From 11883812b3b9f5092d891db561e24fe8145f1b59 Mon Sep 17 00:00:00 2001
From: Lai Jiang <jianglai@google.com>
Date: Wed, 6 Mar 2024 10:10:11 -0500
Subject: [PATCH] Update runtime to Java 21 (#2353)

This PR makes the runtime of most of our workload Java 21.

1. App Engine. Java 21 is in GA and it supports Java EE 8. I had to add
   an environmental variable so that we don't get an
   AppEngineCredentails by default (we have been using
   ComputeEngineCredentials for a couple of years). The uprade to Java
   21 runtime changed a system property that controls how jetty logging
   works, which also control if AppEngineCredential is return. Tested by
   deploying to alpha.
2. Proxy base image upgradedd to Java 21 (distroless still doesn't
   support Java 21 and it looks like Temurin is the way to go
   b/306728455). Tested by deploying to alpha.
3. Nomulus tool image upgrade to Temurin 21 as well. Tested locally.
4. Beam pipeline base image upgrade to Java 21. The JAVA21 flag is not
   supported by gcloud yet, but specifying the image URL directly works
   (and is supported). Tested by running in alpha.
5. Jetty base image upgraded to Java 21. Tested locally.
---
 build.gradle                                              | 8 ++++++--
 core/Dockerfile                                           | 4 ++--
 core/build.gradle                                         | 2 +-
 .../registry/env/alpha/backend/WEB-INF/appengine-web.xml  | 7 ++++++-
 .../registry/env/alpha/bsa/WEB-INF/appengine-web.xml      | 6 +++++-
 .../registry/env/alpha/default/WEB-INF/appengine-web.xml  | 7 ++++++-
 .../registry/env/alpha/pubapi/WEB-INF/appengine-web.xml   | 7 ++++++-
 .../registry/env/alpha/tools/WEB-INF/appengine-web.xml    | 7 ++++++-
 .../registry/env/crash/backend/WEB-INF/appengine-web.xml  | 7 ++++++-
 .../registry/env/crash/bsa/WEB-INF/appengine-web.xml      | 7 ++++++-
 .../registry/env/crash/default/WEB-INF/appengine-web.xml  | 7 ++++++-
 .../registry/env/crash/pubapi/WEB-INF/appengine-web.xml   | 7 ++++++-
 .../registry/env/crash/tools/WEB-INF/appengine-web.xml    | 7 ++++++-
 .../registry/env/local/backend/WEB-INF/appengine-web.xml  | 7 ++++++-
 .../registry/env/local/bsa/WEB-INF/appengine-web.xml      | 7 ++++++-
 .../registry/env/local/default/WEB-INF/appengine-web.xml  | 7 ++++++-
 .../registry/env/local/pubapi/WEB-INF/appengine-web.xml   | 7 ++++++-
 .../registry/env/local/tools/WEB-INF/appengine-web.xml    | 7 ++++++-
 .../env/production/backend/WEB-INF/appengine-web.xml      | 7 ++++++-
 .../registry/env/production/bsa/WEB-INF/appengine-web.xml | 7 ++++++-
 .../env/production/default/WEB-INF/appengine-web.xml      | 7 ++++++-
 .../env/production/pubapi/WEB-INF/appengine-web.xml       | 7 ++++++-
 .../env/production/tools/WEB-INF/appengine-web.xml        | 7 ++++++-
 .../registry/env/qa/backend/WEB-INF/appengine-web.xml     | 7 ++++++-
 .../google/registry/env/qa/bsa/WEB-INF/appengine-web.xml  | 7 ++++++-
 .../registry/env/qa/default/WEB-INF/appengine-web.xml     | 7 ++++++-
 .../registry/env/qa/pubapi/WEB-INF/appengine-web.xml      | 7 ++++++-
 .../registry/env/qa/tools/WEB-INF/appengine-web.xml       | 7 ++++++-
 .../env/sandbox/backend/WEB-INF/appengine-web.xml         | 7 ++++++-
 .../registry/env/sandbox/bsa/WEB-INF/appengine-web.xml    | 7 ++++++-
 .../env/sandbox/default/WEB-INF/appengine-web.xml         | 7 ++++++-
 .../registry/env/sandbox/pubapi/WEB-INF/appengine-web.xml | 7 ++++++-
 .../registry/env/sandbox/tools/WEB-INF/appengine-web.xml  | 7 ++++++-
 jetty/Dockerfile                                          | 2 +-
 proxy/Dockerfile                                          | 2 +-
 release/stage_beam_pipeline.sh                            | 2 +-
 36 files changed, 191 insertions(+), 38 deletions(-)

diff --git a/build.gradle b/build.gradle
index b18d50ce9..1bdf4dea7 100644
--- a/build.gradle
+++ b/build.gradle
@@ -422,11 +422,15 @@ subprojects {
   }
 }
 
-// Force SDK download to be sequential, otherwise parallel tasks will try to
-// write to the same location to upgrade gcloud and fail.
