Keycloak Dev service does not start with OIDC client with 3.20 and 3.21

[jelmew]

Describe the bug

When creating a plain project and adding the quarkus-oidc-client extension, the launch of a keycloak dev service fails. See the reproducer https://github.com/jelmew/quarkus_dev_service_broken

Expected behavior

It is expected that the test starts a container, prints hello world and shutdowns again.

Actual behavior

Test times out waiting for

Caused by: org.testcontainers.containers.ContainerLaunchException: Timed out waiting for log output matching '.*Keycloak.*started.*'
        at org.testcontainers.containers.wait.strategy.LogMessageWaitStrategy.waitUntilReady(LogMessageWaitStrategy.java:47)
        at org.testcontainers.containers.wait.strategy.AbstractWaitStrategy.waitUntilReady(AbstractWaitStrategy.java:52)
        at org.testcontainers.containers.GenericContainer.waitUntilContainerStarted(GenericContainer.java:909)
        at org.testcontainers.containers.GenericContainer.tryStart(GenericContainer.java:492)
        ... 18 more

How to Reproduce?

https://github.com/jelmew/quarkus_dev_service_broken

If debug logging is enabled, you see that the container never prints this log line at all.

Output of uname -a or ver

Linux pop-os 6.12.10-76061203-generic #202412060638174310936622.04~1fce33b SMP PREEMPT_DYNAMIC Thu M x86_64 x86_64 x86_64 GNU/Linux

Output of java -version

openjdk version "23.0.2" 2025-01-21 OpenJDK Runtime Environment Temurin-23.0.2+7 (build 23.0.2+7) OpenJDK 64-Bit Server VM Temurin-23.0.2+7 (build 23.0.2+7, mixed mode, sharing)

Quarkus version or git rev

3.20

Build tool (ie. output of mvnw --version or gradlew --version)

Apache Maven 3.9.9 (8e8579a9e76f7d015ee5ec7bfcdc97d260186937)

Additional information

No response

[quarkus-bot]

/cc @pedroigor (keycloak), @sberyozkin (keycloak)

[sberyozkin]

@jelmew I've updated the description, thanks for creating the reproducer, but I can't reproduce it, it starts without problems in test and dev modes.

Not sure if it is related, but I'm on Java 21

[jelmew]

Hi,

I tried java 21, but it doesn't make a difference. I've run it with debug logging, and you can see the container crash.
Other containers like artemis/kafka do work. I've attached the entire log.

