打包OCI镜像

该插件可以使用 Cloud Native Buildpacks(CNB)从jar或war文件创建 OCI镜像。 可以通过命令行使用 build-image 目标构建镜像。 这确保了在创建镜像之前,package生命周期已执行。

出于安全考虑,镜像的构建和运行均以非root用户身份进行。 详见 CNB规范

最简单的入门方式是在项目上执行 mvn spring-boot:build-image 。 也可以自动化地在每次`package`阶段执行时创建镜像,如下例所示:

<build>
	<plugins>
		<plugin>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-maven-plugin</artifactId>
			<executions>
				<execution>
					<goals>
						<goal>build-image-no-fork</goal>
					</goals>
				</execution>
			</executions>
		</plugin>
	</plugins>
</build>
当将目标绑定到package生命周期时,请使用 build-image-no-fork 。 该目标与 build-image 类似,但不会fork生命周期以确保`package`已执行。 在本节其余部分,build-image 泛指 build-imagebuild-image-no-fork 目标。
虽然buildpack是从 可执行归档运行的,但无需先执行`repackage`目标,因为如有需要会自动创建可执行归档。 当 build-image 重新打包应用时,会应用与 repackage 目标相同的设置,即可通过exclude选项排除依赖。 spring-boot-devtoolsspring-boot-docker-compose 模块默认自动排除(可通过 excludeDevtoolsexcludeDockerCompose 属性控制)。

Docker守护进程

build-image 目标需要访问Docker守护进程。 该目标会检查本地Docker CLI 配置文件以确定当前 上下文,并使用上下文连接信息与Docker守护进程通信。 如果无法确定当前上下文或上下文无连接信息,则目标将使用默认本地连接。 这在所有受支持平台上的 Docker Engine无需配置即可使用。

可通过设置环境变量配置`build-image`目标使用本地或远程连接。 下表展示了环境变量及其含义:

环境变量 描述

DOCKER_CONFIG

用于确定当前上下文的Docker CLI 配置文件位置(默认为 $HOME/.docker

DOCKER_CONTEXT

应用于从Docker CLI配置文件获取主机信息的 上下文名称(覆盖 DOCKER_HOST

DOCKER_HOST

Docker守护进程的主机和端口URL,例如 tcp://192.168.99.100:2376

DOCKER_TLS_VERIFY

设置为`1`时启用安全HTTPS协议(可选)

DOCKER_CERT_PATH

HTTPS所需证书和密钥文件路径(若 DOCKER_TLS_VERIFY=1 则必填,否则忽略)

也可通过插件配置中的 docker 参数提供Docker守护进程连接信息。 下表总结了可用参数:

参数 描述

context

用于从Docker CLI 配置文件获取主机信息的 上下文名称

host

Docker守护进程的主机和端口URL,例如 tcp://192.168.99.100:2376

tlsVerify

设置为`true`时启用安全HTTPS协议(可选)

certPath

HTTPS所需证书和密钥文件路径(若 tlsVerifytrue 则必填,否则忽略)

bindHostToBuilder

若为 true ,则 host 属性值会传递给为CNB builder创建的容器(可选)

更多细节参见 示例

Docker镜像仓库

builderrunImage 参数指定的Docker镜像存储于需要认证的私有仓库,可通过 docker.builderRegistry 参数提供认证信息。

若生成的Docker镜像需发布到镜像仓库,可通过 docker.publishRegistry 参数提供认证信息。

参数支持用户名认证或身份令牌认证。 具体支持的认证方式请参考所用Docker仓库文档。

下表总结了 docker.builderRegistrydocker.publishRegistry 可用参数:

参数 描述

username

Docker镜像仓库用户名。用户认证时必填。

password

Docker镜像仓库用户密码。用户认证时必填。

url

Docker镜像仓库地址。用户认证时可选。

email

Docker镜像仓库用户邮箱。用户认证时可选。

token

Docker镜像仓库用户身份令牌。令牌认证时必填。

更多细节参见 示例

若未提供凭据,插件会读取用户现有的Docker配置文件(通常位于 $HOME/.docker/config.json )以确定认证方式。 插件会尝试使用这些方式为请求的镜像提供认证信息。

插件支持以下认证方式:

  • Credential Helpers:在Docker配置文件中配置的外部工具,为特定仓库提供凭据。例如 osxkeychainecr-login 等工具可处理部分仓库认证。

