feat: use debian base image for `java-library-generation` #3817

@@ -34,27 +34,7 @@ RUN mvn install -B -ntp -DskipTests -Dclirr.skip -Dcheckstyle.skip
 RUN cp "/root/.m2/repository/com/google/api/gapic-generator-java/${DOCKER_GAPIC_GENERATOR_VERSION}/gapic-generator-java-${DOCKER_GAPIC_GENERATOR_VERSION}.jar" \
  "./gapic-generator-java.jar"

-FROM docker.io/library/alpine:3.21.2@sha256:56fa17d2a7e7f168a043a2712e63aed1f8543aeafdcee47c58dcffe38ed51099 as glibc-compat


Can you remind me why we chose alpine in the first place?

Alpine is promoted as a lightweight base image that happens to be secure due to it's smaller attack surface.

Moving to debian-slim gives us a slightly heavier image but compatible with glibc.

zhumin8 · 2025-05-30T01:34:22Z

.cloudbuild/library_generation/library_generation_airlock.Dockerfile

-
-# 3.12.7-alpine3.20
-FROM us-docker.pkg.dev/artifact-foundry-prod/docker-3p-trusted/python@sha256:b83d5ec7274bee17d2f4bd0bfbb082f156241e4513f0a37c70500e1763b1d90d as final
+# 3.12.3-slim-bookworm


Is this older version of the public image above? docker.io/library/python:3.13.2-slim

It unfortunately is, since Airlock has a delay. I thought it's a good temporary base image in the meantime.
I'm planning to update to the slim image I requested to import into Airlock.

🤖 I have created a release *beep* *boop* --- <details><summary>2.59.0</summary> ## [2.59.0](v2.58.0...v2.59.0) (2025-06-02) ### Features * add logic to set universe domain to ServiceAccountJwtAccessCredentials ([#3806](#3806)) ([5b45708](5b45708)) * use debian base image for `java-library-generation` ([#3817](#3817)) ([94d0b30](94d0b30)) ### Bug Fixes * manage graalvm image versions via Hermetic Build templates _only_ ([#3800](#3800)) ([244c5dc](244c5dc)) ### Dependencies * update dependency com.google.oauth-client:google-oauth-client-bom to v1.39.0 ([#3813](#3813)) ([196a7ca](196a7ca)) * update google api dependencies ([#3791](#3791)) ([45ef2e0](45ef2e0)) * update google auth library dependencies to v1.36.0 ([#3814](#3814)) ([07f834a](07f834a)) * update grpc dependencies to 1.71.0 ([#3807](#3807)) ([49a7ae5](49a7ae5)) * Upgrade Protobuf-Java to v3.25.8 ([#3810](#3810)) ([ab90662](ab90662)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>

This PR switches the base image of `java-library-generation` to `python-3.13.2-slim`, based on `debian-slim`. https://hub.docker.com/layers/library/python/3.13.2-slim/images/sha256-8feb1b384bf6755cd1a180d65ec065c742aa1602f026993c33475be6ade2fb2e Our image is an infrastructure image not meant to be used by our final users. This solves the ongoing "compatibility layer" problems previously caused by our [GLIBC compatibility layer](https://github.com/googleapis/sdk-platform-java/blob/b87fd5e1af37af01cff1a51e3e50efcf048a3c27/.cloudbuild/library_generation/library_generation.Dockerfile#L37-L55). For context on this change: [doc](https://docs.google.com/document/d/1wI5VZG5gMCkt4ZyvL6wbf2IeyJrY9pFthFVuAY1kfWw/edit?resourcekey=0-aIfwb5NHqpBlQnbYsD19qw&tab=t.0#heading=h.7xlry2sxrwzj)

🤖 I have created a release *beep* *boop* --- <details><summary>2.59.0</summary> ## [2.59.0](v2.58.0...v2.59.0) (2025-06-02) ### Features * add logic to set universe domain to ServiceAccountJwtAccessCredentials ([#3806](#3806)) ([5b45708](5b45708)) * use debian base image for `java-library-generation` ([#3817](#3817)) ([94d0b30](94d0b30)) ### Bug Fixes * manage graalvm image versions via Hermetic Build templates _only_ ([#3800](#3800)) ([244c5dc](244c5dc)) ### Dependencies * update dependency com.google.oauth-client:google-oauth-client-bom to v1.39.0 ([#3813](#3813)) ([196a7ca](196a7ca)) * update google api dependencies ([#3791](#3791)) ([45ef2e0](45ef2e0)) * update google auth library dependencies to v1.36.0 ([#3814](#3814)) ([07f834a](07f834a)) * update grpc dependencies to 1.71.0 ([#3807](#3807)) ([49a7ae5](49a7ae5)) * Upgrade Protobuf-Java to v3.25.8 ([#3810](#3810)) ([ab90662](ab90662)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>