+// Force SDK download and deployment to be sequential, otherwise parallel tasks
+// will fail. For SDK download, they will try to write to the same location to
+// upgrade gcloud. For deployment, they will try to deploy different services to
+// the same project at the same time.
 for (int i = 1; i < services.size(); i++) {
   project("${services[i]}").downloadCloudSdk
           .dependsOn(project("${services[i - 1]}").downloadCloudSdk)
+  project("${services[i]}").appengineDeployAll
+          .dependsOn(project("${services[i - 1]}").appengineDeployAll)
 }
 
 // If "-P verboseTestOutput=true" is passed in, configure all subprojects to dump all of their
diff --git a/core/Dockerfile b/core/Dockerfile
index 8557311f6..94d04ba53 100644
--- a/core/Dockerfile
+++ b/core/Dockerfile
@@ -1,3 +1,3 @@
-FROM gcr.io/distroless/java17-debian11:debug
+FROM eclipse-temurin:21
 ADD build/libs/nomulus.jar /nomulus.jar
-ENTRYPOINT ["/usr/bin/java", "-jar", "/nomulus.jar"]
+ENTRYPOINT ["java", "-jar", "/nomulus.jar"]
diff --git a/core/build.gradle b/core/build.gradle
index 8f39adfab..7ed680973 100644
--- a/core/build.gradle
+++ b/core/build.gradle
@@ -762,7 +762,7 @@ if (environment == 'alpha') {
             gs://${gcpProject}-deploy/live/beam/${metaDataBaseName} \
             --image-gcr-path ${imageName}:live \
             --sdk-language JAVA \
-            --flex-template-base-image JAVA17 \
+            --flex-template-base-image gcr.io/dataflow-templates-base/java21-template-launcher-base:latest \
             --metadata-file ${projectDir}/src/main/resources/${metaData} \
             --jar ${uberJarName} \
             --env FLEX_TEMPLATE_JAVA_MAIN_CLASS=${mainClass} \
diff --git a/core/src/main/java/google/registry/env/alpha/backend/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/alpha/backend/WEB-INF/appengine-web.xml
index 260b79ab5..136328e73 100644
--- a/core/src/main/java/google/registry/env/alpha/backend/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/alpha/backend/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>backend</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="alpha"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
   </static-files>
diff --git a/core/src/main/java/google/registry/env/alpha/bsa/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/alpha/bsa/WEB-INF/appengine-web.xml
index 816b688fb..a1ac65425 100644
--- a/core/src/main/java/google/registry/env/alpha/bsa/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/alpha/bsa/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>bsa</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,16 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="alpha"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
 
   <!-- Enable external traffic to go through VPC, required for static ip -->
   <vpc-access-connector>
diff --git a/core/src/main/java/google/registry/env/alpha/default/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/alpha/default/WEB-INF/appengine-web.xml
index f486516f8..3271ac5d8 100644
--- a/core/src/main/java/google/registry/env/alpha/default/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/alpha/default/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>default</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="alpha"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
     <include path="/assets/js/**" expiration="1m"/>
diff --git a/core/src/main/java/google/registry/env/alpha/pubapi/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/alpha/pubapi/WEB-INF/appengine-web.xml
index 02c92c317..ed777bebf 100644
--- a/core/src/main/java/google/registry/env/alpha/pubapi/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/alpha/pubapi/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>pubapi</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="alpha"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
     <include path="/assets/js/**" expiration="1m"/>
diff --git a/core/src/main/java/google/registry/env/alpha/tools/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/alpha/tools/WEB-INF/appengine-web.xml
index 339ef1b58..139998b27 100644
--- a/core/src/main/java/google/registry/env/alpha/tools/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/alpha/tools/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>tools</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="alpha"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
     <include path="/assets/js/**" expiration="1m"/>
diff --git a/core/src/main/java/google/registry/env/crash/backend/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/crash/backend/WEB-INF/appengine-web.xml
index 66a7c22fa..a57ac284e 100644
--- a/core/src/main/java/google/registry/env/crash/backend/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/crash/backend/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>backend</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="crash"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
   </static-files>
diff --git a/core/src/main/java/google/registry/env/crash/bsa/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/crash/bsa/WEB-INF/appengine-web.xml
index 866b0392f..007cd564a 100644
--- a/core/src/main/java/google/registry/env/crash/bsa/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/crash/bsa/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>bsa</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="crash"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <!-- Enable external traffic to go through VPC, required for static ip -->
   <vpc-access-connector>
     <name>projects/domain-registry-crash/locations/us-central1/connectors/appengine-connector</name>
diff --git a/core/src/main/java/google/registry/env/crash/default/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/crash/default/WEB-INF/appengine-web.xml
index 599553a84..2c7b32e1e 100644
--- a/core/src/main/java/google/registry/env/crash/default/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/crash/default/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>default</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="crash"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
