PoC for improving startup time with class data sharing

docker-compose.yml

services:
  keycloak:
    build:
      context: "."
      dockerfile: "./Dockerfile"
    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
      KC_LOG_LEVEL: INFO
      KC_HTTP_ENABLED: "true"
      KC_HOSTNAME_STRICT: "false"
      KC_HOSTNAME_STRICT_HTTPS: "false"
    ports:
      - 8080:8080
      - 8443:8443
    volumes:
      - ./data:/opt/keycloak/data:z

Dockerfile

FROM quay.io/keycloak/keycloak:18.0.0 as builder

USER 0

RUN microdnf remove -y java-11-openjdk-headless && \
    microdnf install -y java-17-openjdk-headless && \
    microdnf clean all && \
    rm -rf /var/cache/yum/* && \
    alternatives --set java $(alternatives --list | grep jre_17_openjdk | cut -d$'\t' -f3) || echo "ignore bad exit code"

USER 1000

ENV KC_METRICS_ENABLED=true
ENV KC_FEATURES=preview
ENV KC_HTTP_RELATIVE_PATH=/auth
ENV KC_CACHE=local

ENV JAVA_OPTS_APPEND="-XX:ArchiveClassesAtExit=/opt/keycloak/bin/app-cds.jsa"

RUN /opt/keycloak/bin/kc.sh build

FROM quay.io/keycloak/keycloak:18.0.0

USER 0

RUN microdnf remove -y java-11-openjdk-headless && \
    microdnf install -y java-17-openjdk-headless && \
    microdnf clean all && \
    rm -rf /var/cache/yum/* && \
    alternatives --set java $(alternatives --list | grep jre_17_openjdk | cut -d$'\t' -f3) || echo "ignore bad exit code"

USER 1000

COPY --from=builder /opt/keycloak/lib/quarkus/ /opt/keycloak/lib/quarkus/

# Uncomment the follwing lines to use class data sharing
COPY --from=builder /opt/keycloak/bin/app-cds.jsa /opt/keycloak/bin/app-cds.jsa
ENV JAVA_OPTS_APPEND="-XX:SharedArchiveFile=/opt/keycloak/bin/app-cds.jsa -Xshare:on"

WORKDIR /opt/keycloak

ENTRYPOINT ["/opt/keycloak/bin/kc.sh", "start"]