We’re evaluating whether we can use the Lucee Light image instead of the full-blown one, in an effort to reduce the number of VE vulnerabilities that those images report.
When the docker build
is running, I get this:
#21 11.15 Lucee warmup completed. Shutting down.
#21 15.44 Thread[Thread-42,1,main]
#21 15.44 java.lang.NoClassDefFoundError: lucee/commons/lang/ExceptionUtil
#21 15.45 at lucee.runtime.engine.Controler$ControlerThread.run(Controler.java:118)
#21 15.45 Caused by: java.lang.ClassNotFoundException: Unable to load class 'lucee.commons.lang.ExceptionUtil' because the bundle wiring for lucee.core is no longer valid.
#21 15.45 at org.apache.felix.framework.BundleWiringImpl.findClassOrResourceByDelegation(BundleWiringImpl.java:1542)
#21 15.45 at org.apache.felix.framework.BundleWiringImpl.access$300(BundleWiringImpl.java:79)
#21 15.45 at org.apache.felix.framework.BundleWiringImpl$BundleClassLoader.loadClass(BundleWiringImpl.java:1976)
#21 15.45 at java.base/java.lang.ClassLoader.loadClass(Unknown Source)
#21 15.45 ... 1 more
#21 16.38 2024-02-20 10:27:50.472:INFO:oejsh.ContextHandler:stopped o.e.j.s.ServletContextHandler{/,null}
The reference to prewarm
there is from RUN /usr/local/tomcat/bin/prewarm.sh
in the Dockerfile which we are using to try to prewarm the download/install of some extensions.
The image build finishes, and I can bring up the container and it seems fine. But I’m concerned that the Lucee-Light image is missing something here. The same build process using the full-fat image does not give this.
I googled the stuff that seems googleable, but drew a blank.
Thoughts?