     <include path="/assets/js/**" expiration="1m"/>
diff --git a/core/src/main/java/google/registry/env/crash/pubapi/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/crash/pubapi/WEB-INF/appengine-web.xml
index 3beafc6e3..7f54c564f 100644
--- a/core/src/main/java/google/registry/env/crash/pubapi/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/crash/pubapi/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>pubapi</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="crash"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
     <include path="/assets/js/**" expiration="1m"/>
diff --git a/core/src/main/java/google/registry/env/crash/tools/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/crash/tools/WEB-INF/appengine-web.xml
index 6020f0c7b..f711aecd7 100644
--- a/core/src/main/java/google/registry/env/crash/tools/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/crash/tools/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>tools</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="crash"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
     <include path="/assets/js/**" expiration="1m"/>
diff --git a/core/src/main/java/google/registry/env/local/backend/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/local/backend/WEB-INF/appengine-web.xml
index 3ca4328c2..77b6e6d80 100644
--- a/core/src/main/java/google/registry/env/local/backend/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/local/backend/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>backend</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,6 +12,7 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
@@ -20,6 +21,10 @@
               value="/tmp/domain-registry-appengine-generated/local/"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html">
       <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
diff --git a/core/src/main/java/google/registry/env/local/bsa/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/local/bsa/WEB-INF/appengine-web.xml
index 9945fe536..a6dadaece 100644
--- a/core/src/main/java/google/registry/env/local/bsa/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/local/bsa/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>bsa</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,6 +12,7 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
@@ -20,6 +21,10 @@
               value="/tmp/domain-registry-appengine-generated/local/"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html">
       <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
diff --git a/core/src/main/java/google/registry/env/local/default/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/local/default/WEB-INF/appengine-web.xml
index 6f483b1ff..6f71d5ab1 100644
--- a/core/src/main/java/google/registry/env/local/default/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/local/default/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>default</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,6 +12,7 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
@@ -20,6 +21,10 @@
               value="/tmp/domain-registry-appengine-generated/local/"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html">
       <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
diff --git a/core/src/main/java/google/registry/env/local/pubapi/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/local/pubapi/WEB-INF/appengine-web.xml
index c3a4a43a0..2147b90ba 100644
--- a/core/src/main/java/google/registry/env/local/pubapi/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/local/pubapi/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>pubapi</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,6 +12,7 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
@@ -20,6 +21,10 @@
               value="/tmp/domain-registry-appengine-generated/local/"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html">
       <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
diff --git a/core/src/main/java/google/registry/env/local/tools/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/local/tools/WEB-INF/appengine-web.xml
index 0f5bd2898..9924414b0 100644
--- a/core/src/main/java/google/registry/env/local/tools/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/local/tools/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>tools</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,6 +12,7 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
@@ -20,6 +21,10 @@
               value="/tmp/domain-registry-appengine-generated/local/"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html">
       <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
diff --git a/core/src/main/java/google/registry/env/production/backend/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/production/backend/WEB-INF/appengine-web.xml
index e59cb166e..a46bfc86a 100644
--- a/core/src/main/java/google/registry/env/production/backend/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/production/backend/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>backend</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="production"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
   </static-files>
diff --git a/core/src/main/java/google/registry/env/production/bsa/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/production/bsa/WEB-INF/appengine-web.xml
index c9b57fd1c..e10a9c3ed 100644
--- a/core/src/main/java/google/registry/env/production/bsa/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/production/bsa/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>bsa</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="production"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <!-- Enable external traffic to go through VPC, required for static ip -->
   <vpc-access-connector>
     <name>projects/domain-registry/locations/us-central1/connectors/appengine-connector</name>
diff --git a/core/src/main/java/google/registry/env/production/default/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/production/default/WEB-INF/appengine-web.xml
index 44b867b5e..ec0b8396f 100644
