Jib is a Maven plugin for building Docker and OCI images for your Java applications.

For information about the project, see the Jib project README. For the Gradle plugin, see the jib-gradle-plugin project.

These features are not currently supported but will be added in later releases.

• Support for WAR format

In your Maven Java project, add the plugin to your pom.xml:

<plugin>
  <groupId>com.google.cloud.tools</groupId>
  <artifactId>jib-maven-plugin</artifactId>
  <version>0.1.6</version>
  <configuration>
    <registry>myregistry</registry>
    <repository>myapp</repository>
  </configuration>
</plugin>

Configure the plugin by changing registry and repository to be the registry and repository to push the built image to.

Make sure you have the docker-credential-gcr command line tool. Jib automatically uses docker-credential-gcr for obtaining credentials. See Authentication Methods for other ways of authenticating.

For example, to build the image gcr.io/my-gcp-project/my-app, the configuration would be:

<configuration>
  <registry>gcr.io</registry>
  <repository>my-gcp-project/my-app</repository>
</configuration>

Make sure you have the docker-credential-ecr-login command line tool. Jib automatically uses docker-credential-ecr-login for obtaining credentials. See Authentication Methods for other ways of authenticating.

For example, to build the image aws_account_id.dkr.ecr.region.amazonaws.com/my-app, the configuration would be:

<configuration>
  <registry>aws_account_id.dkr.ecr.region.amazonaws.com</registry>
  <repository>my-app</repository>
</configuration>

Make sure you have a docker-credential-helper set up. For example, on macOS, the credential helper would be docker-credential-osxkeychain. See Authentication Methods for other ways of authenticating.

For example, to build the image my-docker-id/my-app, the configuration would be:

<configuration>
  <registry>registry.hub.docker.com</registry>
  <repository>my-docker-id/my-app</repository>
  <credHelpers><credHelper>osxkeychain</credHelper></credHelpers>
</configuration>

Build your container image with:

mvn compile jib:build

Subsequent builds are much faster than the initial build.

If you want to clear Jib's build cache and force it to re-pull the base image and re-build the application layers, run:

mvn clean compile jib:build

Having trouble? Let us know by submitting an issue, contacting us on Gitter, or posting to the Jib users forum.

You can also bind jib:build to a Maven lifecycle, such as package, by adding the following execution to your jib-maven-plugin definition:

<plugin>
  <groupId>com.google.com.tools</groupId>
  <artifactId>jib-maven-plugin</artifactId>
  ...
  <executions>
    <execution>
      <phase>package</phase>
      <goals>
        <goal>build</goal>
      </goals>
    </execution>
  </executions>
</plugin>

Then, you can build your container image by running:

mvn package

Jib can also export to a Docker context so that you can build with Docker, if needed:

mvn compile jib:dockercontext

The Docker context will be created at target/jib-dockercontext by default. You can change this directory with the targetDir configuration option or the jib.dockerDir parameter:

mvn compile jib:dockercontext -Djib.dockerDir=my/docker/context/

You can then build your image with Docker:

docker build -t myregistry/myapp my/docker/context/

Extended configuration options provide additional options for customizing the image build.

In this configuration, the image is:

• Built from a base of openjdk:alpine (pulled from Docker Hub)
• Pushed to localhost:5000/my-image:built-with-jib
• Runs by calling java -Xms512m -Xdebug -Xmy:flag=jib-rules -cp app/libs/*:app/resources:app/classes mypackage.MyApp
• Reproducible
• Built as OCI format

<configuration>
  <from>openjdk:alpine</from>
  <registry>localhost:5000</registry>
  <repository>my-image</repository>
  <tag>built-with-jib</tag>
  <credHelpers>
    <credHelper>osxkeychain</credHelper>
  </credHelpers>
  <jvmFlags>
    <jvmFlag>-Xms512m</jvmFlag>
    <jvmFlag>-Xdebug</jvmFlag>
    <jvmFlag>-Xmy:flag=jib-rules</jvmFlag>
  </jvmFlags>
  <mainClass>mypackage.MyApp</mainClass>
  <enableReproducibleBuilds>true</enableReproducibleBuilds>
  <imageFormat>OCI</imageFormat>
</configuration>

Pushing/pulling from private registries require authorization credentials. These can be retrieved using Docker credential helpers or defined in your Maven settings. If you do not define credentials explicitly, Jib will try to use credentials defined in your Docker config or infer common credential helpers.

Docker credential helpers are CLI tools that handle authentication with various registries.

Some common credential helpers include:

• Google Container Registry: docker-credential-gcr
• AWS Elastic Container Registry: docker-credential-ecr-login
• Docker Hub Registry: docker-credential-*

Configure credential helpers to use by specifying them in the credHelpers configuration.

Example configuration:

<configuration>
  ...
  <credHelpers>
    <credHelper>osxkeychain</credHelper>
  </credHelpers>
  ...
</configuration>

Registry credentials can be added to your Maven settings. These credentials will be used if credentials could not be found in any specified Docker credential helpers.

If you're considering putting credentials in Maven, we highly recommend using maven password encryption.

Example settings.xml:

<settings>
  ...
  <servers>
    ...
    <server>
      <id>MY_REGISTRY</id>
      <username>MY_USERNAME</username>
      <password>{MY_SECRET}</password>
    </server>
  </servers>
</settings>

• The id field should be the registry server these credentials are for.
• We do not recommend putting your raw password in settings.xml.

See the Jib project README.

These limitations will be fixed in later releases.

• Does not build directly to a Docker daemon.
• Pushing to Azure Container Registry is not currently supported.

See the Jib project README.

See the Jib project README.