| Package | Type | Package file | Manager | Update | Change | |---|---|---|---|---|---| | [com.google.api.grpc:proto-google-common-protos](https://github.com/googleapis/sdk-platform-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `2.58.2` -> `2.59.0` | | [com.google.api:gax](https://github.com/googleapis/sdk-platform-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `2.67.2` -> `2.68.0` | | [com.google.errorprone:error_prone_annotations](https://errorprone.info) ([source](https://github.com/google/error-prone)) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `2.38.0` -> `2.39.0` | | [org.jetbrains.kotlinx.binary-compatibility-validator](https://github.com/Kotlin/binary-compatibility-validator) | plugin | misk/gradle/libs.versions.toml | gradle | minor | `0.17.0` -> `0.18.0` | | [com.autonomousapps.dependency-analysis](https://github.com/autonomousapps/dependency-analysis-android-gradle-plugin) | plugin | misk/gradle/libs.versions.toml | gradle | minor | `2.18.0` -> `2.19.0` | | [software.amazon.awssdk:sdk-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.69` -> `2.31.70` | | [software.amazon.awssdk:sqs](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.69` -> `2.31.70` | | [software.amazon.awssdk:dynamodb-enhanced](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.69` -> `2.31.70` | | [software.amazon.awssdk:dynamodb](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.69` -> `2.31.70` | | [software.amazon.awssdk:aws-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.69` -> `2.31.70` | | [software.amazon.awssdk:bom](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.69` -> `2.31.70` | | [software.amazon.awssdk:auth](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.69` -> `2.31.70` | --- ### Release Notes <details> <summary>googleapis/sdk-platform-java (com.google.api.grpc:proto-google-common-protos)</summary> ### [`v2.59.0`](https://github.com/googleapis/sdk-platform-java/blob/HEAD/CHANGELOG.md#2590-2025-06-02) ##### Features - add logic to set universe domain to ServiceAccountJwtAccessCredentials ([#3806](googleapis/sdk-platform-java#3806)) ([5b45708](googleapis/sdk-platform-java@5b45708)) - use debian base image for `java-library-generation` ([#3817](googleapis/sdk-platform-java#3817)) ([94d0b30](googleapis/sdk-platform-java@94d0b30)) ##### Bug Fixes - manage graalvm image versions via Hermetic Build templates *only* ([#3800](googleapis/sdk-platform-java#3800)) ([244c5dc](googleapis/sdk-platform-java@244c5dc)) ##### Dependencies - update dependency com.google.oauth-client:google-oauth-client-bom to v1.39.0 ([#3813](googleapis/sdk-platform-java#3813)) ([196a7ca](googleapis/sdk-platform-java@196a7ca)) - update google api dependencies ([#3791](googleapis/sdk-platform-java#3791)) ([45ef2e0](googleapis/sdk-platform-java@45ef2e0)) - update google auth library dependencies to v1.36.0 ([#3814](googleapis/sdk-platform-java#3814)) ([07f834a](googleapis/sdk-platform-java@07f834a)) - update grpc dependencies to 1.71.0 ([#3807](googleapis/sdk-platform-java#3807)) ([49a7ae5](googleapis/sdk-platform-java@49a7ae5)) - Upgrade Protobuf-Java to v3.25.8 ([#3810](googleapis/sdk-platform-java#3810)) ([ab90662](googleapis/sdk-platform-java@ab90662)) </details> <details> <summary>google/error-prone (com.google.errorprone:error_prone_annotations)</summary> ### [`v2.39.0`](https://github.com/google/error-prone/releases/tag/v2.39.0): Error Prone 2.39.0 Changes: - Temporarily downgrade to Guava 33.4.0 ([#5108](google/error-prone#5108)) Checks: - [`BooleanLiteral`](https://errorprone.info/bugpattern/BooleanLiteral): Prefer `true` to `Boolean.TRUE` - [`ExpensiveLenientFormatString`](https://errorprone.info/bugpattern/ExpensiveLenientFormatString): Renamed from `PreconditionsExpensiveString`, detects unnecessary calls to `String.format` in the arguments of lenient formatting methods. - [`UnnecessaryQualifier`](https://errorprone.info/bugpattern/UnnecessaryQualifier): Detects `@Qualifier` or `@BindingAnnotation` annotations that have no effect, and can be removed Issues: [#4996](google/error-prone#4996), [#5045](google/error-prone#5045) Full changelog: google/error-prone@v2.38.0...v2.39.0 </details> <details> <summary>Kotlin/binary-compatibility-validator (org.jetbrains.kotlinx.binary-compatibility-validator)</summary> ### [`v0.18.0`](https://github.com/Kotlin/binary-compatibility-validator/releases/tag/0.18.0) [Compare Source](Kotlin/binary-compatibility-validator@0.17.0...0.18.0) #### What's Changed - Supported KLIB cross compilation enabled in Kotlin 2.1.0 [#299](Kotlin/binary-compatibility-validator#299) - Fixed issue with early properties evaluation [#286](Kotlin/binary-compatibility-validator#286) - Started excluding local classes created by Parcelize [#300](Kotlin/binary-compatibility-validator#300) Thanks to [@TheMrMilchmann](https://github.com/TheMrMilchmann), [@osipxd](https://github.com/osipxd), and [@Goooler](https://github.com/Goooler) for their contributions! </details> <details> <summary>autonomousapps/dependency-analysis-android-gradle-plugin (com.autonomousapps.dependency-analysis)</summary> ### [`v2.19.0`](https://github.com/autonomousapps/dependency-analysis-android-gradle-plugin/blob/HEAD/CHANGELOG.md#Version-2190) - \[Feat]: support advices for Android test fixtures source sets - \[Feat]: support typesafe project accessors in IssueHandler - \[Fix]: bump kotlin-metadata-jvm to 2.1.21 to support K2.2 projects. - \[Chore]: move publishing to new `central.sonatype.com` repo. </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 6pm every weekday,before 2am every weekday" in timezone Australia/Melbourne, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Never, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). GitOrigin-RevId: d85db8eca9307834b88f72100e0026a94e3b4aa2

