docker scan classpath not working
See original GitHub issueHi,
following code for scan all classes in a package recursively works fine but when I dockerized my application, that doesn’t work no more.
ClassPath classpath = ClassPath.from(Thread.currentThread().getContextClassLoader()); for (ClassPath.ClassInfo classInfo : classpath.getTopLevelClassesRecursive(packageName)) { }
I constated by investigating the code that results of url packages are
jar:file:/frame-socket-connector.jar!/BOOT-INF/lib/log4j-core-2.7.jar!/
in docker instead of
/home/christof/.gradle/caches/modules-2/files-2.1/org.apache.logging.log4j/log4j-core/2.7/a3f2b4e64c61a7fc1ed8f1e5ba371933404ed98a/log4j-core-2.7.jar
when I launch my application directly with gradleBootRun.
any idea?
Issue Analytics
- State:
- Created 6 years ago
- Comments:5 (2 by maintainers)
Top Results From Across the Web
Docker scan not finding .jar files in image
Hi, I am running an agent scan on a containerized image of our java web product that is running on an older base...
Read more >Vulnerability scanning for Docker local images
Vulnerability scanning for Docker local images allows developers and development teams to review the security state of the container images and take actions...
Read more >Docker for Java developers: 5 things you need to know not to ...
Scan your Java application You have to make sure that your Java application is free from security vulnerabilities, making Docker for Java ...
Read more >How to fix Java 11 docker image security issues - Stack Overflow
I've been receiving security issues from Snyk's container scanning on my java 11 app. There are recommendations to update the packages ...
Read more >Don't build fat jars for Docker applications - Medium
Running a fat jar as a java application is fairly simple: ... This will not work: ... will be executed by Docker using...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
I am also facing this issue, and I think this is because the final packaging you’re having inside the Docker container; in my case it’s a Spring Boot application, but anyway we’re both having a fat jar as a result. As you already noticed, in the fat jar deployment the classes are coming from jars who, in turn, are put in the main jar: you can notice this from the
jar:file:
prefix. Unfortunately this is not supported byClassPath
, according to the Javadoc:You can also check the actual code here. Unfortunately I still couldn’t find a solution with Guava. If someone has some other alternatives, please let me know!
I am currently facing the same issue. Any progress in this?