jib build: Containerize JVM Apps Without a Dockerfile

By Kaveh Alemi·Latchkey

Jib builds an optimized container image for a Java application straight from Maven or Gradle, with no Dockerfile and no Docker daemon.

Jib is a Maven/Gradle plugin (with a standalone CLI) that containerizes JVM apps by splitting dependencies, resources, and classes into separate layers, then pushing directly to a registry.

What it does

Jib builds a container image from your Java build without a Dockerfile. The jib:build (Maven) or jib (Gradle) goal pushes directly to a registry; jib:dockerBuild loads into a local daemon instead. Layers are ordered so dependency layers cache across builds.

Common usage

Terminal

# Maven: build and push directly to a registry
mvn compile jib:build \
  -Djib.to.image=ghcr.io/acme/app:1.4.0

# Gradle: build and push
./gradlew jib --image=ghcr.io/acme/app:1.4.0

# build to the local Docker daemon instead of pushing
mvn compile jib:dockerBuild -Djib.to.image=app:local

Options

Parameter	What it does
jib.to.image / --image	Target image reference to build
jib.from.image	Base image (default is a distroless JRE)
jib.to.auth.username/password	Registry credentials for the target
jib.container.ports	Ports to expose in the image config
jib.container.jvmFlags	JVM flags baked into the entrypoint
-Djib.allowInsecureRegistries	Permit HTTP / self-signed registries

In CI

jib:build needs no daemon, so JVM images build in plain CI containers. Supply registry credentials through jib.to.auth.*, environment variables, or the docker config Jib reads by default. The layered output means dependency layers are reused, keeping incremental CI builds fast.

Common errors in CI

"Unauthorized for ghcr.io/acme/app: 401 Unauthorized" means the target credentials are missing or wrong. "Tried to connect to ... over HTTPS but ... " on an internal registry needs -Djib.allowInsecureRegistries=true. "Missing target image parameter" means set jib.to.image. On Java version mismatches, set jib.from.image to a JRE matching your bytecode target.

Frequently asked questions

jib build: Containerize JVM Apps Without a Dockerfile?

Jib is a Maven/Gradle plugin (with a standalone CLI) that containerizes JVM apps by splitting dependencies, resources, and classes into separate layers, then pushing directly to a registry.

What it does?

Jib builds a container image from your Java build without a Dockerfile. The jib:build (Maven) or jib (Gradle) goal pushes directly to a registry; jib:dockerBuild loads into a local daemon instead. Layers are ordered so dependency layers cache across builds.

In CI?

jib:build needs no daemon, so JVM images build in plain CI containers. Supply registry credentials through jib.to.auth.*, environment variables, or the docker config Jib reads by default. The layered output means dependency layers are reused, keeping incremental CI builds fast.

Common errors in CI?

"Unauthorized for ghcr.io/acme/app: 401 Unauthorized" means the target credentials are missing or wrong. "Tried to connect to ... over HTTPS but ... " on an internal registry needs -Djib.allowInsecureRegistries=true. "Missing target image parameter" means set jib.to.image.