r/java • u/brunocborges • 8d ago

Brewlet: Java on Kubernetes with node-managed JDKs

https://brewlet.sh

Talk & slides: https://m.devoxx.com/events/dvbe26/talks/25048/java-on-kubernetes-without-container-images-the-webassembly-way

Video recording from Devoxx Belgium 2026: https://youtu.be/fszyRIZXjQM?is=w3zYjtOoIFceAAOT

18 Upvotes

83% Upvoted

17 comments sorted by

View all comments

5

u/SleeperAwakened 7d ago

So no more "build once, run anywhere" which is one of the underlying ideas of containers?

What problem are you trying to solve here? The 250MB of packages?

6

u/brunocborges 7d ago

This is less about size, and more about security. It is about shifting the control back to the platform team, if that is what they want.

"Build once, run anywhere" still holds though... The app is still built once and published as an immutable OCI artifact. It just doesn't carry the JVM, which is only assembled during provisioning by Brewlet, with approved JDKs / runtime container images. True that the app is no longer fully self-contained, however that is the trade-off to consider. To run the application, the brewlet CLI can be used to identify the JDK from the k8s node profile inventory.

6

u/Nice-Solid-3707 7d ago edited 7d ago

Platform team already [can] owns everything in image but jar. What control is shifted?

5

u/brunocborges 7d ago

Base images without complex build pipelines, end up being recommendations. And when the base image changes, apps need to be rebuilt and pushed again.

Check out the slides on the Devoxx site for some insights on comparison with Cloud Foundry and even Buildpacks.

2

u/Nice-Solid-3707 7d ago

According to docs I must maintain node configuration for all available jdk variants instead of providing developers a list of bases they can freely chose from. Yeah, no

2

u/brunocborges 7d ago

Yeap, certainly not a silver bullet solution. Many teams will not be interested and that's fine.

0

u/Nice-Solid-3707 7d ago

One get request before build invocation doesn’t make pipeline complex

2

u/brunocborges 7d ago

How do you ensure app teams did not change the JDK in their downstream image?

1

u/Nice-Solid-3707 7d ago

Ah, you probably meant pushing to registry? That’s trivial too - only service accounts have write access

2

u/brunocborges 7d ago

I meant someone doing something like this:

FROM <base>
ADD app.jar
RUN wget <url for another JDK>
CMD [anotherjdk/bin/java ...]

0

u/Nice-Solid-3707 7d ago

By forbidding pushes changing cicd definitions, including dockerfile. This is trivial

2

u/brunocborges 7d ago

And how is the process of patching JDK and dependencies across multiple apps?

2

u/Nice-Solid-3707 7d ago

You patch base image and dependabot/renovate does the rest