Skip to content

feat: bake Eclipse Temurin OpenJDK 11 into the image - #22

Merged
ChrisSc merged 1 commit into
mainfrom
feat/bake-openjdk-11
Jun 15, 2026
Merged

feat: bake Eclipse Temurin OpenJDK 11 into the image#22
ChrisSc merged 1 commit into
mainfrom
feat/bake-openjdk-11

Conversation

@ChrisSc

@ChrisSc ChrisSc commented Jun 15, 2026

Copy link
Copy Markdown
Owner

What

Bakes Eclipse Temurin OpenJDK 11.0.31+11 into the dev container image so it survives make rebuild / docker compose down (live installs land outside the persistent volumes and get wiped).

Why Java 11 specifically (do NOT bump to 17+)

The IBKR Client Portal Gateway (clientportal.gw) needs Java. Its bundled netty-4.1.15 reflectively accesses java.nio.DirectByteBuffer — a harmless warning on Java 11, but a fatal InaccessibleObjectException on Java 17+ (Debian bookworm's only apt OpenJDK), which would otherwise force --add-opens flags in run.sh.

How

  • Dockerfile — new section 5 (renumbered tail 5/6/7 → 6/7/8). Pulls the JDK from Adoptium's GitHub releases, arch-selected via dpkg --print-architecture (the repo's house idiom) with a per-arch SHA-256 gate, matching the pinned/integrity-gated build convention. update-alternatives symlinks java/javac into /usr/bin (already on PATH), so only JAVA_HOME gets an ENV — the load-bearing final PATH line is untouched.
  • Makefile (smoke) — asserts java -version reports Temurin-11.0.31 and $JAVA_HOME resolves correctly.
  • .devcontainer/CLAUDE.md — adds the JDK to the pinned-artifact inventory and a dedicated "do NOT bump to 17+" invariant.

Validation

  • make lint — shellcheck + hadolint + yamllint + compose config all green.
  • Live build of the JDK step on arm64: URL resolves, SHA-256 matches, extracts to /usr/lib/jvm/jdk-11.0.31+11, java -versionTemurin-11.0.31+11, javac 11.0.31.
  • amd64 SHA-256 is from upstream notes; first amd64 build will validate it (a wrong checksum fails the build by design).

🤖 Generated with Claude Code

The IBKR Client Portal Gateway (clientportal.gw) needs Java; its netty-4.1.15
reflectively accesses java.nio.DirectByteBuffer, which is fatal on Java 17+
(bookworm's only apt OpenJDK) but a harmless warning on 11. Pin Temurin
11.0.31+11 from Adoptium's GitHub releases, arch-selected via
dpkg --print-architecture with a per-arch SHA-256 gate (matching the repo's
pinned/integrity-gated build convention).

update-alternatives symlinks java/javac into /usr/bin (already on PATH), so
only JAVA_HOME gets an ENV — the load-bearing final PATH stays untouched.

- Dockerfile: new section 5 (renumbered tail 5/6/7 -> 6/7/8)
- Makefile: smoke asserts Temurin-11.0.31 + JAVA_HOME wiring
- .devcontainer/CLAUDE.md: pinned-artifact inventory + do-NOT-bump-to-17 invariant

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@ChrisSc
ChrisSc merged commit 0904883 into main Jun 15, 2026
4 checks passed
@ChrisSc
ChrisSc deleted the feat/bake-openjdk-11 branch June 15, 2026 17:08
ChrisSc added a commit that referenced this pull request Jun 15, 2026
Follow-up to #22, which baked Temurin OpenJDK 11 but left it invisible in the
docs and the live inventory the in-container Claude is pointed at.

- seed-claude.sh: list the JVM in the generated ENVIRONMENT.md (## Languages),
  capturing java's stderr-only --version output (the shared `ver` helper drops
  stderr, which would have rendered the line blank).
- README.md: add "OpenJDK 11 (Temurin)" to the Languages highlight; fix the WSL
  clone example path that #21's rename missed (claude-sandbox -> claude-devcontainer).
- CHANGELOG.md: populate the empty [Unreleased] with the JDK addition and the
  repo rename.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant