Suresh

Containers & K8S

2025-03-31T00:00:00+00:00

OpenJDK Container Images

# Distroless Java Images
# https://console.cloud.google.com/gcr/images/distroless/GLOBAL
# https://github.com/GoogleContainerTools/distroless#what-images-are-available
$ docker pull gcr.io/distroless/java-base-debian12:latest
$ docker pull gcr.io/distroless/java21-debian12:latest

# Distroless Static & Base
$ docker pull gcr.io/distroless/static-debian12:latest
$ docker pull gcr.io/distroless/base-debian12:latest

# GraalVM native-image base
$ docker pull cgr.dev/chainguard/graalvm-native:latest
$ docker pull cgr.dev/chainguard/static:latest-glibc
$ docker pull cgr.dev/chainguard/jdk:latest

# Openjdk
# https://github.com/docker-library/openjdk
$ docker pull openjdk:25-slim

# Eclipse Temurin
# https://github.com/adoptium/containers#supported-images
$ docker pull eclipse-temurin:24-jdk
$ docker pull eclipse-temurin:24-alpine

# Oracle OpenJDK
$ docker pull container-registry.oracle.com/java/openjdk:latest

# Oracle Java (NFTC)
# https://github.com/oracle/docker-images/tree/main/OracleJava
$ docker pull container-registry.oracle.com/java/jdk:latest

# Azul Zulu
# https://github.com/zulu-openjdk/zulu-openjdk
$ docker pull azul/zulu-openjdk-debian:24-jre
$ docker pull azul/zulu-openjdk-alpine:24-jre
$ docker pull azul/prime-debian:latest

# Amazon Corretto
# https://github.com/corretto/corretto-docker
$ docker pull amazoncorretto:23
$ docker pull amazoncorretto:23-alpine

# Microsoft OpenJDK
# https://learn.microsoft.com/en-us/java/openjdk/containers
$ docker pull mcr.microsoft.com/openjdk/jdk:21-ubuntu
$ docker pull mcr.microsoft.com/openjdk/jdk:21-distroless

# Liberica
# https://github.com/bell-sw/Liberica/tree/master/docker/repos/liberica-openjre-debian
$ docker pull bellsoft/liberica-openjdk-debian:latest
$ docker pull bellsoft/liberica-openjdk-alpine-musl:latest
$ docker pull bellsoft/liberica-openjdk-alpine:latest (libc)

# GraalVM CE & EE
# https://github.com/graalvm/container
$ docker pull ghcr.io/graalvm/graalvm-community:latest
$ docker pull ghcr.io/graalvm/native-image-community:muslib
$ docker pull container-registry.oracle.com/graalvm/native-image:latest

# GraalVM CE Dev Builds (No docker images available)
https://github.com/graalvm/graalvm-ce-dev-builds/releases/

# Jetbrains Runtime (No docker images available)
https://github.com/JetBrains/JetBrainsRuntime/releases

# Azul Zulu OpenJDK & Mission Control (Homebrew on MacOS)
# https://github.com/mdogan/homebrew-zulu
$ brew tap mdogan/zulu
$ brew install <name>

https://hub.docker.com/_/openjdk
https://github.com/docker-library/docs/tree/master/openjdk
https://container-registry.oracle.com/java/openjdk
https://www.graalvm.org/docs/getting-started/container-images/

Docker Commands

Docker Run

# Remove all unused images, not just dangling ones
$ docker system prune -af

# Docker Run
$ docker run \
        -it \
        --rm \
        --pull always \
        --workdir /app \
        --publish 8080:8080 \
        --name app \
        --mount type=bind,source=$PWD,destination=/app,readonly \
        openjdk:25-slim

Docker Image Size

# Compressed Size
$ docker image save ghcr.io/sureshg/containers:openjdk-latest | gzip | wc -c | numfmt --to=si
$ docker image save ghcr.io/sureshg/containers:nativeimage-latest | gzip | wc -c | numfmt --to=si
# OR
$ docker manifest inspect ghcr.io/sureshg/containers:openjdk-latest -v

# Uncompressed Size
$ docker inspect -f "{{ .Size }}" sureshg/jvm | numfmt --to=si
$ docker history sureshg/jvm

Debug Container

# On M1 mac
$ docker run \
         --platform linux/amd64 \
         --pull always \
         -it \
         --rm \
         -p 8080:80 \
         --name openjdk-playground \
         ghcr.io/sureshg/containers:openjdk-latest

# Default busybox image should work.
$ brew install cdebug
$ cdebug exec \
         --privileged \
         -it \
         --rm \
         --platform linux/amd64 \
         docker://openjdk-playground

# Extract a file from the Docker environment and store it locally
$ docker run \
         --rm \
         --entrypoint cat \
         busybox:latest \
         '/bin/ls' > ls

# OR copy files from a container
$ docker cp <CONTAINER>:/app/app/jar .

# OR
$ id=$(docker create ghcr.io/sureshg/containers:openjdk-latest)
$ docker cp $id:/app/app.jar - > app.tar
$ docker rm -v $id

JVM Ergonomics and Container logs

$ cat << EOF >App.java
import static java.lang.System.out;
public class App {
  void main() {
    var version = "• Java %s running on %s %s".formatted(
                   System.getProperty("java.version"),
                   System.getProperty("os.name"),
                   System.getProperty("os.arch"));
    out.println(version);
    long unit = 1024 * 1024L;
    long heapSize = Runtime.getRuntime().totalMemory();
    long heapFreeSize = Runtime.getRuntime().freeMemory();
    long heapUsedSize = heapSize-heapFreeSize;
    long heapMaxSize = Runtime.getRuntime().maxMemory();

    out.println("• [CPU] Active Processors: " + Runtime.getRuntime().availableProcessors());
    out.println("• [Mem] Current Heap Size (Committed) : " + heapSize/unit + " MiB");
    out.println("• [Mem] Current Free memeory in Heap  : " + heapFreeSize/unit + " MiB");
    out.println("• [Mem] Currently used memory         : " + heapUsedSize/unit + " MiB");
    out.println("• [Mem] Max Heap Size (-Xmx)          : " + heapMaxSize/unit + " MiB");
  }
}
EOF

$ docker run \
        -it \
        --rm \
        --cpus=2 \
        --memory=512m \
        --pull always \
        --mount type=bind,source=$(pwd),destination=/app,readonly \
        --mount type=bind,source=/,destination=/host,readonly \
        --name openjdk \
        openjdk:25-slim \
        java \
        --source 25 --enable-preview \
        -XX:+UnlockExperimentalVMOptions \
        -XX:+UnlockDiagnosticVMOptions \
        -XX:+PrintFlagsFinal \
        -XX:MaxRAMPercentage=0.8 \
        -XX:-MaxFDLimit \
        -Xlog:gc \
        /app/App.java \
        | grep -e "Use.*GC" -e "Active" -e "Using" -e "Max.*Limit" -e "Container" -e "•"

Note: For container logs, add -Xlog:gc*,os=trace,os+container=trace option. Override the default container CPU quota detection -XX:ActiveProcessorCount=<n>

JVM default GC

# OpenJDK reverts to Serial GC when it detects < 2 CPUs or < 2GB RAM
$ docker run -it --rm --cpus=1 --memory=1G openjdk:25-slim java -Xlog:gc --version
  #[0.007s][info][gc] Using Serial

OpenJDK - is_server_class_machine
Stop using CPU limits on Kubernetes
JVM ergonomics
https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

Container Sandbox

$ docker run \
         -it --rm \
         --cpus="0.5" \
         --memory="512m" \
         --memory-swap="640m" \
         --pids-limit 512 \
         --cap-drop=ALL \
         --cap-add=DAC_OVERRIDE \
         --security-opt=no-new-privileges \
         --ulimit nproc=20:20 \
         --ulimit fsize=1000000 \
         --user nobody \
         --network none \
         --read-only \
         --tmpfs /tmp \
         --name sandboxed \
         --workdir /app \
         --mount type=bind,source=$PWD,destination=/app,readonly \
         --mount type=bind,source=/var/run/docker.sock,destination=/var/run/docker.sock,readonly \
         --mount type=bind,source=/usr/bin/docker,destination=/usr/bin/docker,readonly \
         --mount type=bind,source=/proc/,target=/host/proc/,ro=true \
         --mount type=bind,source=/sys/fs/cgroup/,target=/host/sys/fs/cgroup,ro=true \
         openjdk:25-slim java --enable-preview src/App.java
         
# --security-opt seccomp=my_sandbox
# --cap-add=chown \
# --cap-add=setgid \
# --cap-add=setuid \
# --cap-add=sys_chroot \
# --cap-add=audit_write \
# --cap-add=kill \
# --cap-add=sys_tty_config \
# --cap-add=DAC_OVERRIDE - Needed to allow overwriting the file

