# jib build: Containerize JVM Apps Without a Dockerfile

> Jib builds container images for Java apps from Maven or Gradle without a Dockerfile or daemon. Reference for jib:build, the image target, credentials, and CI errors.

Source: https://latchkey.dev/learn/command-reference/jib-build-jvm  
Updated: 2026-06-30

Jib builds an optimized container image for a Java application straight from Maven or Gradle, with no Dockerfile and no Docker daemon.

Jib is a Maven/Gradle plugin (with a standalone CLI) that containerizes JVM apps by splitting dependencies, resources, and classes into separate layers, then pushing directly to a registry.

## What it does

Jib builds a container image from your Java build without a Dockerfile. The `jib:build` (Maven) or `jib` (Gradle) goal pushes directly to a registry; `jib:dockerBuild` loads into a local daemon instead. Layers are ordered so dependency layers cache across builds.

## Common usage

```Terminal
# Maven: build and push directly to a registry
mvn compile jib:build \
  -Djib.to.image=ghcr.io/acme/app:1.4.0

# Gradle: build and push
./gradlew jib --image=ghcr.io/acme/app:1.4.0

# build to the local Docker daemon instead of pushing
mvn compile jib:dockerBuild -Djib.to.image=app:local
```

## Options

| Parameter | What it does |
| --- | --- |
| jib.to.image / --image | Target image reference to build |
| jib.from.image | Base image (default is a distroless JRE) |
| jib.to.auth.username/password | Registry credentials for the target |
| jib.container.ports | Ports to expose in the image config |
| jib.container.jvmFlags | JVM flags baked into the entrypoint |
| -Djib.allowInsecureRegistries | Permit HTTP / self-signed registries |

## In CI

jib:build needs no daemon, so JVM images build in plain CI containers. Supply registry credentials through `jib.to.auth.*`, environment variables, or the docker config Jib reads by default. The layered output means dependency layers are reused, keeping incremental CI builds fast.

## Common errors in CI

"Unauthorized for ghcr.io/acme/app: 401 Unauthorized" means the target credentials are missing or wrong. "Tried to connect to ... over HTTPS but ... " on an internal registry needs `-Djib.allowInsecureRegistries=true`. "Missing target image parameter" means set `jib.to.image`. On Java version mismatches, set `jib.from.image` to a JRE matching your bytecode target.

## FAQ

### jib build: Containerize JVM Apps Without a Dockerfile?

Jib is a Maven/Gradle plugin (with a standalone CLI) that containerizes JVM apps by splitting dependencies, resources, and classes into separate layers, then pushing directly to a registry.

### What it does?

Jib builds a container image from your Java build without a Dockerfile. The jib:build (Maven) or jib (Gradle) goal pushes directly to a registry; jib:dockerBuild loads into a local daemon instead. Layers are ordered so dependency layers cache across builds.

### In CI?

jib:build needs no daemon, so JVM images build in plain CI containers. Supply registry credentials through jib.to.auth.*, environment variables, or the docker config Jib reads by default. The layered output means dependency layers are reused, keeping incremental CI builds fast.

### Common errors in CI?

"Unauthorized for ghcr.io/acme/app: 401 Unauthorized" means the target credentials are missing or wrong. "Tried to connect to ... over HTTPS but ... " on an internal registry needs -Djib.allowInsecureRegistries=true. "Missing target image parameter" means set jib.to.image.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt