Base Docker Image Configuration¶

Overview¶

The project allows customization of the base Docker image used for building all service containers. This provides flexibility to:

• Use different JRE distributions (Eclipse Temurin, Amazon Corretto, etc.)
• Switch between image registries
• Use custom base images
• Test with different Java versions or OS distributions

Default Base Image¶

By default, the project uses CentOS with OpenJDK 21:

registryUrl=quay.io/centos
baseImage=centos:latest
installJava=true

This uses a RHEL-compatible base image with Java installed via yum. You can override these settings to use alternative images as needed.

Configuration Parameters¶

Usage¶

Option 1: Command Line Parameter¶

./gradlew clean build podmanize \
  -PregistryUrl=quay.io/centos \
  -PbaseImage=centos:stream9

# or with Docker
./gradlew clean build dockerize \
  -PregistryUrl=quay.io/centos \
  -PbaseImage=centos:stream9

./gradlew clean build podmanize \
  -PregistryUrl=docker.io \
  -PbaseImage=eclipse-temurin:21-jre \
  -PinstallJava=false

Option 2: Modify gradle.properties¶

Edit the gradle.properties file in the project root directory:

# Default (CentOS with OpenJDK 21)
registryUrl=quay.io/centos
baseImage=centos:latest
installJava=true

# Alternative: use a pre-built JRE image
# registryUrl=docker.io
# baseImage=eclipse-temurin:21-jre
# installJava=false

Then run:

./gradlew clean build dockerize
# or
./gradlew clean build podmanize

./gradlew clean build podmanize \
  -PvaultType=hashicorp \
  -PregistryUrl=quay.io/centos \
  -PbaseImage=centos:latest \
  -PinstallJava=true

Validation¶

To verify the base image is being used correctly:

1. Check build output for the FROM statement:

   FROM quay.io/centos/centos:latest
   

2. Inspect the built image:

   podman history <image-name>:latest
   # or
   docker history <image-name>:latest
   

3. Check Java version in container:

   podman run --rm <image-name>:latest java -version
   # or
   docker run --rm <image-name>:latest java -version
   

4. Verify OS and package manager:

   podman run --rm <image-name>:latest cat /etc/os-release
   

Docker Image Structure¶

All Dockerfiles use the following pattern:

ARG REGISTRY_URL="quay.io/centos"
ARG BASE_IMAGE="centos:latest"
FROM ${REGISTRY_URL}/${BASE_IMAGE}
# Set INSTALL_JAVA=false only if the base image already includes a JRE.
ARG INSTALL_JAVA=true

# Optionally install Java 21 via yum
RUN if [ "$INSTALL_JAVA" = "true" ]; then yum update -y && yum clean all; fi
RUN if [ "$INSTALL_JAVA" = "true" ]; then yum install java-21-openjdk -y && yum clean all; fi

# Create a group and user (non-root) with fixed UID/GID
RUN groupadd -g 1000 appuser && useradd -u 1000 -g appuser -s /bin/sh -m appuser

Common Base Image Examples¶

./gradlew podmanize
# Uses default: quay.io/centos/centos:latest with java-21-openjdk

./gradlew podmanize \
  -PregistryUrl=quay.io/centos \
  -PbaseImage=centos:stream9

./gradlew podmanize \
  -PregistryUrl=docker.io \
  -PbaseImage=eclipse-temurin:21-jre-alpine \
  -PinstallJava=false

./gradlew podmanize \
  -PregistryUrl=<your-registry> \
  -PbaseImage=<your-image> \
  -PinstallJava=false

Affected Services¶

All Docker-based services use the configurable base image:

Default Behavior¶

If no parameters are specified, the build defaults to:

You can override these defaults either via command-line parameters or by modifying gradle.properties.

Init Container: cert-installer¶

All component Helm charts include a cert-installer init container that runs before the main application container. Its purpose is to build a Java truststore containing the Vault CA certificate, so the main container can establish a trusted TLS connection to HashiCorp Vault.

How It Works¶

1. Copies the system Java truststore from the image (/etc/pki/ca-trust/extracted/java/cacerts) into a shared emptyDir volume mounted at /opt/ca
2. Sets world-readable permissions (chmod 666) so the main container can read the file
3. Imports the Vault CA certificate (from a Kubernetes Secret) into the truststore via keytool
4. The main container mounts the same emptyDir at /shared and reads the truststore through JAVA_TOOL_OPTIONS

Using a Different Image for the Init Container¶

• Set certInstallerImage to any image that has Java (keytool) available
• Update the cp source path in initContainers inside values.yaml to match the truststore location for your image, as it differs per JRE distribution

• To find the truststore path in your image:

  docker run --rm <your-image> find / -name "cacerts" 2>/dev/null
  

See Also¶

• Vault Selection Guide - Choose between HashiCorp and Azure vault
• Build Overview - Overview of all build options
• Quick Start - Full deployment walkthrough