# Create nobody user
# RUN useradd --shell /bin/sh --create-home --uid 65534 nobody

App Running on K8S/Docker

# Check if running on docker container
$ docker run \
     -it \
     --rm \
     --pull always \
     openjdk:25-slim \
     sh -c "cat /proc/self/cgroup | grep -i '/docker'"

# Check if running on Kubernets
$  docker run \
     -it \
     --rm \
     --pull always \
     openjdk:25-slim \
     sh -c "printenv | grep SERVICE"

Check if the container is running inside K8S

Access Docker desktop LinuxKit VM on MacOS

$ docker run -it --rm --memory=256m --cpus=1 --mount type=bind,source=/,destination=/host --name alpine alpine
 /# chroot /host
  # docker version

Multi Architecture Support

tonistiigi/binfmt

$ docker run --rm --privileged tonistiigi/binfmt --install all

multiarch/qemu-user-static

$ docker run --rm --privileged multiarch/qemu-user-static --reset -p yes

Supported Targets - qemu-binfmt-conf.sh
Dockerhub Supported Archs

Examples

$ docker run -it --rm --platform=linux/aarch64  alpine uname -m
  aarch64
$ docker run -it --rm --platform=linux/amd64 alpine uname -m
  x86_64

$ docker run --rm arm64v8/alpine uname -a
$ docker run --rm arm32v7/alpine uname -a
$ docker run --rm ppc64le/alpine uname -a
$ docker run --rm s390x/alpine uname -a
$ docker run --rm tonistiigi/debian:riscv uname -a

Netcat Webserver

FROM alpine

ENTRYPOINT while :; do nc -k -l -p $PORT -e sh -c 'echo -e "HTTP/1.1 200 OK\n\n hello, world"'; done
# https://github.com/jamesward/hello-netcat
# docker build -t hello-netcat .
# docker run -p 8080:80 -e PORT=80 -it hello-netcat

Forwards Logs

# forward request and error logs to docker log collector
RUN ln -sf /dev/stdout /var/log/nginx/access.log \
 && ln -sf /dev/stderr /var/log/nginx/error.log

# OR output directly to
/proc/self/fd/1 (STDOUT)
/proc/self/fd/2 (STDERR)

# https://docs.docker.com/config/containers/logging/configure/

Shutdown signals and EnytryPoint

#!/bin/bash
## Entrypoint script for my-app. This script is to show how to write
## an entrypoint script that actually passes down signals from Docker.

## Load our DB Password into a runtime only Environment Variable
if [ -f /run/secrets/password ]
then
  echo "Loading DB password from secrets file"
  DB_PASS=$(cat /run/secrets/password)
  export DB_PASS
fi

## Run the Application
exec my-app

ENTRYPOINT ["../../myapp-entrypoint.sh"]

Docker stats GraalVM app

HTTP Proxy

FROM debian:stable-slim

ENV HTTP_PROXY="http://proxy.test.com:8080"
ENV HTTPS_PROXY="http://proxy.test.com:8080"
ENV NO_PROXY="*.test1.com,*.test2.com,127.0.0.1,localhost"

Container Tools

https://github.com/rancher-sandbox/rancher-desktop
https://github.com/beringresearch/macpine (Lightweight Linux VMs on MacOS)
https://github.com/containerd/containerd
https://github.com/lima-vm/lima (Linux on Mac)
https://github.com/containerd/nerdctl
https://github.com/k3s-io/k3s
https://github.com/rancher/k3d/
https://kind.sigs.k8s.io/
https://github.com/k0sproject/k0s
https://github.com/canonical/multipass (Running Ubuntu VM)
https://podman.io/blogs/2021/09/06/podman-on-macs.html
https://github.com/wagoodman/dive
https://github.com/google/cadvisor
https://github.com/google/go-containerregistry/tree/main/cmd/crane
CoSign - Container Signing

JVM Profiling

2025-03-18T00:00:00+00:00

1. Flight Recorder

2. Java Mission Control

# https://jdk.java.net/jmc/
# https://adoptium.net/jmc
# https://github.com/adoptium/jmc-build/releases
# https://github.com/corretto/corretto-jmc/releases
# https://www.oracle.com/java/technologies/jdk-mission-control.html
# https://www.azul.com/products/components/zulu-mission-control/

$ curl https://github.com/adoptium/jmc-build/releases/download/8.2.0/org.openjdk.jmc-8.2.0-macosx.cocoa.x86_64.tar.gz | tar xv -

$ rm -rf "/Applications/JDK Mission Control.app"
$ mv "JDK Mission Control.app" /Applications
$ open '/Applications/JDK Mission Control.app'

# To run with a JDK
$ ./jmc -vm %JAVA_HOME%\bin
# or
$ open '/Applications/JDK Mission Control.app' --args -vm $JAVA_HOME/bin

3. Visualization

FlameGraph of java threads

$ wget https://github.com/brendangregg/FlameGraph/raw/master/flamegraph.pl
$ wget https://github.com/brendangregg/FlameGraph/raw/master/stackcollapse-jstack.pl
$ chmod +x *.pl

# Run multiple times to get more samples
$ jcmd GradleDaemon Thread.print >> jcmd.tdump
$ stackcollapse-jstack.pl jcmd.tdump > jcmd.tdump.folded
$ flamegraph.pl --color=io --title "Thread Dump" --countname "Samples" --width 1080 jcmd.tdump.folded > jcmd.tdump.svg

JFR to FlameGraph

# Download the latest release from Github
$ LOCATION=$(curl -sL https://api.github.com/repos/jvm-profiling-tools/async-profiler/releases/latest \
    | grep -i "browser_download_url" \
    | grep -i "converter.jar" \
    | awk '{ print $2 }' \
    | sed 's/,$//'       \
    | sed 's/"//g' )     \
    ; curl --progress-bar -L -o ${HOME}/install/tools/converter.jar ${LOCATION}

$ java -cp ${HOME}/install/tools/converter.jar \
       jfr2flame --total --dot --lines  \
       openjdk-playground.jfr flame.html
$ open flame.html

CPU/Memory Viz of a process

Script

# Download the script
$ wget https://github.com/sureshg/openjdk-playground/raw/main/scripts/cpu-mem-viz.sh
# Record CPU/Memory usage of a process
$ ./scripts/cpu-mem-viz.sh --pid <pid>

# Generate visualization using gunplot
$ ./scripts/cpu-mem-viz.sh --pid <pid> -a gnuplot
$ open -a "Google Chrome" gnuplot-<pid>.svg

# Generate visualization using vega-lite
$ sudo npm install -g vega-lite vega-cli
$ ./scripts/cpu-mem-viz.sh --pid <pid> -a vega
$ open -a "Google Chrome" vega-lite-<pid>.svg

Misc Tools

# Using htop
$  htop -p $(pgrep -f idea)

# Using psrecord
$ pip install matplotlib psrecord
$ psrecord $(pgrep -f idea) --plot plot.png --log activity.txt --include-children --duration 5
$ open plot.png

4. Profilers & Tools

5. Commands

Wizard to create configuration files (.jfc)

$ jfr configure --interactive
$ jfr summary openjdk-playground.jfr

# Concat multiple JFR files
$ jfr assemble <repository> <file> // cat jfr_file_version_* >> combined.jfr

# Print specific event details
$ jfr print --events 'jdk.*' --stack-depth 64 openjdk-playground.jfr
$ jfr print --events CPULoad,GarbageCollection openjdk-playground.jfr

# Pinned virtual threads
$  jfr print --events jdk.VirtualThreadPinned openjdk-playground.jfr

# Remove passwords from JFR
$  jfr scrub --exclude-events InitialEnvironmentVariable recording.jfr no-psw.jfr

# Search for JFR metadata
$ jfr metadata | grep -i -e "tls" -e "x509" -e "security" | grep -i "@Name"

Some config options are,

-XX:StartFlightRecording:filename=recording.jfr
-XX:FlightRecorderOptions:stackdepth=256

-XX:+HeapDumpOnOutOfMemoryError
-XX:ErrorFile=$USER_HOME/java_error_in_app_%p.log
-XX:HeapDumpPath=$USER_HOME/java_error_in_app.hprof

Find finalizable objects in your application

$ java -XX:StartFlightRecording:filename=dump.jfr ...
$ jfr print --events FinalizerStatistics dump.jfr

Troubleshoot Perf Issues Using JFR
Flight Recorder Tool
Flight Recorder API Guide

6.JFR Streaming

7. HeapDump

Analyze using JOL

 $ curl -sL https://builds.shipilev.net/jol/jol-cli-latest.jar > jol-cli.jar
 $ java -jar jol-cli.jar heapdump-stats heapdump.hprof

8. ThreadDump

# Get all java processes
$ jcmd -l
$ jps -mlvV

# See the available commands for all java processes
$ jcmd 0 help
# Use PID or main class
$ jcmd dev.suresh.Main VM.version
$ jcmd <dev.suresh.Main | pid> Thread.print

# Virtual thread dump
$ jcmd dev.suresh.Main Thread.dump_to_file -format=json openjdk-playground-threads.json

# OR
$ kill -3 <pid>
$ kill -3 "$(jcmd -l | grep "dev.suresh.Main" | cut -d " " -f1)"
# OR
# Prints additional info about thread (-e  extended listing) and locks (-l  long listing)
$ jstack -l -e  <pid>

# Show Native Memory
$ jcmd GradleDaemon VM.native_memory

9. Load Testing

# Run Gataling Recorder and select listening port as 9999
$ ~/install/gatling/bin/recorder.sh

$ Confiure it as system proxy
GATALING_PROXY_PORT=9999
NETWORK_SERVICE="Wi-Fi"
networksetup -getwebproxy $NETWORK_SERVICE
networksetup -getsecurewebproxy $NETWORK_SERVICE
networksetup -setwebproxy $NETWORK_SERVICE localhost $GATALING_PROXY_PORT
networksetup -setsecurewebproxy $NETWORK_SERVICE localhost $GATALING_PROXY_PORT

# Browse the application URLs, Stop recording & Switch off the proxy
networksetup -setwebproxystate $NETWORK_SERVICE off
networksetup -setsecurewebproxystate $NETWORK_SERVICE off

# Run simulation
$ ~/install/gatling/bin/gatling.sh --run-mode local --simulation dev.suresh.LoadTest

10. Unified GC Logging

$ java -Xlog:help

# For G1GC
$ java -XX:+UseG1GC
-XX:MaxGCPauseMillis=200
-XX:InitiatingHeapOccupancyPercent=70
-XX:+PrintGC
-XX:+PrintGCDateStamps
-XX:+PrintGCDetails
-Xloggc:/log/gclogs/app-gc.log
-XX:+UseGCLogFileRotation
-XX:NumberOfGCLogFiles=15
-XX:GCLogFileSize=10M ...

11. JVM Tools

Java Object Layout (JOL)

$ wget -q https://builds.shipilev.net/jol/jol-cli-latest.jar
$ java -jar jol-cli-latest.jar internals java.lang.String

12. System/Node Health

SAR (System Activity Report)

$ yum install sysstat

$ sar -A

# Generate file for single day:
$ sar -A -f /var/log/sa/sa19 > /tmp/sa19_$(hostname).txt

# Generate file for multiple days files:
$ ls /var/log/sa/sa?? | xargs -i sar -A -f {} > /tmp/sar_$(uname -n).txt

https://github.com/vlsi/ksar
https://github.com/sargraph/sargraph.github.io
https://sarcharts.tuxfamily.org/
https://www.cyberciti.biz/tips/top-linux-monitoring-tools.html

Node Exporter
Prometheus JFR Exporter

13. Commands

Grabbing a file from a remote system with ssh

# grabbing a file from a remote system with ssh but no scp binary

$ ssh user@remote-system "cat <file.txt" > file.txt
$ ssh user@remote-system  'tar -S cz somedirectory' | tar -S xvz

# Using Rsync: Upload
$ rsync -Pavze ssh path/to/src remote-system:path/to/dst
# Download
$ rsync -Pavze ssh remote-system:path/to/src path/to/dst

Strace

# Syscall trace
$ strace -tttTf -p <pid>

Netstat

$ netstat -tunalp

# Socket stats
$ ss -s

14. Clock Cycles

15. Resources

OpenJDK

2025-03-18T00:00:00+00:00

Java Commands

1. Create Source Code Structure

$ mkdir -p src/{main,test}/{java,resources}

2. Preview features

$ javac --enable-preview -release 24 Foo.java
$ java  --enable-preview Foo

3. Java Platform Module Systems (JPMS)

$ java --list-modules
$ java --describe-module java.se
$ java --show-module-resolution java.base

# Replace upgradeable modules in the runtime image
$ java --upgrade-module-path $DIR

Java Compiler Upgradeable module

4. Disassembles a class

$ javap -p -v <classfile>

# Show the class version
$ javap -p -v build.classes.kotlin.main.App | grep version

Javap Pastebin

5. App CDS

# Before JDK 18
if [ ! -f app.jsa ]; then
  java -XX:ArchiveClassesAtExit=app.jsa -jar app.jar
else
  java -XX:ShareArchiveFile=app.jsa -jar app.jar
fi

# Since JDK 19, auto generate the CDS archive
$ java -XX:+AutoCreateSharedArchive -XX:SharedArchiveFile=app.jsa -jar app.jar

# Create default CDS archive
$ jlink-runtime/java -Xshare:dump [-XX:-UseCompressedOops]
# Check if it worked, this will fail if it can't map the archive (lib/server/classes.jsa)
$ jlink-runtime/java -Xshare:on --version

https://ionutbalosin.com/2022/04/application-dynamic-class-data-sharing-in-hotspot-jvm
https://dev.java/learn/class-data-sharing-and-application-class-data-sharing-in-hotspot
https://mbien.dev/blog/entry/custom-java-runtimes-with-jlink

6. Show Java VMProperty Settings

$ java --version
$ java -Xinternalversion

# Show Java Version (Useful for shell scripts)
$ java -XshowSettings:properties -version 2>&1 | grep "java.specification.version =" | awk '{print $3}'
$ jshell --feedback=silent -  <<< 'System.out.println(System.getProperty("java.specification.version"))'

# Show all settings
$ java -XshowSettings:all --version

# Show all Javac linter options
$ javac --help-lint

# Show all system properties
$ java -XshowSettings:properties --version

# VM extra options
$  java -XX:+UnlockExperimentalVMOptions -XX:+UnlockDiagnosticVMOptions -XX:+PrintFlagsFinal --version

# Java JIT compiler options
$ java -Xcomp            forces compilation of methods on first invocation (slow startup)
$ java -Xint             interpreted mode execution only (fast startup)
$ java -Xmixed           mixed mode execution (default)

7. Scan deprecated APIs

# Print dependency summary
$ jdeps -summary  app.jar

# Check the dependencies on JDK internal APIs
$ jdeps --jdk-internals --classpath libs.jar app.jar

# List of module dependences to be used in JLink
$ jdeps --ignore-missing-deps --print-module-deps  app.jar

# List all service providers
$ jlink --suggest-providers java.security.Provider

# List all jlink plugins
$ jlink --list-plugins

# Generate module-info
$ jdeps --generate-module-info ./  app.jar

# List all deprecated APIs for a release
$ jdeprscan --for-removal --release 24 --list

# Scan deprecated APIs
$ jdeprscan --for-removal --release 24 app.jar

Java EE Maven artifacts

8. JPMS

# Start ModuleMainClass
$ java -m jdk.httpserver -b 127.0.0.1

# Compile all modules at once (Start from the main module)
$ javac  --enable-preview \
         --release 24 \
         -parameters  \    // Optional, Generate metadata for reflection on method parameters
         --add-modules ALL-MODULE-PATH \  // Optional, Root modules to resolve in addition to the initial modules
         --module-path ... \           // Optional, where to find application modules
         --module-source-path "src" \  // Source files for multiple modules
         -d classes  \
         --module MainApp              // Compile only the specified module(s)

# Package all modules (Create for all modules)
$ jar --create \
      --file mods/app.jar \
      --main-class dev.suresh.MainKt \
      --module-version 1.0 \    // Optional
      -C app/ classes resources // Or *.class

# Launch app
$ java  --enable-preview \
        --show-version \
        --show-module-resolution \
        --module-path mods \
        --module app   // OR <module>/<mainclass>

# Build native image from modular jars
$ native-image \
    -p base-module.jar:main-module.jar \
    -m dev.suresh.Main

# JavaFX 24 using jlink & jpackage
$ wget "https://download.java.net/java/early_access/.../openjfx-xxx_macos-aarch64_bin-jmods.tar.gz"
$ tar -xvzf openjfx-xxx_macos-aarch64_bin-jmods.tar.gz

$ jlink --output javafx-jdk \
        --module-path $JAVA_HOME/jmods:javafx-jmods-24 \
        --add-modules javafx.controls,java.desktop,java.logging
#       --add-modules ALL-MODULE-PATH

$ javafx-jdk/bin/java --list-modules

$ jpackage --main-jar app.jar \
           --runtime-image javafx-jdk \
           --type app-image \
           --name app \
           --java-options "-Xmx64m" \
           --arguments "arg" \
           --icon app.ico \
           --input app \
           --dest bin