  • Credential Store:默认回退机制,安全存储和检索凭据(如Docker Desktop的 desktop )。

  • Static Credentials:直接存储在Docker配置文件 auths 部分的凭据。

镜像自定义

插件会调用 builder来编排镜像生成。 该builder包含多个 buildpacks,可检查应用以影响生成的镜像。 默认情况下,插件会选择一个builder镜像。 生成镜像的名称由项目属性推断。

image 参数允许配置builder及其在项目上的操作方式。 下表总结了可用参数及其默认值:

参数 /(用户属性) 描述 默认值

builder
(spring-boot.build-image.builder)

要使用的builder镜像名称。

paketobuildpacks/builder-noble-java-tiny:latest

trustBuilder
(spring-boot.build-image.trustBuilder)

是否将builder视为 受信任

若builder为 paketobuildpacks/builder-noble-java-tinypaketobuildpacks/builder-jammy-java-tinypaketobuildpacks/builder-jammy-tinypaketobuildpacks/builder-jammy-basepaketobuildpacks/builder-jammy-fullpaketobuildpacks/builder-jammy-buildpackless-tinypaketobuildpacks/builder-jammy-buildpackless-basepaketobuildpacks/builder-jammy-buildpackless-fullgcr.io/buildpacks/builderheroku/builder 时为 true ,否则为 false

imagePlatform
(spring-boot.build-image.imagePlatform)

拉取的builder、run和buildpack镜像的平台(操作系统和架构)。 格式为 OS[/architecture[/variant]] ,如 linux/amd64linux/arm64linux/arm/v5 。 具体可用选项请参考所用builder文档。

无默认值,表示使用主机平台。

runImage
(spring-boot.build-image.runImage)

要使用的run镜像名称。

无默认值,表示使用Builder元数据中指定的run镜像。

name
(spring-boot.build-image.imageName)

生成镜像的 镜像名称

docker.io/library/
${project.artifactId}:${project.version}

pullPolicy
(spring-boot.build-image.pullPolicy)

用于决定何时从仓库拉取builder和run镜像的 策略。 可选值为 ALWAYSNEVERIF_NOT_PRESENT

ALWAYS

env

传递给builder的环境变量。

buildpacks

builder在构建镜像时应使用的buildpack。 仅会使用指定的buildpack,覆盖builder中默认包含的buildpack。 buildpack引用格式如下:

  • builder中的buildpack - [urn:cnb:builder:]<buildpack ID>[@<version>]

  • 文件系统目录中的buildpack - [file://]<path>

  • 文件系统中gzipped tar(.tgz)文件中的buildpack - [file://]<path>/<file name>

  • OCI镜像中的buildpack - [docker://]<host>/<repo>[:<tag>][@<digest>]

无,表示使用builder自带的buildpack。

bindings

卷绑定挂载,在构建镜像时应挂载到builder容器。 绑定信息会在创建builder容器时原样传递给Docker,不做解析和校验。 绑定格式如下:

  • <主机源路径>:<容器目标路径>[:<选项>]

  • <主机卷名>:<容器目标路径>[:<选项>]

其中`<选项>`可包含:

  • ro:只读挂载

  • rw:可读写挂载

  • volume-opt=key=value:指定选项名及其值的键值对

network + (spring-boot.build-image.network)

builder容器将配置使用的 网络驱动。 提供的值会在创建builder容器时原样传递给Docker。

cleanCache + (spring-boot.build-image.cleanCache)

构建前是否清理缓存。

false

verboseLogging

启用builder操作的详细日志。

false

publish + (spring-boot.build-image.publish)

是否将生成的镜像发布到Docker仓库。

false

tags

为生成的镜像添加一个或多个额外标签。 `tags`选项的值应为*完整*镜像引用。 详见 标签部分

buildWorkspace

builder和buildpack在构建镜像时用于存储文件的临时工作区。 该值可为命名卷或绑定挂载位置。

Docker守护进程中的命名卷,名称由镜像名派生。

buildCache

buildpack创建并由镜像构建过程使用的层缓存。 该值可为命名卷或绑定挂载位置。

Docker守护进程中的命名卷,名称由镜像名派生。

launchCache

buildpack创建并由镜像启动过程使用的层缓存。 该值可为命名卷或绑定挂载位置。

Docker守护进程中的命名卷,名称由镜像名派生。

createdDate
(spring-boot.build-image.createdDate)

