Are there clear docs as to what the Light build has/does not have

[AdamCameron]

In an attempt to reduce the surface area of Lucee’s various CVE vulnerabilities, we’re gonna try to pilot Lucee Light (on 5.x; we won’t be moving to 6.x).

The best docs I could find for what it comprises is Deploying Lucee :: Lucee Documentation

• Lucee-light.jar which includes the lucee core and loader, java bundles, admin and docs

Cool. But what does that mean? What do each of “core”, “loader”, “java bundles” actually mean in the context of CFML execution?

What I’m looking for, I guess, is some docs that say something to effect of:

Lucee Core includes all CFML except for the following, which require the indicated extension to be installed:

• <cfdocument>, <cfpdf>, <cfhtmltopdf>, all related PDF functions: PDF extension.
• <cfimage> and all related image functions ([including these non obvious ones]): Image extension.
• etc covering all CFML functionality

It is not clear to me from anything I have seen what LAS considers to be “core” and what it considers to be “extension” in this context. I’ve tried googling a bit, but… the link above is the best I can find :-/

Unfortunately this is a legacy app with very poor test coverage, so I can’t rely on regression tests to help me out as much as I would like here.

Cheers for any insight.

[markdrew]

(this is from memory from a long time ago, so take this as a wild stab in the darl)

• Core is basically the Lucee Runtime that knows all the tags and Interfaces (cache, datasource etc)
• The Loader allows you to dynamically reload the core with new versions so you can update it in without restarting the process. So it knows about where to get Jars and reload.
• Java bundles are the libraries that different extensions would require, so for example, mysql driver might need some specific version of JDBC vs the Postgres one

Hopefully @micstriit can clarify but I hope that makes sense.

With regards what’s in and out of the core I dont think there is such a doc?

[Roberto_Marzialetti]

There is also “Lucee Zero” but I see that it is only available for snapshots.

Lucee Zero, a lighter Lucee Light (Lamba Friendly)

Lucee Zero is a new smaller Lucee distribution without the admin or docs bundled. This reduces the jar size by about 2mb and avoids expanding them on install, which makes Lucee initial startup a lot faster, as there is less to deploy. Why an additional distribution? Firstly backwards compat with existing build pipelines, as you can’t build a full install by adding just extensions, the admin simply isn’t there with Lucee Zero. Secondly Lambas have some size limitations, you only have 50MB…

[AdamCameron]

@Roberto_Marzialetti

There is also “Lucee Zero” but I see that it is only available for snapshots.

Also only for Lucee 6 from my reading. So not a starter for my situation.

[AdamCameron]

@markdrew

With regards what’s in and out of the core I dont think there is such a doc?

That was kinda what I was driving at.

My mention of the “core” / “loader” / “java bundles” was illustrative that that info adds no clarity to the situation given even those aren’t documented (that I could find).