feat: use debian base image for java-library-generation

7d54841

product-auto-label bot added the size: s Pull request size is small. label May 29, 2025

feat: update Airlock image with debian base image

45b165d

product-auto-label bot added size: m Pull request size is medium. and removed size: s Pull request size is small. labels May 29, 2025

diegomarquezp marked this pull request as ready for review May 29, 2025 21:14

diegomarquezp requested review from zhumin8 and blakeli0 May 29, 2025 21:14

blakeli0 reviewed May 29, 2025

View reviewed changes

blakeli0 requested a review from jinseopkim0 May 29, 2025 21:50

zhumin8 reviewed May 30, 2025

View reviewed changes

zhumin8 mentioned this pull request May 30, 2025

deps: Upgrade Protobuf-Java to v3.25.8 #3810

Merged

zhumin8 approved these changes May 30, 2025

View reviewed changes

jinseopkim0 approved these changes May 30, 2025

View reviewed changes

blakeli0 approved these changes May 30, 2025

View reviewed changes

diegomarquezp merged commit 94d0b30 into main May 30, 2025
84 of 91 checks passed

diegomarquezp deleted the hermetic-build-debian branch May 30, 2025 16:46

release-please bot mentioned this pull request May 30, 2025

chore(main): release 2.59.0 #3804

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: use debian base image for `java-library-generation` #3817

feat: use debian base image for `java-library-generation` #3817

Uh oh!

diegomarquezp commented May 29, 2025 •

edited by zhumin8

Loading

Uh oh!

sonarqubecloud bot commented May 29, 2025

Uh oh!

sonarqubecloud bot commented May 29, 2025

Uh oh!

blakeli0 left a comment

Uh oh!

blakeli0 May 29, 2025

Uh oh!

diegomarquezp May 30, 2025

Uh oh!

zhumin8 May 30, 2025

Uh oh!

diegomarquezp May 30, 2025

Uh oh!

Uh oh!

Uh oh!

feat: use debian base image for java-library-generation #3817

feat: use debian base image for java-library-generation #3817

Uh oh!

Conversation

diegomarquezp commented May 29, 2025 • edited by zhumin8 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud bot commented May 29, 2025

Quality Gate passed for 'gapic-generator-java-root'

Uh oh!

sonarqubecloud bot commented May 29, 2025

Quality Gate passed for 'java_showcase_integration_tests'

Uh oh!

blakeli0 left a comment

Choose a reason for hiding this comment

Uh oh!

blakeli0 May 29, 2025

Choose a reason for hiding this comment

Uh oh!

diegomarquezp May 30, 2025

Choose a reason for hiding this comment

Uh oh!

zhumin8 May 30, 2025

Choose a reason for hiding this comment

Uh oh!

diegomarquezp May 30, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

feat: use debian base image for `java-library-generation` #3817

feat: use debian base image for `java-library-generation` #3817

diegomarquezp commented May 29, 2025 •

edited by zhumin8

Loading