用于设置生成镜像元数据中`Created`字段的日期。 该值必须为ISO 8601 instant格式的字符串,或`now`表示当前日期时间。

固定日期以实现 可重现性构建

applicationDirectory
(spring-boot.build-image.applicationDirectory)

应用内容将上传到builder镜像中的目录路径。 生成的镜像中应用内容也位于此路径。

/workspace

securityOptions

将应用于builder容器的 安全选项,以字符串数组形式提供

Linux和macOS为`["label=disable"],Windows为[]`

插件会通过编译器插件配置或 maven.compiler.target 属性检测项目的目标Java兼容性。 使用默认Paketo builder和buildpack时,插件会指示buildpack安装相同Java版本。 可参考 builder配置示例进行覆盖。

更多细节参见 示例

标签格式

tags 选项的值应为*完整*镜像引用。 接受的格式为 [domainHost:port/][path/]name[:tag][@digest]

若省略domain,则默认为 docker.io 。 若省略path,则默认为 library 。 若省略tag,则默认为 latest

示例:

  • my-image`会生成镜像引用 `docker.io/library/my-image:latest

  • my-repository/my-image 会生成 docker.io/my-repository/my-image:latest

  • example.com/my-repository/my-image:1.0.0 将按原样使用

spring-boot:build-image

org.springframework.boot:spring-boot-maven-plugin:3.5.0

Package an application into an OCI image using a buildpack, forking the lifecycle to make sure that package ran. This goal is suitable for command-line invocation. If you need to configure a goal execution in your build, use build-image-no-fork instead.

Required parameters

Name Type Default

sourceDirectory

File

${project.build.directory}

Optional parameters

Name Type Default

applicationDirectory

String

classifier

String

cleanCache

Boolean

createdDate

String

docker

Docker

excludeDevtools

boolean

true

excludeDockerCompose

boolean

true

excludeGroupIds

String

excludes

List

image

Image

imageBuilder

String

imageName

String

imagePlatform

String

includeSystemScope

boolean

false

includeTools

boolean

true

includes

List

layers

Layers

layout

LayoutType

layoutFactory

LayoutFactory

loaderImplementation

LoaderImplementation

mainClass

String

network

String

publish

Boolean

pullPolicy

PullPolicy

runImage

String

skip

boolean

false

trustBuilder

Boolean

Parameter details

applicationDirectory

Alias for Image#applicationDirectory to support configuration through command-line property.

Name

applicationDirectory

Type

java.lang.String

Default value

User property

spring-boot.build-image.applicationDirectory

Since

3.1.0

classifier

Classifier used when finding the source archive.

Name

classifier

Type

java.lang.String

Default value

User property

Since

2.3.0

cleanCache

Alias for Image#cleanCache to support configuration through command-line property.

Name

cleanCache

Type

java.lang.Boolean

Default value

User property

spring-boot.build-image.cleanCache

Since

2.4.0

createdDate

Alias for Image#createdDate to support configuration through command-line property.

Name

createdDate

Type

java.lang.String

Default value

User property

spring-boot.build-image.createdDate

Since

3.1.0

docker

Docker configuration options.

Name

docker

Type

org.springframework.boot.maven.Docker

Default value

User property

Since

2.4.0

excludeDevtools

Exclude Spring Boot devtools from the repackaged archive.

Name

excludeDevtools

Type

boolean

Default value

true

User property

spring-boot.repackage.excludeDevtools

Since

1.3.0

excludeDockerCompose

Exclude Spring Boot dev services from the repackaged archive.

Name

excludeDockerCompose

Type

boolean

Default value

true

User property

spring-boot.repackage.excludeDockerCompose

Since

3.1.0

excludeGroupIds

Comma separated list of groupId names to exclude (exact match).

Name

excludeGroupIds

Type

java.lang.String

Default value

User property

spring-boot.excludeGroupIds

Since

1.1.0

excludes

Collection of artifact definitions to exclude. The Exclude element defines mandatory groupId and artifactId components and an optional classifier component. When configured as a property, values should be comma-separated with colon-separated components: groupId:artifactId,groupId:artifactId:classifier

Name

excludes

Type

java.util.List

Default value

User property

spring-boot.excludes

Since

1.1.0

image

Image configuration, with builder, runImage, name, env, cleanCache, verboseLogging, pullPolicy, and publish options.

