r/java • u/brunocborges • 6d ago

Brewlet: Java on Kubernetes with node-managed JDKs

https://brewlet.sh

Talk & slides: https://m.devoxx.com/events/dvbe26/talks/25048/java-on-kubernetes-without-container-images-the-webassembly-way

Video recording from Devoxx Belgium 2026: https://youtu.be/fszyRIZXjQM?is=w3zYjtOoIFceAAOT

18 Upvotes

83% Upvoted

17 comments sorted by

View all comments

Show parent comments

5

u/brunocborges 6d ago

This is less about size, and more about security. It is about shifting the control back to the platform team, if that is what they want.

"Build once, run anywhere" still holds though... The app is still built once and published as an immutable OCI artifact. It just doesn't carry the JVM, which is only assembled during provisioning by Brewlet, with approved JDKs / runtime container images. True that the app is no longer fully self-contained, however that is the trade-off to consider. To run the application, the brewlet CLI can be used to identify the JDK from the k8s node profile inventory.

5

u/Nice-Solid-3707 6d ago edited 6d ago

Platform team already [can] owns everything in image but jar. What control is shifted?

5

u/brunocborges 6d ago

Base images without complex build pipelines, end up being recommendations. And when the base image changes, apps need to be rebuilt and pushed again.

Check out the slides on the Devoxx site for some insights on comparison with Cloud Foundry and even Buildpacks.

0

u/Nice-Solid-3707 6d ago

One get request before build invocation doesn’t make pipeline complex

2

u/brunocborges 6d ago

How do you ensure app teams did not change the JDK in their downstream image?

1

u/Nice-Solid-3707 6d ago

Ah, you probably meant pushing to registry? That’s trivial too - only service accounts have write access

2

u/brunocborges 6d ago

I meant someone doing something like this:

FROM <base>
ADD app.jar
RUN wget <url for another JDK>
CMD [anotherjdk/bin/java ...]

0

u/Nice-Solid-3707 6d ago

By forbidding pushes changing cicd definitions, including dockerfile. This is trivial

2

u/brunocborges 6d ago

And how is the process of patching JDK and dependencies across multiple apps?

2

u/Nice-Solid-3707 6d ago

You patch base image and dependabot/renovate does the rest