Tune start script for OpenJDK 25 and use it in Docker image

Signed-off-by: Fabio Di Fabio <[email protected]>

Author: fab-10

app/src/main/scripts/unixStartScript.txt

@@ -43,9 +43,6 @@ cd "\$SAVED" >/dev/null
 APP_NAME="${applicationName}"
 APP_BASE_NAME=`basename "\$0"`
 
-# Add default JVM options here. You can also use JAVA_OPTS and ${optsEnvironmentVar} to pass JVM options to this script.
-DEFAULT_JVM_OPTS=${defaultJvmOpts}
-
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD="maximum"
 
@@ -105,6 +102,18 @@ Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
 fi
 
+JAVA_VERSION=`"\$JAVA_HOME/bin/java" -version 2>&1 | fgrep version | cut -d' ' -f3 | tr -d '"' | cut -d. -f1`
+
+# Add default JVM options here. You can also use JAVA_OPTS and ${optsEnvironmentVar} to pass JVM options to this script.
+if [ "\$JAVA_VERSION" -ge 25 ]; then
+    DEFAULT_JVM_OPTS=@DEFAULT_JVM_OPTS_25@
+elif [ "\$JAVA_VERSION" -ge 21 ]; then
+    DEFAULT_JVM_OPTS=${defaultJvmOpts}
+else
+    echo "Java version must be at least 21"
+    exit 1
+fi
+
 # Increase the maximum file descriptors if we can.
 if [ "\$cygwin" = "false" -a "\$darwin" = "false" -a "\$nonstop" = "false" ] ; then
     MAX_FD_LIMIT=`ulimit -H -n`

build.gradle

@@ -714,11 +714,14 @@ run {
   }
 }
 
-def tweakStartScript(createScriptTask) {
+def tweakStartScript(createScriptTask, defaultJvmOpts25) {
   def shortenWindowsClasspath = { line ->
     line.replaceAll(/^set CLASSPATH=.*$/, "set CLASSPATH=%APP_HOME%/lib/*")
   }
 
+  // this must be before the BESU_HOME replacement
+  createScriptTask.unixScript.text = createScriptTask.unixScript.text.replace('@DEFAULT_JVM_OPTS_25@', defaultJvmOpts25)
+
   createScriptTask.unixScript.text = createScriptTask.unixScript.text.replace('BESU_HOME', '\$APP_HOME')
   createScriptTask.windowsScript.text = createScriptTask.windowsScript.text.replace('BESU_HOME', '%~dp0..')
 
@@ -730,17 +733,32 @@ def tweakStartScript(createScriptTask) {
     .join('\r\n')
 }
 
+def defaultJvmOpts21 = application.applicationDefaultJvmArgs + [
+  "-XX:G1ConcRefinementThreads=2",
+  "-XX:G1HeapWastePercent=15",
+  "-XX:MaxGCPauseMillis=100",
+  "-XX:StartFlightRecording,settings=default.jfc",
+  "-Xlog:jfr*=off"
+]
+
+def defaultJvmOpts25 = defaultJvmOpts21 +   [
+  "-XX:+UseCompactObjectHeaders",
+  "-XX:MaxHeapFreeRatio=30",
+  "-XX:MinHeapFreeRatio=10",
+  "-XX:GCTimeRatio=50",
+  "-XX:-ShrinkHeapInSteps"
+]
+
+def serializeDefaultJvmOpts(opts) {
+  return "'" + opts.collect{ /"$it"/}.join(' ') + "'"
+}
+
 startScripts {
-  defaultJvmOpts = application.applicationDefaultJvmArgs + [
-    "-XX:G1ConcRefinementThreads=2",
-    "-XX:G1HeapWastePercent=15",
-    "-XX:MaxGCPauseMillis=100",
-    "-XX:StartFlightRecording,settings=default.jfc",
-    "-Xlog:jfr*=off"
-  ]
+  defaultJvmOpts = defaultJvmOpts21
   unixStartScriptGenerator.template = resources.text.fromFile("${projectDir}/app/src/main/scripts/unixStartScript.txt")
   windowsStartScriptGenerator.template = resources.text.fromFile("${projectDir}/app/src/main/scripts/windowsStartScript.txt")
-  doLast { tweakStartScript(startScripts) }
+
+  doLast { tweakStartScript(startScripts, serializeDefaultJvmOpts(defaultJvmOpts25)) }
 }
 