Name

image

Type

org.springframework.boot.maven.Image

Default value

User property

Since

2.3.0

imageBuilder

Alias for Image#builder to support configuration through command-line property.

Name

imageBuilder

Type

java.lang.String

Default value

User property

spring-boot.build-image.builder

Since

2.3.0

imageName

Alias for Image#name to support configuration through command-line property.

Name

imageName

Type

java.lang.String

Default value

User property

spring-boot.build-image.imageName

Since

2.3.0

imagePlatform

Alias for Image#imagePlatform to support configuration through command-line property.

Name

imagePlatform

Type

java.lang.String

Default value

User property

spring-boot.build-image.imagePlatform

Since

3.4.0

includeSystemScope

Include system scoped dependencies.

Name

includeSystemScope

Type

boolean

Default value

false

User property

Since

1.4.0

includeTools

Include JAR tools.

Name

includeTools

Type

boolean

Default value

true

User property

Since

3.3.0

includes

Collection of artifact definitions to include. The Include element defines mandatory groupId and artifactId components and an optional classifier component. When configured as a property, values should be comma-separated with colon-separated components: groupId:artifactId,groupId:artifactId:classifier

Name

includes

Type

java.util.List

Default value

User property

spring-boot.includes

Since

1.2.0

layers

Layer configuration with options to disable layer creation, exclude layer tools jar, and provide a custom layers configuration file.

Name

layers

Type

org.springframework.boot.maven.Layers

Default value

User property

Since

2.3.0

layout

The type of archive (which corresponds to how the dependencies are laid out inside it). Possible values are JAR, WAR, ZIP, DIR, NONE. Defaults to a guess based on the archive type.

Name

layout

Type

org.springframework.boot.maven.AbstractPackagerMojo$LayoutType

Default value

User property

Since

2.3.11

layoutFactory

The layout factory that will be used to create the executable archive if no explicit layout is set. Alternative layouts implementations can be provided by 3rd parties.

Name

layoutFactory

Type

org.springframework.boot.loader.tools.LayoutFactory

Default value

User property

Since

2.3.11

loaderImplementation

The loader implementation that should be used.

Name

loaderImplementation

Type

org.springframework.boot.loader.tools.LoaderImplementation

Default value

User property

Since

3.2.0

mainClass

The name of the main class. If not specified the first compiled class found that contains a main method will be used.

Name

mainClass

Type

java.lang.String

Default value

User property

Since

1.0.0

network

Alias for Image#network to support configuration through command-line property.

Name

network

Type

java.lang.String

Default value

User property

spring-boot.build-image.network

Since

2.6.0

publish

Alias for Image#publish to support configuration through command-line property.

Name

publish

Type

java.lang.Boolean

Default value

User property

spring-boot.build-image.publish

Since

pullPolicy

Alias for Image#pullPolicy to support configuration through command-line property.

Name

pullPolicy

Type

org.springframework.boot.buildpack.platform.build.PullPolicy

Default value

User property

spring-boot.build-image.pullPolicy

Since

runImage

Alias for Image#runImage to support configuration through command-line property.

Name

runImage

Type

java.lang.String

Default value

User property

spring-boot.build-image.runImage

Since

2.3.1

skip

Skip the execution.

Name

skip

Type

boolean

Default value

false

User property

spring-boot.build-image.skip

Since

2.3.0

sourceDirectory

Directory containing the source archive.

Name

sourceDirectory

Type

java.io.File

Default value

${project.build.directory}

User property

Since

2.3.0

trustBuilder

Alias for Image#trustBuilder to support configuration through command-line property.

Name

trustBuilder

Type

java.lang.Boolean

Default value

User property

spring-boot.build-image.trustBuilder

Since

spring-boot:build-image-no-fork

org.springframework.boot:spring-boot-maven-plugin:3.5.0

Package an application into an OCI image using a buildpack, but without forking the lifecycle. This goal should be used when configuring a goal execution in your build. To invoke the goal on the command-line, use build-image instead.

