DEV Community

Artem Ptushkin
Artem Ptushkin

Posted on • Updated on

How to configure DNS caching timeout in a Spring Boot docker image?

JVM build used for this article eclipse-temurin:21-jdk:

openjdk 21.0.2 2024-01-16 LTS
OpenJDK Runtime Environment Temurin-21.0.2+13 (build 21.0.2+13-LTS)
OpenJDK 64-Bit Server VM Temurin-21.0.2+13 (build 21.0.2+13-LTS, mixed mode, sharing)
Enter fullscreen mode Exit fullscreen mode

We must differentiate JVM Security properties and System properties.

  • Security properties:
    • can not be affected directly by the command line
    • accessed with class
    • can be modified through the file
  • System properties
    • can be affected directly by the command line
    • accessed with class java.lang.System

Important to know:

  • Default value of the property is 30 (seconds) and can be found in

  • This class reads the property once during the class initialization in the static method - this is important for further conclusions

  • How to debug: open line ~1141 cachePolicy = InetAddressCachePolicy.get(); and call the code InetAddressCachePolicy.get() through the debug execution

Initial options to set the value:

  • Security property networkaddress.cache.ttl (through the file)
  • System property (through JVM command line)

Technical in JVM it's possible to set a value in runtime (e.g. System.setProperty or Security.setProperty but this is misleading here's why:

You don't know when a property will be accessed by any code. You must either determine that you set it before other code accesses it or there is a risk that it will be not applied.

Therefore, to mediate the risk and the checks we should set the value as JVM startup parameters (not runtime).

Let's consider 3 typical build setups:

  • fat jar
  • Spring Boot docker build
  • Goole jib

Fat jar

There are plenty of options on how to set a JVM property, one example

Security properties with Gradle example

Enter fullscreen mode Exit fullscreen mode

Security properties with Googe Jib plugin

# build.gradle.kts
jib {
    extraDirectories {
        paths {
            path {
                into = "/etc/"
    container {
        jvmFlags = listOf("")
    from {
        image = "eclipse-temurin:21-jre"
Enter fullscreen mode Exit fullscreen mode

You can reproduce the same code with other build tools and with the Dockerfile too.

Event this is not enough

Spring uses Apache HTTP client underneath and by default connection TTL there is infinite. You can change it to (see):

    fun poolingHttpClientConnectionManager(): PoolingHttpClientConnectionManager =
            .apply {


// which you set to 

Enter fullscreen mode Exit fullscreen mode


Top comments (0)