debug_mvn_clean_test.txt

2025-04-01 14:41:24,491 DEBUG [com.git.doc.zer.sha.org.apa.hc.cli.htt.wire] (docker-java-stream-1638607549) http-outgoing-1 << "[0x2][0x0][0x0][0x0][0x0][0x0][0x4][0xfffffff9]/opt/keycloak/bin/kc.sh: line 169: 86 Killed 'java' -Dkc.config.build-and-exit=true -Djava.util.concurrent.ForkJoinPool.common.threadFactory=io.quarkus.bootstrap.forkjoin.QuarkusForkJoinWorkerThreadFactory '-XX:MetaspaceSize=96M' '-XX:MaxMetaspaceSize=256m' '-Dfile.encoding=UTF-8' '-Dsun.stdout.encoding=UTF-8' '-Dsun.err.encoding=UTF-8' '-Dstdout.encoding=UTF-8' '-Dstderr.encoding=UTF-8' '-XX:+ExitOnOutOfMemoryError' '-Djava.security.egd=file:/dev/urandom' '-XX:+UseG1GC' '-XX:FlightRecorderOptions=stackdepth=512' '-XX:MaxRAMPercentage=70' '-XX:MinRAMPercentage=70' '-XX:InitialRAMPercentage=50' '--add-opens=java.base/java.util=ALL-UNNAMED' '--add-opens=java.base/java.util.concurrent=ALL-UNNAMED' '--add-opens=java.base/java.security=ALL-UNNAMED' '-Duser.language=en' '-Duser.country=US' -Dkc.home.dir='/opt/keycloak/bin/..' -Djboss.server.config.dir='/opt/keycloak/bin/../conf' -Djava.util.logging.manager=org.jboss.logmanager.LogManager -Dpicocli.disable.closures=true -Dquarkus-log-max-startup-records=10000 -cp '/opt/keycloak/bin/../lib/quarkus-run.jar' io.quarkus.bootstrap.runner.QuarkusEntryPoint 'start' '--http-enabled=true' '--hostname-strict=false' '--spi-user-profile-declarative-user-profile-config-file=/opt/keycloak/upconfig.json'[\n]"
2025-04-01 14:41:24,491 DEBUG [com.git.doc.zer.sha.org.apa.hc.cli.htt.wire] (docker-java-stream-1638607549) http-outgoing-1 << "[\r][\n]"
2025-04-01 14:41:24,491 DEBUG [org.tes.con.out.WaitingConsumer] (build-30) STDERR: /opt/keycloak/bin/kc.sh: line 169: 86 Killed 'java' -Dkc.config.build-and-exit=true -Djava.util.concurrent.ForkJoinPool.common.threadFactory=io.quarkus.bootstrap.forkjoin.QuarkusForkJoinWorkerThreadFactory '-XX:MetaspaceSize=96M' '-XX:MaxMetaspaceSize=256m' '-Dfile.encoding=UTF-8' '-Dsun.stdout.encoding=UTF-8' '-Dsun.err.encoding=UTF-8' '-Dstdout.encoding=UTF-8' '-Dstderr.encoding=UTF-8' '-XX:+ExitOnOutOfMemoryError' '-Djava.security.egd=file:/dev/urandom' '-XX:+UseG1GC' '-XX:FlightRecorderOptions=stackdepth=512' '-XX:MaxRAMPercentage=70' '-XX:MinRAMPercentage=70' '-XX:InitialRAMPercentage=50' '--add-opens=java.base/java.util=ALL-UNNAMED' '--add-opens=java.base/java.util.concurrent=ALL-UNNAMED' '--add-opens=java.base/java.security=ALL-UNNAMED' '-Duser.language=en' '-Duser.country=US' -Dkc.home.dir='/opt/keycloak/bin/..' -Djboss.server.config.dir='/opt/keycloak/bin/../conf' -Djava.util.logging.manager=org.jboss.logmanager.LogManager -Dpicocli.disable.closures=true -Dquarkus-log-max-startup-records=10000 -cp '/opt/keycloak/bin/../lib/quarkus-run.jar' io.quarkus.bootstrap.runner.QuarkusEntryPoint 'start' '--http-enabled=true' '--hostname-strict=false' '--spi-user-profile-declarative-user-profile-config-file=/opt/keycloak/upconfig.json'

[sberyozkin]

Thanks @jelmew, Looks like it is a Keycloak container issue, can you check #46457 please ? Keycloak container may require more memory, I probably should update OIDC devservice docs with a dedicated section

[jelmew]

That fixes it. If the default memor limit is to small, shouldn't we change the default? It doesn't make much sense if it crashes OOTB?

[sberyozkin]

@jelmew Can you please give me a favor and find the minimum memory limit which works in your case ?

[sberyozkin]

@InfoSec812 Hi, can you also please check, when you get a chance, what is the minimum memory that the container requires in your case ?

May be we can indeed increase the default value, unless it would raise the limit dramatically, in that case I'd rather doc it as an important note

[InfoSec812]

@sberyozkin I got it to run using 1.2GB of memory... That said, I am loading a realm.json file which probably increased the memory requirements.

[sberyozkin]

Thanks @InfoSec812 for having a look, loading a custom realm file is probably the typical case once users can get it working with a simple default realm. I guess 1.2GB is not significantly different from the default 750M.
@jelmew, does it work with 1.2GB for you ?

[jelmew]

Hi,
For an empty container, 900M seems to be barely enough.