Required parameters

Name Type Default

sourceDirectory

File

${project.build.directory}

Optional parameters

Name Type Default

applicationDirectory

String

classifier

String

cleanCache

Boolean

createdDate

String

docker

Docker

excludeDevtools

boolean

true

excludeDockerCompose

boolean

true

excludeGroupIds

String

excludes

List

image

Image

imageBuilder

String

imageName

String

imagePlatform

String

includeSystemScope

boolean

false

includeTools

boolean

true

includes

List

layers

Layers

layout

LayoutType

layoutFactory

LayoutFactory

loaderImplementation

LoaderImplementation

mainClass

String

network

String

publish

Boolean

pullPolicy

PullPolicy

runImage

String

skip

boolean

false

trustBuilder

Boolean

Parameter details

applicationDirectory

Alias for Image#applicationDirectory to support configuration through command-line property.

Name

applicationDirectory

Type

java.lang.String

Default value

User property

spring-boot.build-image.applicationDirectory

Since

3.1.0

classifier

Classifier used when finding the source archive.

Name

classifier

Type

java.lang.String

Default value

User property

Since

2.3.0

cleanCache

Alias for Image#cleanCache to support configuration through command-line property.

Name

cleanCache

Type

java.lang.Boolean

Default value

User property

spring-boot.build-image.cleanCache

Since

2.4.0

createdDate

Alias for Image#createdDate to support configuration through command-line property.

Name

createdDate

Type

java.lang.String

Default value

User property

spring-boot.build-image.createdDate

Since

3.1.0

docker

Docker configuration options.

Name

docker

Type

org.springframework.boot.maven.Docker

Default value

User property

Since

2.4.0

excludeDevtools

Exclude Spring Boot devtools from the repackaged archive.

Name

excludeDevtools

Type

boolean

Default value

true

User property

spring-boot.repackage.excludeDevtools

Since

1.3.0

excludeDockerCompose

Exclude Spring Boot dev services from the repackaged archive.

Name

excludeDockerCompose

Type

boolean

Default value

true

User property

spring-boot.repackage.excludeDockerCompose

Since

3.1.0

excludeGroupIds

Comma separated list of groupId names to exclude (exact match).

Name

excludeGroupIds

Type

java.lang.String

Default value

User property

spring-boot.excludeGroupIds

Since

1.1.0

excludes

Collection of artifact definitions to exclude. The Exclude element defines mandatory groupId and artifactId components and an optional classifier component. When configured as a property, values should be comma-separated with colon-separated components: groupId:artifactId,groupId:artifactId:classifier

Name

excludes

Type

java.util.List

Default value

User property

spring-boot.excludes

Since

1.1.0

image

Image configuration, with builder, runImage, name, env, cleanCache, verboseLogging, pullPolicy, and publish options.

Name

image

Type

org.springframework.boot.maven.Image

Default value

User property

Since

2.3.0

imageBuilder

Alias for Image#builder to support configuration through command-line property.

Name

imageBuilder

Type

java.lang.String

Default value

User property

spring-boot.build-image.builder

Since

2.3.0

imageName

Alias for Image#name to support configuration through command-line property.

Name

imageName

Type

java.lang.String

Default value

User property

spring-boot.build-image.imageName

Since

2.3.0

imagePlatform

Alias for Image#imagePlatform to support configuration through command-line property.

Name

imagePlatform

Type

java.lang.String

Default value

User property

spring-boot.build-image.imagePlatform

Since

3.4.0

includeSystemScope

Include system scoped dependencies.

Name

includeSystemScope

Type

boolean

Default value

false

User property

Since

1.4.0

includeTools

Include JAR tools.

Name

includeTools

Type

boolean

Default value

true

User property

Since

3.3.0

includes

Collection of artifact definitions to include. The Include element defines mandatory groupId and artifactId components and an optional classifier component. When configured as a property, values should be comma-separated with colon-separated components: groupId:artifactId,groupId:artifactId:classifier

Name

includes

Type

java.util.List

Default value

User property

spring-boot.includes

Since

1.2.0

layers

Layer configuration with options to disable layer creation, exclude layer tools jar, and provide a custom layers configuration file.

Name

layers

Type

org.springframework.boot.maven.Layers

Default value

User property

Since

2.3.0

layout

The type of archive (which corresponds to how the dependencies are laid out inside it). Possible values are JAR, WAR, ZIP, DIR, NONE. Defaults to a guess based on the archive type.

Name

layout

Type

org.springframework.boot.maven.AbstractPackagerMojo$LayoutType

Default value

User property

Since

2.3.11

layoutFactory

The layout factory that will be used to create the executable archive if no explicit layout is set. Alternative layouts implementations can be provided by 3rd parties.

