Demystifying Google Container Tool Jib: Java Image Builder

Are you are wondering what Jib is, actually?. You probably should read my previous article before going ahead.

Jib is an excellent tool for Java developers who are interested in containerizing Java applications but not so interested in creating and maintaining Dockerfile or installing Docker. A Java developer can add a plugin to Maven or Gradle, and that's it. You don't have to learn new technology just to containerize your Java application.

Now let's talk about some internals.

Jib Image Layering

Jib intelligently divides your images into the following layers for more granular incremental builds.

1. Dependencies
2. Resources
3. Classes
4. Snapshot dependencies
5. All other dependencies Each extra directory (jib.extraDirectories in Gradle, in Maven) builds to its own layer

When you do any code changes, only your changes are rebuilt, not your entire application. Which means Jib only pushes the layer which is changed and the rest of the layers remain the same. For example, in the following demo, only a class file was changed and Jib pushed only the compiled class layer. Later on, we could see that during the docker pull only the changed layer was extracted.

Furthermore to dig deeper, now we will use the simple spring boot application that was used in the previous article. The source code is available here. We will run maven in debug mode to understand these layers. However, In the following logs, you will see only dependencies, resources, and classes as separate layers since we don't have other dependencies.

Deep Dive Image Layer

You can inspect images created by Jib using the Dive tool. As you can see on RHS, we have exploded directory structure for classes, resources and dependencies in the following path and their size is very minimal.

/apps/classes,/apps/libs,/apps/resources

Rest of the contents are of your base image.

Dive also tells you if you are wasting any space and if you are then you can discover ways to shrink the size of your Docker/OCI image. However, in our case, no space is wasted :).! You can view the content of an image with a docker history command as well. Let's see what it looks like.

What are Distroless Images?

Google defines distroless images as the following:

Distroless images are lightweight base images as they contain only dependencies required to run your application. They do not contain package managers, shells or any other programs you would expect to find in a standard Linux distribution.

Furthermore the layers created by Jib are created on top of a distroless base image. Jib by default uses distroless Java 8 image but you have the option to choose an image of your choice.

Why Distroless?

1. Less vulnerabilities to patch
2. Better security
3. Built with minimum dependencies

Debugging Distroless Images

Since there are no package managers installed and you cannot do ssh to your container running with distroless base image makes them hard for debugging. In an ideal world, you would add better logging then you know enable shell access for your containers. But there are ways with which you can add shell support and debug your application.

Conclusion

In this article, we have covered some internals about Jib .i.e. image layering which makes it fast. We have also covered distroless images with their benefits and pitfalls like debugging.

Support me

If you like what you just read, then you can buy me a coffee by clicking the link in the image below:

Further reading

You can also read some of my previous articles