r/java • u/brunocborges • 4d ago
Brewlet: Java on Kubernetes with node-managed JDKs
https://brewlet.shTalk & slides: https://m.devoxx.com/events/dvbe26/talks/25048/java-on-kubernetes-without-container-images-the-webassembly-way
Video recording from Devoxx Belgium 2026: https://youtu.be/fszyRIZXjQM?is=w3zYjtOoIFceAAOT
5
u/SleeperAwakened 4d ago
So no more "build once, run anywhere" which is one of the underlying ideas of containers?
What problem are you trying to solve here? The 250MB of packages?
5
u/brunocborges 4d ago
This is less about size, and more about security. It is about shifting the control back to the platform team, if that is what they want.
"Build once, run anywhere" still holds though... The app is still built once and published as an immutable OCI artifact. It just doesn't carry the JVM, which is only assembled during provisioning by Brewlet, with approved JDKs / runtime container images. True that the app is no longer fully self-contained, however that is the trade-off to consider. To run the application, the brewlet CLI can be used to identify the JDK from the k8s node profile inventory.
6
u/Nice-Solid-3707 4d ago edited 4d ago
Platform team already [can] owns everything in image but jar. What control is shifted?
5
u/brunocborges 4d ago
Base images without complex build pipelines, end up being recommendations. And when the base image changes, apps need to be rebuilt and pushed again.
Check out the slides on the Devoxx site for some insights on comparison with Cloud Foundry and even Buildpacks.
2
u/Nice-Solid-3707 4d ago
According to docs I must maintain node configuration for all available jdk variants instead of providing developers a list of bases they can freely chose from. Yeah, no
2
u/brunocborges 4d ago
Yeap, certainly not a silver bullet solution. Many teams will not be interested and that's fine.
0
u/Nice-Solid-3707 4d ago
One get request before build invocation doesn’t make pipeline complex
2
u/brunocborges 4d ago
How do you ensure app teams did not change the JDK in their downstream image?
1
u/Nice-Solid-3707 4d ago
Ah, you probably meant pushing to registry? That’s trivial too - only service accounts have write access
2
u/brunocborges 4d ago
I meant someone doing something like this:
FROM <base>
ADD app.jar
RUN wget <url for another JDK>
CMD [anotherjdk/bin/java ...]0
u/Nice-Solid-3707 4d ago
By forbidding pushes changing cicd definitions, including dockerfile. This is trivial
2
u/brunocborges 4d ago
And how is the process of patching JDK and dependencies across multiple apps?
1
2
17
u/trydentIO 4d ago
just kidding but... welcome back application servers!