Name

layoutFactory

Type

org.springframework.boot.loader.tools.LayoutFactory

Default value

User property

Since

2.3.11

loaderImplementation

The loader implementation that should be used.

Name

loaderImplementation

Type

org.springframework.boot.loader.tools.LoaderImplementation

Default value

User property

Since

3.2.0

mainClass

The name of the main class. If not specified the first compiled class found that contains a main method will be used.

Name

mainClass

Type

java.lang.String

Default value

User property

Since

1.0.0

network

Alias for Image#network to support configuration through command-line property.

Name

network

Type

java.lang.String

Default value

User property

spring-boot.build-image.network

Since

2.6.0

publish

Alias for Image#publish to support configuration through command-line property.

Name

publish

Type

java.lang.Boolean

Default value

User property

spring-boot.build-image.publish

Since

pullPolicy

Alias for Image#pullPolicy to support configuration through command-line property.

Name

pullPolicy

Type

org.springframework.boot.buildpack.platform.build.PullPolicy

Default value

User property

spring-boot.build-image.pullPolicy

Since

runImage

Alias for Image#runImage to support configuration through command-line property.

Name

runImage

Type

java.lang.String

Default value

User property

spring-boot.build-image.runImage

Since

2.3.1

skip

Skip the execution.

Name

skip

Type

boolean

Default value

false

User property

spring-boot.build-image.skip

Since

2.3.0

sourceDirectory

Directory containing the source archive.

Name

sourceDirectory

Type

java.io.File

Default value

${project.build.directory}

User property

Since

2.3.0

trustBuilder

Alias for Image#trustBuilder to support configuration through command-line property.

Name

trustBuilder

Type

java.lang.Boolean

Default value

User property

spring-boot.build-image.trustBuilder

Since

示例

自定义镜像构建器

如果你需要自定义用于创建镜像的builder或用于启动已构建镜像的run image,请按以下示例配置插件:

<project>
	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
				<configuration>
					<image>
						<builder>mine/java-cnb-builder</builder>
						<runImage>mine/java-cnb-run</runImage>
					</image>
				</configuration>
			</plugin>
		</plugins>
	</build>
</project>

该配置将使用名为 mine/java-cnb-builder 、标签为 latest 的builder镜像,以及名为 mine/java-cnb-run 、标签为 latest 的run image。

builder和run image也可以通过命令行指定,如下所示:

$ mvn spring-boot:build-image -Dspring-boot.build-image.builder=mine/java-cnb-builder -Dspring-boot.build-image.runImage=mine/java-cnb-run

Builder配置

如果builder通过环境变量暴露配置选项,可以通过`env`属性进行设置。

<project>
	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
				<configuration>
					<image>
						<env>
							<BP_JVM_VERSION>17</BP_JVM_VERSION>
						</env>
					</image>
				</configuration>
			</plugin>
		</plugins>
	</build>
</project>

如果Docker守护进程所在的builder与buildpacks下载构件的网络位置之间存在网络代理,你需要为builder配置代理。 使用Paketo builder时,可以通过设置 HTTPS_PROXY 和/或 HTTP_PROXY 环境变量实现,如下示例:

<project>
	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
				<configuration>
					<image>
						<env>
							<HTTP_PROXY>http://proxy.example.com</HTTP_PROXY>
							<HTTPS_PROXY>https://proxy.example.com</HTTPS_PROXY>
						</env>
					</image>
				</configuration>
			</plugin>
		</plugins>
	</build>
</project>

运行时JVM配置

Paketo Java buildpacks通过设置 JAVA_TOOL_OPTIONS`环境变量 配置JVM运行时环境。 buildpack提供的 `JAVA_TOOL_OPTIONS 值可被修改,以便在容器中启动应用镜像时自定义JVM运行时行为。

需要存储在镜像中并应用于每次部署的环境变量修改,可按照 Paketo文档描述进行设置,示例如下:

<project>
	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
				<configuration>
					<image>
						<env>
							<BPE_DELIM_JAVA_TOOL_OPTIONS xml:space="preserve"> </BPE_DELIM_JAVA_TOOL_OPTIONS>
							<BPE_APPEND_JAVA_TOOL_OPTIONS>-XX:+HeapDumpOnOutOfMemoryError</BPE_APPEND_JAVA_TOOL_OPTIONS>
						</env>
					</image>
				</configuration>
			</plugin>
		</plugins>
	</build>
</project>

