https issues with docker 1.7 alpine jdk image

[sukrit007]

When I make https call (e.g: https://github.com) within java program using image: 'java:7u91-jdk-alpine', my call fails with error:

Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty

Note: This issue is very similar to iron java image as described here:
iron-io/dockers#32 (comment)

[yosifkit]

I would assume that is because ca-certificates and its dependency of openssl in not included in this image. Since this image is designed to be super minimal, you'll need to install any libraries that you need:

FROM java:7-jdk-alpine
RUN apk add --no-cache ca-certificates
# add code and compile or whatever

[sukrit007]

I will debug it further as my image has both. Had run into similar issue with iron java image and apparently java was ignoring default ca-certificates.

[sukrit007]

So looks like we need java-cacerts and create soft-links:

apk add --no-cache java-cacerts \
    && rm /usr/lib/jvm/java-1.7-openjdk/jre/lib/security/cacerts \
    && ln -s /etc/ssl/certs/java/cacerts /usr/lib/jvm/java-1.7-openjdk/jre/lib/security/cacerts

After adding this , it worked for me. Wondering if this should be part of the base image. @yosifkit

See iron-io/dockers@2e22428

[sukrit007]

@yosifkit should I submit a PR with above fix ? Note: Adding OpenSSL with cacerts did not resolve the issue

[md5]

@sukrit007 Are you able to update to openjdk8? It appears to have been fixed in that package but not in openjdk7: http://git.alpinelinux.org/cgit/aports/commit/?id=2445067072ee0b830308575d5d63ce0981a73de3

[sukrit007]

@md5 Thanks for the same. However, there are few of my legacy apps that would require significant migration effort to java8 from java7 (un-compatible maven plugins) .

I was wondering if this can make it to base image of openjdk7.

[yosifkit]

Sorry for the long tail on this issue. I am hesitant to add a fix in the Dockerfile, since we don't specifically install java-cacerts, and this is really an issue with the alpine packaging.

@ncopa, can you look into the fix from opendjk8 to see if it can be added to openjdk7? 🙏 🙇‍♂️

[ncopa]

Seems like it already was added. alpinelinux/aports@170b830. should this be backported to alpine v3.4?

[tianon]

Yeah, sounds like it since I think the package is a bit broken without it. 👍 ❤️

Thanks for taking a look!

[yosifkit]

Closing since this was fixed in the alpine packaging. Thanks @ncopa!

[aiannucci]

Facing the same issue with openjdk:9-jdk, does this need to be configured manually?

[Foorack]

@aiannucci There seems to be more progress here #145