Open-API: Slim down REST fixture shadow JAR and externalize cloud bundles

.github/workflows/publish-iceberg-rest-fixture-docker.yml

@@ -49,8 +49,13 @@ jobs:
         distribution: zulu
         java-version: 21
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-    - name: Build Iceberg Open API project
-      run: ./gradlew :iceberg-open-api:shadowJar
+    - name: Build REST server and cloud bundle JARs
+      run: |
+        ./gradlew \
+          :iceberg-open-api:shadowJar \
+          :iceberg-aws-bundle:shadowJar \
+          :iceberg-gcp-bundle:shadowJar \
+          :iceberg-azure-bundle:shadowJar
     - name: Login to Docker Hub
       env:
         DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}

build.gradle

@@ -1062,6 +1062,9 @@ project(':iceberg-open-api') {
   apply plugin: 'java-test-fixtures'
   apply plugin: 'com.gradleup.shadow'
 
+  ext.runtimeDepsConfig = 'testFixturesRuntimeClasspath'
+  apply from: "${rootDir}/runtime-deps.gradle"
+
   build.dependsOn shadowJar
 
   dependencies {
@@ -1120,9 +1123,6 @@ project(':iceberg-open-api') {
 
     testFixturesCompileOnly libs.apiguardian
 
-    testFixturesRuntimeOnly project(':iceberg-aws-bundle')
-    testFixturesRuntimeOnly project(':iceberg-azure-bundle')
-    testFixturesRuntimeOnly project(':iceberg-gcp-bundle')
   }
 
   test {
@@ -1163,6 +1163,23 @@ project(':iceberg-open-api') {
     manifest {
       attributes 'Main-Class': 'org.apache.iceberg.rest.RESTCatalogServer'
     }
+
+    // Exclude cloud-specific thin modules — loaded at runtime via cloud bundle JARs
+    dependencies {
+      exclude(project(':iceberg-aws'))
+      exclude(project(':iceberg-gcp'))
+      exclude(project(':iceberg-azure'))
+      exclude(project(':iceberg-bigquery'))
+    }
+
+    // Exclude JUnit — should not be in a runtime JAR
+    dependencies {
+      exclude(dependency('org.junit:.*'))
+      exclude(dependency('org.junit.jupiter:.*'))
+      exclude(dependency('org.junit.platform:.*'))
+      exclude(dependency('org.opentest4j:.*'))
+      exclude(dependency('org.apiguardian:.*'))
+    }
   }
 
   jar {

docker/iceberg-rest-fixture/Dockerfile

@@ -30,21 +30,30 @@ RUN  set -xeu && \
 # Working directory for the application
 WORKDIR /usr/lib/iceberg-rest
 
-# Copy the JAR file directly to the target location
+# Copy the core REST server JAR
 COPY --chown=iceberg:iceberg open-api/build/libs/iceberg-open-api-test-fixtures-runtime-*.jar /usr/lib/iceberg-rest/iceberg-rest-adapter.jar
 
-ENV CATALOG_CATALOG__IMPL=org.apache.iceberg.jdbc.JdbcCatalog
-ENV CATALOG_URI=jdbc:sqlite:/tmp/iceberg_catalog.db
-ENV CATALOG_JDBC_USER=user
-ENV CATALOG_JDBC_PASSWORD=password
-ENV CATALOG_JDBC_STRICT__MODE=true
-ENV REST_PORT=8181
+# Optional: copy cloud bundle JARs for credential vending.
+# Include only the cloud(s) you need. These are separate JARs added to the classpath.
+COPY --chown=iceberg:iceberg aws-bundle/build/libs/iceberg-aws-bundle-*.jar /usr/lib/iceberg-rest/lib/
+COPY --chown=iceberg:iceberg gcp-bundle/build/libs/iceberg-gcp-bundle-*.jar /usr/lib/iceberg-rest/lib/
+COPY --chown=iceberg:iceberg azure-bundle/build/libs/iceberg-azure-bundle-*.jar /usr/lib/iceberg-rest/lib/
+
+# Server configuration
+# Env vars prefixed with CATALOG_ are mapped to catalog properties:
+#   CATALOG_FOO_BAR -> foo.bar  (single _ = dot, double __ = hyphen)
+ENV CATALOG_CATALOG__IMPL=org.apache.iceberg.jdbc.JdbcCatalog \
+    CATALOG_URI=jdbc:sqlite:/tmp/iceberg_catalog.db \
+    CATALOG_JDBC_USER=user \
+    CATALOG_JDBC_PASSWORD=password \
+    CATALOG_JDBC_STRICT__MODE=true \
+    CATALOG_REST_PORT=8181
 
 # Healthcheck for the iceberg rest service
 HEALTHCHECK --retries=10 --interval=1s \
-  CMD curl --fail http://localhost:$REST_PORT/v1/config || exit 1
+  CMD curl --fail http://localhost:${CATALOG_REST_PORT}/v1/config || exit 1
 
-EXPOSE $REST_PORT
+EXPOSE ${CATALOG_REST_PORT}
 USER iceberg:iceberg
 ENV LANG=en_US.UTF-8
-CMD ["java", "-jar", "iceberg-rest-adapter.jar"]
+CMD ["java", "-cp", "iceberg-rest-adapter.jar:lib/*", "org.apache.iceberg.rest.RESTCatalogServer"]