自定义镜像名称

默认情况下,镜像名称由项目的 artifactId`和 `version`推断,例如 `docker.io/library/${project.artifactId}:${project.version}。 你可以像下面这样自定义镜像名称:

<project>
	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
				<configuration>
					<image>
						<name>example.com/library/${project.artifactId}</name>
					</image>
				</configuration>
			</plugin>
		</plugins>
	</build>
</project>
此配置未显式指定标签,因此使用 latest 。也可以指定标签,无论是 ${project.version} 、构建中可用的任何属性还是硬编码版本。

镜像名称也可以通过命令行指定,如下所示:

$ mvn spring-boot:build-image -Dspring-boot.build-image.imageName=example.com/library/my-app:v1

Buildpacks

默认情况下,builder会使用builder镜像中包含的buildpacks,并按预定义顺序应用。 你也可以提供一组替代buildpacks,以应用builder中未包含的buildpack,或更改已包含buildpack的顺序。当指定了一个或多个buildpack时,仅会应用这些指定的buildpack。

以下示例指示builder先使用一个以 .tgz 文件打包的自定义buildpack,然后再使用builder中包含的buildpack。

<project>
	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
				<configuration>
					<image>
						<buildpacks>
							<buildpack>file:///path/to/example-buildpack.tgz</buildpack>
							<buildpack>urn:cnb:builder:paketo-buildpacks/java</buildpack>
						</buildpacks>
					</image>
				</configuration>
			</plugin>
		</plugins>
	</build>
</project>

buildpack可以采用以下任意形式指定。

位于CNB Builder中的buildpack(如果builder中只有一个与 buildpack-id 匹配的buildpack,则版本可省略):

  • urn:cnb:builder:buildpack-id

  • urn:cnb:builder:buildpack-id@0.0.1

  • buildpack-id

  • buildpack-id@0.0.1

指向包含buildpack内容的目录的路径(Windows不支持):

  • file:///path/to/buildpack/

  • /path/to/buildpack/

指向包含buildpack内容的gzip压缩tar文件的路径:

  • file:///path/to/buildpack.tgz

  • /path/to/buildpack.tgz

包含 打包buildpack的OCI镜像:

  • docker://example/buildpack

  • docker:///example/buildpack:latest

  • docker:///example/buildpack@sha256:45b23dee08…​

  • example/buildpack

  • example/buildpack:latest

  • example/buildpack@sha256:45b23dee08…​

镜像发布

通过启用`publish`选项,可以将生成的镜像发布到Docker仓库。

如果Docker仓库需要认证,可通过 docker.publishRegistry 参数配置凭据。 如果Docker仓库不需要认证,则可以省略 docker.publishRegistry 配置。

镜像将发布到的仓库由镜像名称中的仓库部分(如这些示例中的 docker.example.com )决定。如果配置了 docker.publishRegistry 凭据并包含 url 参数,则该值会传递给仓库,但不会用于决定发布仓库的位置。
<project>
	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
				<configuration>
					<image>
						<name>docker.example.com/library/${project.artifactId}</name>
						<publish>true</publish>
					</image>
					<docker>
						<publishRegistry>
							<username>user</username>
							<password>secret</password>
						</publishRegistry>
					</docker>
				</configuration>
			</plugin>
		</plugins>
	</build>
</project>

publish 选项也可以通过命令行指定,如下所示:

$ mvn spring-boot:build-image -Dspring-boot.build-image.imageName=docker.example.com/library/my-app:v1 -Dspring-boot.build-image.publish=true

在命令行使用 publish 选项并需要认证时,可以像下面这样通过属性提供凭据:

$ mvn spring-boot:build-image \
      -Ddocker.publishRegistry.username=user \
      -Ddocker.publishRegistry.password=secret \
      -Ddocker.publishRegistry.url=docker.example.com \
      -Dspring-boot.build-image.publish=true \
      -Dspring-boot.build-image.imageName=docker.example.com/library/my-app:v1

并在XML配置中引用这些属性:

<project>
	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
				<configuration>
					<docker>
						<publishRegistry>
							<url>${docker.publishRegistry.url}</url>
							<username>${docker.publishRegistry.username}</username>
							<password>${docker.publishRegistry.password}</password>
						</publishRegistry>
					</docker>
				</configuration>
			</plugin>
		</plugins>
	</build>
</project>

Builder缓存与工作区配置

CNB builder会缓存用于构建和启动镜像的层。默认情况下,这些缓存作为命名卷存储在Docker守护进程中,卷名由目标镜像的完整名称派生而来。如果镜像名称频繁变化(例如项目版本作为镜像标签),则缓存可能会频繁失效。

可以通过如下示例配置缓存卷名称,以便更好地控制缓存生命周期:

<project>
	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
				<configuration>
					<image>
						<buildCache>
							<volume>
								<name>cache-${project.artifactId}.build</name>
							</volume>
						</buildCache>
						<launchCache>
							<volume>
								<name>cache-${project.artifactId}.launch</name>
							</volume>
						</launchCache>
					</image>
				</configuration>
			</plugin>
		</plugins>
	</build>
</project>

builder和buildpack在构建镜像时需要一个用于存储临时文件的位置。默认情况下,该临时构建工作区存储在命名卷中。

缓存和构建工作区也可以配置为使用绑定挂载(bind mount)而非命名卷,如下所示:

<project>
	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
				<configuration>
					<image>
						<buildWorkspace>
							<bind>
								<source>/tmp/cache-${project.artifactId}.work</source>
							</bind>
						</buildWorkspace>
						<buildCache>
							<bind>
								<source>/tmp/cache-${project.artifactId}.build</source>
							</bind>
						</buildCache>
						<launchCache>
							<bind>
								<source>/tmp/cache-${project.artifactId}.launch</source>
							</bind>
						</launchCache>
					</image>
				</configuration>
			</plugin>
		</plugins>
	</build>
</project>

Docker配置

minikube的Docker配置

插件可以与 minikube提供的Docker守护进程通信,而不是默认的本地连接。

在Linux和macOS上,minikube启动后可通过命令`eval $(minikube docker-env)`设置环境变量。

插件也可以通过如下示例所示的连接信息配置为使用minikube守护进程:

<project>
	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
				<configuration>
					<docker>
						<host>tcp://192.168.99.100:2376</host>
						<tlsVerify>true</tlsVerify>
						<certPath>/home/user/.minikube/certs</certPath>
					</docker>
				</configuration>
			</plugin>
		</plugins>
	</build>
</project>

podman的Docker配置

插件可以与 podman容器引擎通信。

插件可通过如下示例所示的连接信息配置为使用podman本地连接:

<project>
	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
				<configuration>
					<docker>
						<host>unix:///run/user/1000/podman/podman.sock</host>
						<bindHostToBuilder>true</bindHostToBuilder>
					</docker>
				</configuration>
			</plugin>
		</plugins>
	</build>
</project>
安装了 colima CLI后,可通过命令 podman info --format='{{.Host.RemoteSocket.Path}}' 获取本示例中 docker.host 配置属性的值。

Colima的Docker配置

插件可以与 Colima提供的Docker守护进程通信。 可通过以下命令设置`DOCKER_HOST`环境变量:

$ export DOCKER_HOST=$(docker context inspect colima -f '{{.Endpoints.docker.Host}}')

插件也可以通过如下示例所示的连接信息配置为使用Colima守护进程:

<project>
	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
				<configuration>
					<docker>
						<host>unix:///${user.home}/.colima/docker.sock</host>
					</docker>
				</configuration>
			</plugin>
		</plugins>
	</build>
</project>

Docker认证配置

如果builder或run image存储在支持用户认证的私有Docker仓库中,可通过如下示例所示的 docker.builderRegistry 参数提供认证信息:

<project>
	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
				<configuration>
					<docker>
						<builderRegistry>
							<username>user</username>
							<password>secret</password>
							<url>https://docker.example.com/v1/</url>
							<email>user@example.com</email>
						</builderRegistry>
					</docker>
				</configuration>
			</plugin>
		</plugins>
	</build>
</project>

如果builder或run image存储在支持token认证的私有Docker仓库中,可通过如下示例所示的 docker.builderRegistry 参数提供token值:

<project>
	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
				<configuration>
					<docker>
						<builderRegistry>
							<token>9cbaf023786cd7...</token>
						</builderRegistry>
					</docker>
				</configuration>
			</plugin>
		</plugins>
	</build>
</project>