Hermetic Java (static image packaging/formatting) investigation and proposal

[Jiangli Zhou]

Hi,

During the last one and a half years, Google has done some extensive
research on linux-x64 with Java static image, as project Hermetic Java [1
<http://cr.openjdk.java.net/~jiangli/hermetic_java.pdf>]. We would like to
share our experiences/results with the community and present our approach
for discussion under the Leyden project. We hope to contribute the work to
OpenJDK through project Leyden, via the JEP [2
<http://cr.openjdk.java.net/~mr/jep/jep-2.0-02.html>] process as needed.

With Hermetic Java, our main goal is to create a single executable image
including the Java runtime environment, Java application and the
dependencies. This addresses some real-world Java deployment issues and
challenges that we have encountered over the years.  We believe it fits
very well with the overall goal of project Leyden in the following aspects:

   -

   Provide a build-time created static image derived from an application
   and JDK; Image executes as a standalone program.
   -

   Satisfy closed-world constraints.
   -

   Is built on top of OpenJDK and can utilize existing OpenJDK components
   including the Hotspot VM, runtime JIT compiler (C1, C2), CDS, etc.

Our focus has been on the image packaging and formatting part. This works
roughly as follows:


   1.

   The executable image (see slide
   <http://cr.openjdk.java.net/~jiangli/hermetic_java.pdf> #10 of [1
   <http://cr.openjdk.java.net/~jiangli/hermetic_java.pdf>]) consists of
   three sections: the ELF executable section (see slide
   <http://cr.openjdk.java.net/~jiangli/hermetic_java.pdf> #14), the JDK
   runtime section (see slide
   <http://cr.openjdk.java.net/~jiangli/hermetic_java.pdf> #20, #21) and
   the JAR section (see slide
   <http://cr.openjdk.java.net/~jiangli/hermetic_java.pdf> #22).


The ELF section is at the beginning of the image and contains the Java
launcher executable, which allows the image to work as a native executable.
The JDK runtime section contains the JDK lib/modules image starting at a
page-aligned file offset. This section can include other data that requires
special alignment, such as the CDS archive. The JAR section holds the Java
application classes, dependent library classes, and resources. JDK runtime
resource files, such as java.security and java.policy are also packaged
within the JAR section.


   1.

   The Java launcher executable is statically linked with Hotspot/JDK
   natives and application JNI natives (see slide
   <http://cr.openjdk.java.net/~jiangli/hermetic_java.pdf> #15 - #18).


For static native library support, we enhance and complete existing OpenJDK
work [3 <https://bugs.openjdk.org/browse/JDK-8005716>, 4
<https://bugs.openjdk.org/browse/JDK-8136556>, 5
<https://bugs.openjdk.org/browse/JDK-8232748>]. It provides a flexible
solution for loading built-in (static) native libraries while still
allowing dynamically loading shared JNI libraries (if desired).


   1.

   With a single executable image, we define the image file path as the
   java.home (see slide
   <http://cr.openjdk.java.net/~jiangli/hermetic_java.pdf> #23). A JavaHome
   class is used to provide uniform APIs for accessing JDK resources in
   traditional and Hermetic Java (single image) execution modes.

Hermetic Java is an accumulation of wisdom that Google obtained from
real-world production deployments over many years (years before the current
project research/experiments). We would love to gather feedback from
community members. Any input and feedback are welcome and appreciated!

We are happy to provide additional information and answer questions (open
to discussions in any form).

[1] http://cr.openjdk.java.net/~jiangli/hermetic_java.pdf

[2] http://cr.openjdk.java.net/~mr/jep/jep-2.0-02.html

[3] https://bugs.openjdk.org/browse/JDK-8005716

[4] https://bugs.openjdk.org/browse/JDK-8136556
[5] https://bugs.openjdk.org/browse/JDK-8232748

Best regards,

Jiangli
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mail.openjdk.org/pipermail/leyden-dev/attachments/20230202/446831ca/attachment.htm>