, using kpack ● From your favorite CI tool ○ Github Actions ○ Gitlab CI/CD ○ Jenkins ● From your favorite PaaS ○ Fly.io, Heroku, Porter ● Or cloud provider ○ GCP Cloud Run, Azure Container Apps
- 17. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. Thank You
- 18. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
- 19. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. Montréal co-lead Your presenter for this session Java and Go developer, Cloud architect, Devops guy… But also community leader! Devoxx4Kids Québec co-lead CNCF Eastern Canada co-organizer
- 20. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. What are buildpacks? Detect and build! Python Buildpack ⚙ NodeJS Buildpack ⚙ Java Buildpack ⚙ java –jar my-app.jar node server.js python3 server.py
- 21. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. What are buildpacks? Heroku, the OG
- 22. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. What are buildpacks? Cloud Foundry: the open-source PaaS
- 23. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. What are buildpacks? Detect and build an OCI image!!
- 24. Broadcom Proprietary and Confidential. Copyright © 2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. Demo time! Let’s create a very simple Java buildpack! ● For that we can bootstrap with: ● bin/detect returns 0 when there’s a pom.xml ● bin/build fetches a JDK and creates the java -jar entrypoint ● The rest is just metadata for pack and lifecycle pack buildpack new nantes/java --api 0.8 --path java-buildpack --version 0.0.1