9. JShell

# JShell with preview feature enabled
$ jshell --enable-preview
$ jshell --show-version --enable-preview  --enable-native-access --startup JAVASE --feedback concise

# Use custom startup script
$ jshell --enable-preview --startup DEFAULT --startup ~/calc.repl

# Query system properties/run java code
$ fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"

10. Java TEMP Config

$ echo "-------- TMP PATH for $OSTYPE --------"
$ MKTEMP_PATH="$(dirname "$(mktemp -u)")/"
$ JAVA_TMP_DIR="$(java -XshowSettings:properties -version 2>&1 | awk 'tolower($0) ~ /java.io.tmpdir/{print $NF}')/"
$ JAVA_FILE_ENC="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"

$ echo "MKTEMP_PATH    = $MKTEMP_PATH"
$ echo "TMP            = $TMP"
$ echo "TEMP           = $TEMP"
$ echo "TMPDIR (Mac)   = $TMPDIR"
$ echo "RUNNER_TEMP    = $RUNNER_TEMP"
$ echo "JAVA_IO_TMPDIR = $JAVA_TMP_DIR"
$ echo "JAVA_FILE_ENC  = $JAVA_FILE_ENC"
$ echo "/TMP           = $(ls -l /tmp)"

IDEs and Tools

IntelliJ Selection Modes
- All Actions - CMD + SHIFT + A
- Select all occurrences - CMD + CTRL + G
- Column selection mode - CMD + SHIFT + 8
- Multiple Cursors - SHIFT + ALT + Left Click
- Multi Selection - SHIFT + ALT + Select as usual
- Caret Cloning - SHIFT + ALT + Middle click on end line
- Move line - SHIFT + ALT + Arrow UP/DOWN

Plugin Version Update

$ PLUGIN_VERSION="1.2.6.2594"
$ wget --content-disposition "https://plugins.jetbrains.com/plugin/download?rel=true&updateId=331908"
$ unzip github-copilot-intellij-${PLUGIN_VERSION}.zip
$ cd github-copilot-intellij/lib
$ jar -tvf github-copilot-intellij-${PLUGIN_VERSION}.jar | grep plugin.xml
$ unzip github-copilot-intellij-${PLUGIN_VERSION}.jar
# Change until-build="223.*"
$ vi META-INF/plugin.xml
$ zip -r github-copilot-intellij-${PLUGIN_VERSION}.jar META-INF
$ rm -rf META-INF
$ cd ../../
$ zip -r github-copilot-intellij-${PLUGIN_VERSION}.zip github-copilot-intellij/
$ rm -rf github-copilot-intellij

# Now upload github-copilot-intellij-${PLUGIN_VERSION}.zip (Preferences -> Plugins -> ⚙️ -> Install Plugin from Disk)

IntelliJ Plugin Channels
- https://plugins.jetbrains.com/plugins/beta/list
- https://plugins.jetbrains.com/plugins/snapshots/org.jetbrains.compose.desktop.ide

Networking & Security

🚨Security Developer’s Guide

1. Allow Unsafe Server Cert Change

# This is Unsafe. Don't use in prod.
-Djdk.tls.allowUnsafeServerCertChange=true
-Dsun.security.ssl.allowUnsafeRenegotiation=true

2. Debugging TLS

https://docs.oracle.com/en/java/javase/24/security/java-secure-socket-extension-jsse-reference-guide.html#GUID-4D421910-C36D-40A2-8BA2-7D42CCBED3C6
https://docs.oracle.com/en/java/javase/24/security/java-secure-socket-extension-jsse-reference-guide.html

https://github.com/sureshg/InstallCerts/blob/master/src/main/kotlin/io/github/sureshg/extn/Certs.kt

# Turn on all debugging
$ java -Djavax.net.debug=all

# Override HostsFileNameService
$ java -Djdk.net.hosts.file=/etc/host/style/file

# Force IPv4
$ java -Djava.net.preferIPv4Stack=true

# The entropy gathering device can also be specified with the system property
$ java -Djava.security.egd=file:/dev/./urandom

3. Java Networking Properties

http://htmlpreview.github.io/?https://github.com/openjdk/jdk/blob/master/src/java.base/share/classes/java/net/doc-files/net-properties.html
https://docs.oracle.com/en/java/javase/24/docs/api/java.base/java/net/doc-files/net-properties.html
All Java Networking System Properties
https://docs.oracle.com/javase/8/docs/technotes/guides/net/proxies.html

Config	Description
http.proxyHost	The host name of the proxy server
http.proxyPort	The port number, the default value being `80`
http.nonProxyHosts

HTTP

# Use JAVA_TOOL_OPTIONS
$ export JAVA_TOOL_OPTIONS="
${JAVA_TOOL_OPTIONS}
-Dhttp.useProxy=true
-Dhttps.useProxy=true
-Dhttp.proxyHost=172.10.10.1
-Dhttp.proxyPort=8100
-Dhttps.proxyHost=172.10.10.1
-Dhttps.proxyPort=8100
-Dhttp.nonProxyHosts='localhost|127.0.0.1|cdn.test.org|*-prod.app.com|slack.com'"

# OR use system properties
$ java -Dhttp.proxyHost=webcache.example.com -Dhttp.proxyPort=8080 -Dhttp.nonProxyHosts="localhost|host.example.com" <URL>

Env vars

export HTTP_PROXY=http://USERNAME:PASSWORD@10.0.1.1:8080/
export HTTPS_PROXY=https://USERNAME:PASSWORD@10.0.0.1:8080/
export NO_PROXY=master.hostname.example.com

4. HTTP Client Properties

-Djdk.internal.httpclient.disableHostnameVerification
-Djdk.httpclient.HttpClient.log=headers
-Djdk.internal.httpclient.debug=false
-Djdk.tls.client.protocols="TLSv1.2"

Gradle Kotlin DSL

1. Docs

2. Name Abbrevation

$ ./gradlew --console=plain \
            --continuous \
            --dry-run \
            --no-daemon \
            -Dauthor=Suresh \
            -Pmyprop=myvalue \
            cle dU

3. Configure/Create Tasks

Eager

val p: Jar = getByName<Jar>("jar")       // Get existing task
val q: Jar = create<Jar>("jar") {}       // Create new task
val r: Jar by getting(Jar::class)        // Get task using property delegate
val s: Copy by creating(Copy::class) {}  // Create task using property delegate

Lazy (Configuration Avoidance API)

val t: TaskProvider<Jar> = named<Jar>("jar"){}        // Get existing task
val u: TaskProvider<Jar> = register<Jar>("jar"){}     // Create new task
val v: TaskProvider<Jar> by registering(Jar::class){} // Create task using property delegate
val jar: TaskProvider<Task> by existing // Get task using property delegate

val foo: FooTask by existing            // Take Task type from val (Kotlin 1.4)
val bar: BarTask by registering {}      // Take Task type from val (Kotlin 1.4)

4. Reproducible builds

withType<AbstractArchiveTask>().configureEach {
    isPreserveFileTimestamps = false
    isReproducibleFileOrder = true
}

reproducible-builds.org
https://github.com/jvm-repo-rebuild/reproducible-central

5. Multi Release Jar

// See https://github.com/melix/mrjar-gradle for more on multi release jars
val mrVersion = "11"
if (JavaVersion.current().isJava11Compatible) {
    sourceSets {
        create("java$mrVersion") {
            java {
                srcDirs("src/main/java$mrVersion")
            }
        }
    }

    tasks {
        // For each source set, Gradle will automatically create a compile task.
        val mrJavaCompile = named<JavaCompile>("compileJava${mrVersion}Java") {
            sourceCompatibility = mrVersion
            targetCompatibility = mrVersion
            options.compilerArgs = listOf("--release", mrVersion)
        }

        named<Jar>("jar") {
            into("META-INF/versions/$mrVersion") {
                from(sourceSets.named("java$mrVersion").get().output)
            }
            manifest.attributes(
                "Multi-Release" to "true"
            )

            dependsOn(mrJavaCompile)
        }
    }
}

6. Dependencies

# Direct dependencies
$ ./gradlew -q dependencies --configuration implementation
# Transitive dependencies
$ ./gradlew -q dependencies --configuration runtimeClasspath

# Dependencies insight for a dependency group.
$ ./gradlew -q dependencyInsight --configuration runtimeClasspath --dependency kotlin
$ ./gradlew -q dependencyInsight --dependency log4j-core

# Task Dependencies
$ ./gradlew clean build --dry-run

# Dependency updates
$ ./gradlew clean dependencyUpdates -Drevision=release

Refresh dependencies & Caching

# Force Gradle to execute all tasks ignoring up-to-date checks
$ ./gradlew clean build --rerun-tasks

# Don't reuse outputs from previous builds (org.gradle.caching=false)
$ ./gradlew clean build --no-build-cache

# To refresh all dependencies in the dependency cache
$ ./gradlew clean build --refresh-dependencies

Maven

1. Create a Project

$ mvn archetype:generate -DgroupId=dev.suresh -DartifactId=my-app -DarchetypeArtifactId=maven-archetype-quickstart -DarchetypeVersion=1.4 -DinteractiveMode=false

2. Enabling Java preview feature

<build>
    <plugins>
        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-compiler-plugin</artifactId>
            <version>3.6.2</version>
            <configuration>
                <release>15</release>
                <compilerArg>--enable-preview</compilerArg>
            </configuration>
        </plugin>

        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-surefire-plugin</artifactId>
            <configuration>
                <argLine>--enable-preview</argLine>
            </configuration>
        </plugin>

        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-failsafe-plugin</artifactId>
            <configuration>
                <argLine>--enable-preview</argLine>
            </configuration>
        </plugin>
    </plugins>
</build>

3. Reproducible Builds

<properties>
    <project.build.outputTimestamp>2020-04-02T08:04:00Z</project.build.outputTimestamp>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
</properties>

4. Maven Wrapper

$ mvn wrapper:wrapper -Dmaven=3.8.5

5. Update Version number

$ ./mvnw versions:set -DnewVersion=1.0.1-SNAPSHOT -DprocessAllModules -DgenerateBackupPoms=false
$ ./mvnw versions:revert // Rollback
$ ./mvnw versions:commit

6. Dependency Tree

# Show all orginal versions, not the resolved ones.
$ ./mvnw dependency:tree
$ ./mvnw dependency:tree -Ddetail=true
$ ./mvnw dependency:tree -Dverbose -Dincludes=org.jetbrains.kotlin:kotlin-stdlib
$ ./mvnw clean verify

# Dependency and plugin updates
$ ./mvnw clean versions:display-dependency-updates versions:display-plugin-updates

# Search Artifacts by class
https://search.maven.org/search?q=fc:kotlin.text.Regex

Microservices Starters

1. SpringBoot

$ curl https://start.spring.io/starter.zip \
    -d dependencies=devtools,web \
    -d type=gradle-project \
    -d language=kotlin \
    -d javaVersion=11 \
    -d packaging=jar \
    -d platformVersion=2.2.6.RELEASE \
    -d name=helloworld \
    -d groupId=dev.suresh \
    -d artifactId=helloworld \
    -d packageName=dev.suresh \
    -d description=Hello%20World%20App \
    -d baseDir=helloworld \
    -o helloworld.zip

Misc

Github Registry

$ VERSION=$(date +%s)
$ docker build . --file Dockerfile --tag docker.pkg.github.com/sureshg/repo/app:${VERSION}
$ docker login docker.pkg.github.com --username sureshg --password ${{ secrets.GITHUB_TOKEN }}
$ docker push docker.pkg.github.com/sureshg/repo/app:${VERSION}

Install Command Line Tools
```
$ xcode-select --install
```

OpenJDK Build

$ sdk install java 24-open
$ git clone https://github.com/openjdk/jdk.git
$ cd jdk
# $ make clean
$ bash configure
$ make images
$ build/*/images/jdk/bin/java --version

Oracle A1 Flex

# Reset the password
# https://docs.oracle.com/en-us/iaas/Content/Compute/References/serialconsole.htm#four__opcpasswordreset
$ /usr/sbin/load_policy -i
$ sudo /bin/mount -o remount, rw /
$ sudo passwd opc
$ sudo reboot -f

# Install softwares
$ sudo yum upgrade -y
$ sudo yum install curl wget tree docker git zsh -y
$ sh -c "$(curl -fsSL https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"
$ curl -s "https://get.sdkman.io" | bash
$ sdk i java 24.ea-open

# For Github self hosted runners on Aarch64
export LD_LIBRARY_PATH=/opt/oracle/oracle-armtoolset-8/root/usr/lib64:/usr/local/lib:/usr/lib:/usr/local/lib64:/usr/lib64
export DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=1
export JAVA_HOME_11_X64=/home/opc/.sdkman/candidates/java/11.0.11.hs-adpt

# Install EPEL
$ sudo rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm

Open Ports

 # Networking > Virtual cloud networks > Security List > Add Ingress Rules (open tcp/8080)
 $ firewall-cmd  --permanent --zone=public --add-port=8080/tcp
 $ firewall-cmd  --reload
 $ http://ip:8080

Awesome Svgs

Illustrations

https://undraw.co/illustrations
https://www.manypixels.co/gallery/
https://www.pixeltrue.com/free-illustrations

Background

https://www.svgbackgrounds.com/

Icons

https://icons.getbootstrap.com/
https://material.io/resources/icons/?style=baseline (not sag)
https://fontawesome.com/v4.7.0/icons/ (not sag)
https://simpleicons.org/ (Brand Icons - good one)
https://github.com/microsoft/fluentui-system-icons
https://tablericons.com/
https://tabler-icons.io/
https://systemuicons.com/
https://github.com/c5inco/intellij-icons-compose
https://www.visiwig.com/icons/
https://standart.io/
https://thenounproject.com/
https://www.flaticon.com/
https://www.iconfinder.com/
https://ionicons.com/
https://icons8.com/
https://github.com/game-icons/icons

Emojis

https://emojipedia.org/search/
https://github.com/twitter/twemoji/tree/master/assets

Awesome List

https://github.com/vkarampinis/awesome-icons
https://github.com/notlmn/awesome-icons
https://github.com/ikatyang/emoji-cheat-sheet

Tools

https://jakearchibald.github.io/svgomg/
https://css-tricks.com/tools-for-optimizing-svg/
https://imageoptim.com/mac
https://xmlgraphics.apache.org/batik/
https://github.com/svg/svgo-osx-folder-action

$ pip3 install mkdocs-macros-plugin
$ ./gradlew dokka
$ cp  docs/mkdocs.yml build/dokka
$ cp -R docs/images build/dokka/my-app
$ cp CHANGELOG.md build/dokka/my-app/CHANGELOG.md
$ cp README.md build/dokka/my-app/Overview.md
$ Fix the img reference on Overview.md
$ cd build/dokka
$ mkdocs build

Kotlin

2025-02-11T00:00:00+00:00

Tip: Shortcut: Cmd + C · Configure: Settings | View | Edit · Press Cmd + C to copy.

Kotlin Compiler Options

$ kotlinc -X 2>&1 | grep -i release

Native Image

$ sdk u java graalvm-ce-dev
$ cat > App.kt << EOF
fun main() {
  println("Hello Kotlin!")
}
EOF

# $ kotlinc -version \
#           -verbose \
#           -include-runtime \
#           -java-parameters \
#           -jvm-target 19 \
#           -Xjdk-release=19 \
#           -api-version 1.9 \
#           -language-version 2.0 \
#           -Werror \
#           -progressive \
#           App.kt -d app.jar

$ kotlinc -version -include-runtime App.kt -d app.jar
$ java -showversion -jar app.jar
$ native-image \
      --no-fallback \
      --native-image-info \
      --enable-preview \
      -jar app.jar

$ chmod +x app
$ time ./app

# Static image info
$ file app
$ otool -L app
$ objdump -section-headers  app

# Find GraalVM used to generate the image
$ strings -a app | grep -i com.oracle.svm.core.VM

Videos

https://www.youtube.com/watch?v=SEKsvHYZz8s (crypto 101)

Samples

fun main() {
  println("Hello, Kotlin!")
}

Eager style

if (true) {
    doThis()
}

Lazy/one-liner style

if (true) doThis()

Download movies.csv

Misc


classDiagram
    Animal <|-- Duck
    Animal <|-- Fish
    Animal <|-- Zebra
    Animal: +int age
    Animal: +String gender
    Animal: +isMammal()
    Animal: +mate()
    class Duck {
        +String beakColor
        +swim()
        +quack()
    }
    class Fish {
        -int sizeInFeet
        -canEat()
    }
    class Zebra {
        +bool is_wild
        +run()
    }

Math

$$ \begin{equation} x = \frac{-b \pm \sqrt{b^2 - 4ac}}{2a} \end{equation} $$

Security & Certificates

2025-02-11T00:00:00+00:00

OpenSSL & Keytool

Extract Certificate from Server

# Extract the server certificates.
$ echo -n | openssl s_client -showcerts -connect google.com:443 \
          | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > google.pem