 task untunedStartScripts(type: CreateStartScripts) {
@@ -751,7 +769,7 @@ task untunedStartScripts(type: CreateStartScripts) {
   defaultJvmOpts = application.applicationDefaultJvmArgs
   unixStartScriptGenerator.template = resources.text.fromFile("${projectDir}/app/src/main/scripts/unixStartScript.txt")
   windowsStartScriptGenerator.template = resources.text.fromFile("${projectDir}/app/src/main/scripts/windowsStartScript.txt")
-  doLast { tweakStartScript(untunedStartScripts) }
+  doLast { tweakStartScript(untunedStartScripts, serializeDefaultJvmOpts(application.applicationDefaultJvmArgs)) }
 }
 
 task evmToolStartScripts(type: CreateStartScripts) {
@@ -764,7 +782,7 @@ task evmToolStartScripts(type: CreateStartScripts) {
   ]
   unixStartScriptGenerator.template = resources.text.fromFile("${projectDir}/app/src/main/scripts/unixStartScript.txt")
   windowsStartScriptGenerator.template = resources.text.fromFile("${projectDir}/app/src/main/scripts/windowsStartScript.txt")
-  doLast { tweakStartScript(evmToolStartScripts) }
+  doLast { tweakStartScript(evmToolStartScripts, serializeDefaultJvmOpts(defaultJvmOpts)) }
 }
 
 task autocomplete(type: JavaExec) {

docker/Dockerfile

@@ -1,12 +1,13 @@
 FROM ubuntu:24.04
+ARG TARGETARCH
 ARG VERSION="dev"
 ENV NO_PROXY_CACHE="-o Acquire::BrokenProxy=true -o Acquire::http::No-Cache=true -o Acquire::http::Pipeline-Depth=0"
 
 # Update and install dependencies without using any cache
 RUN apt-get update $NO_PROXY_CACHE  && \
   # $NO_PROXY_CACHE must not be used here or otherwise will trigger a hadolint error
   apt-get -o Acquire::BrokenProxy=true -o Acquire::http::No-Cache=true -o Acquire::http::Pipeline-Depth=0 \
-    --no-install-recommends -q --assume-yes install openjdk-21-jre-headless=21* libjemalloc-dev=5.* adduser=3*  && \
+    --no-install-recommends -q --assume-yes install libjemalloc-dev=5.* adduser=3* wget=1* ca-certificates=2* && \
   # Clean apt cache
   apt-get clean  && \
   rm -rf /var/cache/apt/archives/* /var/cache/apt/archives/partial/*  && \
@@ -16,7 +17,24 @@ RUN apt-get update $NO_PROXY_CACHE  && \
   # Ensure we use a stable UID for besu, as file permissions are tied to UIDs.
   adduser --uid 1000 --disabled-password --gecos "" --home /opt/besu besu  && \
   chown besu:besu /opt/besu  && \
-  chmod 0755 /opt/besu
+  chmod 0755 /opt/besu && \
+  case "${TARGETARCH}" in \
+        amd64) JDK_ARCH=x64 \
+               CHECKSUM=59cdcaf255add4721de38eb411d4ecfe779356b61fb671aee63c7dec78054c2b \
+               ;; \
+        arm64) JDK_ARCH=aarch64 \
+               CHECKSUM=f4a8d27429458a529148f90ebafcd1ae9b1968fa323f9e5e40d579a5c8c0288f \
+               ;; \
+        *) echo "Unsupported architecture: ${TARGETARCH}" && exit 1 ;; \
+  esac && \
+  wget -q "https://download.java.net/java/GA/jdk25/bd75d5f9689641da8e1daabeccb5528b/36/GPL/openjdk-25_linux-${JDK_ARCH}_bin.tar.gz" && \
+  if [ "$(sha256sum "openjdk-25_linux-${JDK_ARCH}_bin.tar.gz")" != "${CHECKSUM}  openjdk-25_linux-${JDK_ARCH}_bin.tar.gz" ]; \
+  then \
+    echo "Checksum failed" && exit 1; \
+  else \
+    tar -xzf "openjdk-25_linux-${JDK_ARCH}_bin.tar.gz" -C /opt ; \
+    rm "openjdk-25_linux-${JDK_ARCH}_bin.tar.gz"; \
+  fi
 
 ARG BESU_USER=besu
 USER ${BESU_USER}
@@ -49,8 +67,9 @@ ENV BESU_GRAPHQL_HTTP_HOST 0.0.0.0
 ENV BESU_PID_PATH "/tmp/pid"
 ENV OTEL_RESOURCE_ATTRIBUTES="service.name=besu,service.version=$VERSION"
 
+ENV JAVA_HOME="/opt/jdk-25"
 ENV OLDPATH="${PATH}"
-ENV PATH="/opt/besu/bin:${OLDPATH}"
+ENV PATH="/opt/besu/bin:${JAVA_HOME}/bin:${OLDPATH}"
 
 # The entry script just sets permissions as needed based on besu config
 # and is replaced by the besu process running as besu user.