# OR use java keytool
$ keytool -printcert -rfc -sslserver google.com:443 > google.pem

# Show full cert chain (CN, SAN and Expiry) of TLS server
$ echo | openssl s_client -showcerts -connect google.com:443 2>/dev/null \
       | while openssl x509 -noout \
       -subject -ext subjectAltName -issuer -dates \
       -fingerprint -sha256 -serial 2>/dev/null; \
       do echo "--------------" ; done

# Show just the cert details of a TLS server
$ echo | openssl s_client -showcerts -connect google.com:443 2>/dev/null \
       | openssl x509 -inform pem -noout -text

# Show full cert chain of PEM
$ cat cert.pem | while openssl x509 -noout \
                      -subject -ext subjectAltName -issuer -dates \
                      -fingerprint -sha256 -serial 2>/dev/null; \
                      do echo "**************" ; done
$ keytool -printcert -file cert.pem \
    | grep -i -e "Owner" -e "Issuer:" -e "Serial number:" -e "SHA256:"

# Extract TLS public keys in Cert pinning format
$ openssl s_client -connect 'dns.google.com:443' 2>&1 < /dev/null \
         | sed -n '/-----BEGIN/,/-----END/p' \
         | openssl x509 -noout -pubkey \
         | openssl asn1parse -noout -inform pem -out /dev/stdout \
         | openssl dgst -sha256 -binary \
         | openssl base64

$ curl -vvI https://google.com 2>&1 | grep -i date

Create PKCS#12 trust-store from pem

# Create/Add trust store
$ keytool -importcert \
          -trustcacerts \
          -alias globalsign-rootca \
          -storetype PKCS12 \
          -keystore globalsign-rootca.p12 \
          -storepass changeit \
          -file globalsign.crt

# Add intermediate certs (Optional)
$ keytool -importcert \
          -keystore globalsign-rootca.p12 \
          -alias CA-intermediate \
          -storepass changeit \
          -file CA-intermediate.cer

# Create PKCS12 truststore using OpenSSL
$ openssl pkcs12 -export \
                 -jdktrust anyExtendedKeyUsage \
                 -nokeys \
                 -in server.pem \
                 -password pass: \
                 -out truststore-openssl.p12
              
# Show PKCS#12 info.
$ openssl pkcs12 -info -password pass:changeit -in globalsign-rootca.p12
$ keytool -list \
          -keystore globalsign-rootca.p12 \
          --storetype pkcs12 \
          -storepass changeit \
          -v

# OpenSSL: Create a new PKCS#12 store from certs
$ openssl pkcs12 -export -chain -out keystore.p12 \
                  -inkey private.key -password pass:test123 \
                  -in client.crt -certfile client.crt \
                  -CAfile cacert.crt -caname root-ca \
                  -name client-key

# Convert a PEM certificate file to PKCS#12 without private key.
$ openssl pkcs12 -export -nokeys -in certificate.pem -out keystore.p12

# Change the keystore password
# Convert PKCS#12 to PEM (don't encrypt private keys)
$ openssl pkcs12 -in keystore.p12 -out keystore.pem -nodes

# Export to PKCS#12 with new password
$ openssl pkcs12 -export -in keystore.pem -nodes -out keystore.p12

# Verify if a Private Key Matches a Certificate
$ openssl x509 -noout -modulus -in cert.pem | openssl md5
$ openssl rsa  -noout -modulus -in cert.key | openssl md5

Extract certs from PKCS#12

# Client Certificate (Remove "-clcerts" to include intermediate/root certs)
$ openssl pkcs12 -in keystore.p12 -nodes -clcerts -nokeys -passin pass:<password>  -out client.crt

# Certificate Key (Remove "-nodes" for encrypted)
$ openssl pkcs12 -in keystore.p12 -nodes -nocerts -passin pass:<password> -out client.key

# Decrypt Key
$ openssl rsa -in client-encrypted.key -passin pass:<password> -out client.key

# CA cert
$ openssl pkcs12 -in keystore.p12 -nodes -nokeys -cacerts -passin pass:<password> -out cacert.crt

# Remove attribtes (Optional)
# openssl pkcs12 -in keystore.p12 -nodes  -nokeys -passin pass:<password> | openssl x509 -out client.crt
# openssl pkcs12 -in keystore.p12 -nodes -nocerts -passin pass:<password> | openssl rsa -out client.key
# openssl pkcs12 -in keystore.p12 -nodes -nokeys -cacerts -passin pass:<password> | openssl x509 -out cacert.crt

# Convert to PKCS8 private key (For java)
$ openssl pkcs8 -topk8 -inform PEM -outform DER -in cert.pem -out out.pem -nocrypt

PEM to single line

$ awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}'  cert.pem > cert.cer
# Revert singleline to multiline
$ echo -ne $(cat cert.cer)
# Check if the reverted format is ok
$ echo -ne $(cat cert.cer) | openssl rsa -check

PEM to JSON

# Convert the PEM text to JSON
$ jq -sR . test.pem > test.txt

Show all certs from System truststore

# Using Openssl (CentOS/Ubuntu)
$ while openssl x509 -noout -subject -issuer -dates; do echo ........... ; done < $(find -L /etc/ssl/certs -regex ".*/ca-\(bundle\|certificates\).crt") 2>/dev/null | grep -i subject

# Using java keytool
$ keytool -printcert -file /etc/ssl/certs/ca-bundle.crt \
   | grep -i -e "Owner" -e "Issuer:" -e "Serial number:" -e "SHA256:"

OpenJDK

List all JDK cacerts using OpenSSL

# Since JDK 18, cacert migrated to Password-Less PKCS12(https://jdk.java.net/18/release-notes#JDK-8275252)
$ openssl pkcs12 \
          -cacerts \
          -chain \
          -nokeys \
          -nomacver \
          -in "$(find -L $JAVA_HOME -name cacerts)" \
          -passin pass: | grep -i "subject="

Show all JDK CA Certs using Keytool

# JDK 17+
$ keytool -list -rfc -cacerts

# Or using cacerts location.
$ JDK_CACERT="$(find -L "${JAVA_HOME:-$(dirname $(readlink -f "$(which java)"))/..}" -name cacerts -print -quit)"

$ keytool -list \
          -rfc \
          -storetype pkcs12 \
          -storepass changeit \
          -keystore "${JDK_CACERT}"

# Older JDKs
$ keytool -list \
      -storetype jks \
      -storepass changeit \
      -keystore "${JDK_CACERT}"

Use Mac System truststore in Java

$ java -Djavax.net.ssl.trustStoreType=KeychainStore \
       -Djavax.net.ssl.trustStore=/Library/Keychains/System.keychain \
       -jar app.jar

Self Signed Certs

Using OpenSSL

$ openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
          -keyout example.key -out example.pem \
          -subj "/C=US/ST=CA/L=SanJose/O=Company Name/OU=Org/CN=www.example.com" \
          -addext "subjectAltName=DNS:example.com,DNS:www.example.net,IP:10.0.0.1"

# For ECC
$ openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -days 3650 \
          -nodes -keyout example.key -out example.pem -subj "/CN=localhost" \
          -addext "subjectAltName=DNS:example.com,DNS:*.example.com,IP:127.0.0.1"

# See certificate details (in text format, no cert output)
$ openssl x509 -in example.pem -text -noout

# Instead of text form, just print subject/issuer/dates
$ openssl x509 -in example.pem -noout -subject -ext subjectAltName -issuer -dates  -fingerprint

# Show SAN entries
$ openssl x509 -text -in example.pem -noout | grep -A1 'Subject Alternative Name'
$ openssl x509 -text -noout -in example.pem -certopt no_subject,no_header,no_version,no_serial,no_signame,no_validity,no_issuer,no_pubkey,no_sigdump,no_aux

# Show public key of a cert
$ openssl x509 -in example.pem -pubkey -noout

# Get public key from a private key
$ openssl pkey -check -in example.key -pubout -outform PEM

# Check if the private key belongs to the cert
$ diff <(openssl x509 -pubkey -in example.pem -noout) <(openssl pkey -check -in example.key -pubout -outform PEM)

# OR create a test TLS server that will verify that a key and certificate match
$ openssl s_server -accept 443 -www -key example.key -cert example.pem

Using OpenJDK Keytool

# Generate self signed cert
$ keytool -genkeypair \
          -keyalg RSA \
          -keysize 4096 \
          -sigalg SHA256withRSA \
          -alias server \
          -storetype JKS \
          -keystore keystore.jks \
          -storepass changeit \
          -keypass changeit \
          -dname "CN=localhost, OU=app, O=app, L=Unspecified, ST=Unspecified, C=US" \
          -ext "SAN=dns:test.server.com,ip:127.0.0.1" \
          -validity 7200

# Migrate from  JKS to PKCS12 
$ keytool -importkeystore \
          -srckeystore keystore.jks \
          -srcstoretype JKS \
          -srcstorepass changeit \
          -destkeystore keystore.p12 \
          -deststoretype PKCS12 \
          -deststorepass changeit
          
# List cert entries
$ keytool -keystore keystore.jks -storepass changeit -list -v

Add CACerts

To JDK Truststore

#!/usr/bin/env bash

certs=("https://pki.service.com/cacert1.crt"
       "https://pki.service.com/cacert2.crt")

JDK_CACERT="$(find -L "${JAVA_HOME:-$(dirname $(readlink -f "$(which java)"))/..}" -name cacerts -print -quit)"
echo "Using JDK CACert: ${JDK_CACERT}"

pushd /tmp >/dev/null || exit 1

for cert in "${certs[@]}"; do
  echo "Downloading $cert ..."
  cert_file="$(basename "$cert")"
  curl -fsSL "$cert" -o "${cert_file}"

  echo "Installing ${cert_file} ..."
  keytool -importcert \
          -noprompt \
          -trustcacerts \
          -file "${cert_file}" \
          -alias "${cert_file}" \
          -keystore "${JDK_CACERT}" \
          -storepass changeit

  rm -f "${cert_file}"
done

popd >/dev/null || exit 1

cURL: Auth/Mutual TLS

# mTLS Authentication using PKCS#12 bundle
$ curl -v \
       --cert-type P12 \
       --cert ~/keystore.p12:xxxxx \
       -X GET "https://my-server:443/api"


# Mutual TLS using PEM files
$ curl -v \
       --cacert ca.pem \
       --key client.key \
       --cert client.pem \
       --resolve "my-server:443:8.8.8.8" \
       -X GET "https://my-server:443/api"

CA Certs and Certificate Transparency Logs

Certificate Search - crt.sh
https://crt.sh/test-websites?trustedBy=Java
LintCert
Cert Lint Library
CT Logs

GPG/OpenPGP

Setup GPG on MacOS - IntelliJ Doc
GPG Key Prepare

GPG commands

# GPU key files
$ ~/.gnupg

# Show all keys
$ gpg --list-keys --keyid-format=[long|short]

# List secrets keys
$ gpg --list-secret-keys --keyid-format=short

# Update all keys from a keyserver
$ gpg --refresh-keys [--keyserver pgp.mit.edu]

$ gpg --recv-key XXXXXX
$ gpg --delete-key  "xxx@gmail.com"

Renew GPG Key

# Note: The private key can never expire

# Get the key id
$ gpg --list-keys --keyid-format SHORT

# Comment out 'no-tty' in ~/.gnupg/gpg.conf
$ gpg --edit-key C8B5XXXX
$ gpg> list
       expire // type 1y
       key 1  // renew encryption subkey
       expire // type 1y
       trust
       save
       quit

# Export for backup
$ gpg -a --export C8B5XXXX > sureshg.gpg.public
$ gpg -a --export-secret-keys C8B5XXXX > sureshg.gpg.private

# Send it to key servers
$ gpg --keyserver keyserver.ubuntu.com --send-keys C8B5XXXX
$ gpg --keyserver pgp.mit.edu --send-keys C8B5XXXX

# Update GPG key in Github
$ cat sureshg.gpg.public| pbcopy
$ https://github.com/settings/gpg/new

Change Secret Password

$ gpg --list-secret-keys --keyid-format=short
$ gpg --edit-key C8B5XXXX
$ gpg>  passwd

Tools

BadSSL
Mastering two way TLS in Java
sslcontext-kickstart
Cert Ripper
Extract TLS Secrets for Wireshark
mkcert - Locally Trusted Self-Signed Certs
Keystore Explorer
https://github.com/scop/portecle
https://github.com/mitmproxy/mitmproxy

TLS Debugging

$ java -Djavax.net.debug=help MyApp
# java -Djavax.net.debug=all MyApp
# java -Djavax.net.debug=ssl,handshake,data,trustmanager MyApp

help           print the help messages
expand         expand debugging information

all            turn on all debugging
ssl            turn on ssl debugging

The following can be used with ssl:
  record       enable per-record tracing
  handshake    print each handshake message
  keygen       print key generation data
  session      print session activity
  defaultctx   print default SSL initialization
  sslctx       print SSLContext tracing
  sessioncache print session cache tracing
  keymanager   print key manager tracing
  trustmanager print trust manager tracing
  pluggability print pluggability tracing

  handshake debugging can be widened with:
  data         hex dump of each handshake message
  verbose      verbose handshake message printing

  record debugging can be widened with:
  plaintext    hex dump of record plaintext
  packet       print raw SSL/TLS packets

Misc

https://www.sslshopper.com/article-most-common-java-keytool-keystore-commands.html
Export Certificates and Private Key from a PKCS#12
https://www.rapidsslonline.com/blog/simple-guide-java-keytool-keystore-commands/

TrustStore

Keystore vs. Truststore
https://www.baeldung.com/java-keystore-truststore-difference

Cryptography

https://www.udacity.com/course/applied-cryptography–cs387
https://www.coursera.org/learn/crypto#syllabus

Tmux

2025-02-11T00:00:00+00:00

Install Tmux

$ brew install tmux
# Tmux-based terminal divider
$ brew install tmux-xpanes

Save Tmux config

$ tmux info
$ tmux show -g | sed 's/^/set-option -g /' > ~/.tmux.conf

## Reload config
$ tmux source ~/.tmux.conf

# Kill Tmux server
$ tmux kill-server

Basic Commands

Prefix: Ctrl-b

Install Tmux Plugin manager

# Install plugins
$ prefix + I
# Uninstall
$ prefix + Alt + u

Save and Restore Sessions
```
$ prefix + Ctrl-s
$ prefix + Ctrl-r
```

Manage Sessions

$ tmux new -s code
$ tmux attach-session -t code
$ tmux kill-session -t code
# Kill current session
$ prefix + :kill-session
# Detach a session
$ prefix + d

Windows and Sessions

# Create a new window
$ prefix + c

# Rename a window
$ prefix + ,

# Kill a window
$ Ctrl + d
$ exit
$ prefix + &

# Switch to the previous window
$ prefix + p
# Switch to the next window
$ prefix + n
# Switch to window 1
$ prefix + 1

$ prefix + w
$ tmux list-windows
$ tmux list-sessions
$ tmux list-clients
$ tmux ls

# Switch session
$ prefix + s
$ prefix + )
$ prefix + (

Window Panes

# Split window vertically
$ prefix + %
# Split window horizontally
$ prefix + '"'
# Pane Navigation
$ prefix + ->,<-,Up,Down
# Exit pane
$ exit or  prefix + x

Show menu
```
$ prefix +  >
```
Mouse Mode

Click Alt/Option to override the mouse protocol and let you select/paste
```
set -g mouse on
```

Normally Tmux commands can be entered three different ways:

By running tmux ... command in a shell inside tmux
By hitting Ctrl-b + : in tmux and then entering command into tmux’s command prompt
By adding a command into to your ~/.tmux.conf file to bind the key at startup

Key Bindings

List Key Bindings
```
$ prefix + ?
$ tmux list-keys
```

Modifier-Keys

Ctrl-Keys

Linux

2024-09-19T00:00:00+00:00

Command Line Tools

Process threads, cpu and memory usage.

# Show process threads and it's CPU usage
$ ps  -p  <pid> \
      -T \
      -o start_time,uname,fname,pid,ppid,%cpu,%mem,tid,tname,thcount,time,size,rss,m_size,vsize,lwp | awk '{print $6}' | sort -rn | less

# OR
$ ps  -p  <pid> \
      -T \
      -o start_time,uname,fname,pid,ppid,%cpu,%mem,tid,tname,thcount,time,size,rss,m_size,vsize,lwp --sort -tid

# Show all processes sorted by RSS
$ ps -eo user,pid,pmem,rss,vsz,comm,start,time,command --sort -rss | numfmt --header --from-unit=1024 --to=iec --field 4-5 | awk '$3 != 0'

# Show process tree
$ pstree -aps

# Show all threads
$ ls /proc/<pid>/task

# Show all threads using top
$ top -H -p <pid>

Sysctl

# /etc/sysctl.conf
fs.file-max=10485760
fs.nr_open=10485760

net.core.somaxconn=16192
net.core.netdev_max_backlog=16192
net.ipv4.tcp_max_syn_backlog=16192

net.ipv4.ip_local_port_range = 1024 65535

net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.rmem_default = 16777216
net.core.wmem_default = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 87380 16777216
net.ipv4.tcp_mem = 1638400 1638400 1638400

net.netfilter.nf_conntrack_buckets = 1966050
net.netfilter.nf_conntrack_max = 7864200

# EC2 Amazon Linux
net.core.netdev_max_backlog = 65536
net.core.optmem_max = 25165824
net.ipv4.tcp_max_tw_buckets = 1440000

# /etc/security/limits.conf (set max open file descriptors)
* soft nofile 8000000
* hard nofile 9000000

Java Virtual Threads - c5m
See 2M websocket connections
See Tuning HA Proxy for 300K connections
See Kernel Tuning params
See How TCP backlog works in Linux
See TCP TIME_WAIT config

 # Can also set it using sysctl commands
 sysctl -w fs.file-max=12000500
 sysctl -w fs.nr_open=20000500
 sysctl -w net.ipv4.tcp_mem='10000000 10000000 10000000'
 sysctl -w net.ipv4.tcp_rmem='1024 4096 16384'
 sysctl -w net.ipv4.tcp_wmem='1024 4096 16384'
 sysctl -w net.core.rmem_max=16384
 sysctl -w net.core.wmem_max=16384
 sysctl -w net.core.somaxconn=1024
 ulimit -n 20000000

Netstat

# Find all TCP/UDP listening port's PID
$ netstat -tunalp

# On Mac
$ netstat -vanp tcp  | grep -i 8080

# Find process used by given port
$ lsof -i :8080

# Socket stats
$ ss -s

XArgs

sudo -S pgrep -f tomcat  | xargs -n 1  -I {}  sh -c 'echo "Killing process pid: {}" &&  sudo kill -9 {} && echo Done.'

Proc FileSystem

Checking the Init system

case "$(cat /proc/1/comm)" in
    init)    echo Init ;;
    systemd) echo SystemD ;;
    upstart) echo Upstart ;;
    *) echo "unknown: '`cat /proc/1/comm`'" ;;
esac

# OR
$ ps --no-headers -o comm 1 | grep -q 'systemd'

Git Config

These are the common useful git aliases

$ git config --global alias.remote-tags '!git ls-remote --tags --sort="-creatordate" origin | grep -v "\^{}"'
$ git config --global alias.remote-tags-short '!git ls-remote --tags --sort="-creatordate" origin | grep -v "\^{}" | cut -f2 | sed "s/refs\/tags\///"'
$ git config --global alias.pull-rebase-push '!git pull origin main --rebase && git push origin main --follow-tags'
$ git config --global alias.tag-version '!git describe --always --tags --match "v*"'

Curl

Get round trip time

$ curl -X GET \
       -o /dev/null  \
       -I -w "Connect: %{time_connect}s, Transfer: %{time_starttransfer}s, Total: %{time_total}s" \
       -X GET http://www.google.com

# Curl Response time using specific DNS server
$  while true ;do curl \
      --dns-servers 8.8.8.8 \
      https://suresh.dev \
      -o /dev/null \
      -s \
      -w 'Total: %{time_total}s\n' \
;done

Download the latest release from Github

# Download the latest release from Github
$ LOCATION=$(curl -s https://api.github.com/repos/jvm-profiling-tools/async-profiler/releases/latest \
    | grep -i "browser_download_url" \
    | grep -i "converter.jar" \
    | awk '{ print $2 }' \
    | sed 's/,$//'       \
    | sed 's/"//g' )     \
    ; curl --progress-bar -L -o ${HOME}/install/tools/converter.jar ${LOCATION}

Download a file with retry

# -fsSLO
$ curl --fail \
      --silent \
      --show-error \
      --location \
      --remote-name \
      --compressed \
      --progress-bar \
      --retry 3 \
      --retry-connrefused \
      --retry-delay 1 \
      --connect-timeout 5 \
      --max-time 10 \
      --request GET \
https://search.maven.org/remotecontent?filepath=org/jetbrains/kotlin/kotlin-stdlib/1.7.0/kotlin-stdlib-1.7.0.jar

DIG

Commands

# Find all nameserver IPs for a TLD
$ for i in $(dig ns suresh.dev +short); do echo -n "$i " && dig $i +short; done

# Trace DNS requests
$ dig +trace compute.suresh.dev

# Trace using specific resolver
$ dig @a.root-servers.net +trace compute.suresh.dev

SSH

Port Forwarding

# Local Port(2345) Forwarding
ssh -v user@ip -L 2345:ip:5432
# ssh -v ooadmin@100.64.0.32 -L 2345:100.64.0.32:5432

# Remote Port Forwarding
ssh -v  -R  :8091:localip:remoteport  user@remoteip
# ssh -v  -R  :8091:172.28.170.95:3000  app@10.242.182.199

Wireshark

Download wirkshark

Install tcpdump on remote host (say 10.9.210.101)

$ ssh user@10.9.210.101 "sudo yum install -y tcpdump"

Start packet capture

$ ssh user@10.9.210.101 "sudo /usr/sbin/tcpdump -s0 -w - 'port 22'" | wireshark -k -i -
# or for 8080
$ ssh user@remote-host "sudo /usr/sbin/tcpdump -s0 -w - 'port 8080'" | wireshark -k -i -

See Wireshark Over SSH
See Using Unix Named Pipe

TCPDump

# HTTP traffic including req & res headers and message body from a particular source.
$ tcpdump -A -s 0 'src example.com and tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

# All incoming HTTP GET traffic
$ tcpdump -i any -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'

# All incoming HTTP POST traffic to port 80
$ tcpdump -i any -s 0 -A 'tcp dst port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504F5354'

# HTTP GET/POST  Incoming calls to port 80/443 Originating from 192.168.10.1 Host.
$ tcpdump -i any -s 0 -A 'tcp dst port 80 or tcp dst port 443 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420 or tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504F5354' and host 192.168.10.1

# Filter HTTP User agents
$ tcpdump -vvAls0 | grep 'User-Agent:'

# Write to pcap file
$ tcpdump -i any -s 0 -X -w /tmp/tcpdump.pcap

# Capture TCP packets from local interface
$ tcpdump -i lo

# Print packet in ASCII
$ tcpdump -v -i lo -A

https://danielmiessler.com/study/tcpdump/

Readings

2024-09-19T00:00:00+00:00

Java

https://openjdk.org/jeps/425
https://openjdk.org/jeps/428 (Structured Concurrency)
https://openjdk.org/jeps/429 (Extent-Local Variables)
https://openjdk.org/jeps/411 (Deprecate the Security Manager for Removal)
https://www.reddit.com/r/java/comments/v394uh/loom_and_thread_fairness/
https://isopov.github.io/posts/loom-cooperative-downside/
https://jbaker.io/2022/05/09/project-loom-for-distributed-systems/
https://www.reddit.com/r/java/comments/v7v3v5/conways_game_of_life_implemented_with/
https://github.com/ebarlas/game-of-life-csp
https://github.com/ebarlas/project-loom-comparison
https://github.com/ebarlas/project-loom-c5m
https://inside.java/2021/11/30/on-parallelism-and-concurrency/
https://inside.java/2021/09/10/what-are-modules-about/
https://inside.java/2021/04/23/security-and-sandboxing-post-securitymanager/
https://inside.java/2020/08/07/loom-performance/
https://inside.java/2020/07/15/loomqa/
https://cr.openjdk.java.net/~rpressler/loom/loom/sol1_part1.html
https://inside.java/2021/10/26/why-user-mode-thread-video/
https://stackoverflow.com/questions/71945866/project-loom-why-are-virtual-threads-not-the-default
https://foojay.io/today/thinking-about-massive-throughput-meet-virtual-threads/
https://github.com/cmpxchg16/kotlin-loom#linux-kernel-configuration

Happy eyeballs

https://mail.openjdk.java.net/pipermail/loom-dev/2022-May/004613.html
https://mail.openjdk.java.net/pipermail/loom-dev/2022-May/004615.html
https://publicobject.com/2022/03/14/uncertainty-in-tests/

Database

VladMihalcea - DB Job Queue using SKIP LOCKED
VladMihalcea - Best UUID type for PrimaryKey
VladMihalcea - hypersistence-tsid
Maciej Walkowiak - PostgreSQL and UUID as primary key
UUID7 in 33 langs
GunnarMorling - Last Updated Columns With Postgres
Most work queue implementations in SQL are wrong
Choosing Primary Key Type in Postgres
Correctly using Postgres as queue
JOOQ - JDBC Drivers Maven Coordinates
JOOQ - JDBC Connection URLs
JOOQ - Simulating Latency with SQL / JDBC
VladMihalcea - Optimistic vs. Pessimistic Locking
Sakila DB
Chinook PostgreSql
Audit Table Schema
https://github.com/coditory/sherlock-distributed-lock
https://github.com/kagkarlsson/db-scheduler