--- a/core/src/main/java/google/registry/env/production/default/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/production/default/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>default</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -11,12 +11,17 @@
   </manual-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="production"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
     <include path="/assets/js/**" expiration="1d"/>
diff --git a/core/src/main/java/google/registry/env/production/pubapi/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/production/pubapi/WEB-INF/appengine-web.xml
index 22922a18f..146e662c7 100644
--- a/core/src/main/java/google/registry/env/production/pubapi/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/production/pubapi/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>pubapi</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -11,12 +11,17 @@
   </manual-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="production"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
     <include path="/assets/js/**" expiration="1d"/>
diff --git a/core/src/main/java/google/registry/env/production/tools/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/production/tools/WEB-INF/appengine-web.xml
index bdacaa04c..6b2d4ddf9 100644
--- a/core/src/main/java/google/registry/env/production/tools/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/production/tools/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>tools</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="production"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
     <include path="/assets/js/**" expiration="1d"/>
diff --git a/core/src/main/java/google/registry/env/qa/backend/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/qa/backend/WEB-INF/appengine-web.xml
index 0f78e0339..901cec37d 100644
--- a/core/src/main/java/google/registry/env/qa/backend/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/qa/backend/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>backend</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="qa"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1h"/>
   </static-files>
diff --git a/core/src/main/java/google/registry/env/qa/bsa/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/qa/bsa/WEB-INF/appengine-web.xml
index 6dc8eeea3..67b94ddf6 100644
--- a/core/src/main/java/google/registry/env/qa/bsa/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/qa/bsa/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>bsa</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="qa"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1h"/>
   </static-files>
diff --git a/core/src/main/java/google/registry/env/qa/default/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/qa/default/WEB-INF/appengine-web.xml
index 7a5109044..07204022e 100644
--- a/core/src/main/java/google/registry/env/qa/default/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/qa/default/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>default</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -15,12 +15,17 @@
   </automatic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="qa"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1h"/>
     <include path="/assets/js/**" expiration="1h"/>
diff --git a/core/src/main/java/google/registry/env/qa/pubapi/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/qa/pubapi/WEB-INF/appengine-web.xml
index ae056986a..4a9f306da 100644
--- a/core/src/main/java/google/registry/env/qa/pubapi/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/qa/pubapi/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>pubapi</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="qa"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1h"/>
     <include path="/assets/js/**" expiration="1h"/>
diff --git a/core/src/main/java/google/registry/env/qa/tools/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/qa/tools/WEB-INF/appengine-web.xml
index f5956e6b1..a0a1a98d7 100644
--- a/core/src/main/java/google/registry/env/qa/tools/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/qa/tools/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>tools</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="qa"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1h"/>
     <include path="/assets/js/**" expiration="1h"/>
diff --git a/core/src/main/java/google/registry/env/sandbox/backend/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/sandbox/backend/WEB-INF/appengine-web.xml
index a16e16c85..6a6c96d94 100644
--- a/core/src/main/java/google/registry/env/sandbox/backend/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/sandbox/backend/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>backend</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="sandbox"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
   </static-files>
diff --git a/core/src/main/java/google/registry/env/sandbox/bsa/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/sandbox/bsa/WEB-INF/appengine-web.xml
index 02ab68932..6d31c2552 100644
--- a/core/src/main/java/google/registry/env/sandbox/bsa/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/sandbox/bsa/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>bsa</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="sandbox"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
   </static-files>
diff --git a/core/src/main/java/google/registry/env/sandbox/default/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/sandbox/default/WEB-INF/appengine-web.xml
index e03fd12af..217303ea9 100644
--- a/core/src/main/java/google/registry/env/sandbox/default/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/sandbox/default/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>default</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -11,12 +11,17 @@
   </manual-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="sandbox"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
     <include path="/assets/js/**" expiration="1d"/>
diff --git a/core/src/main/java/google/registry/env/sandbox/pubapi/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/sandbox/pubapi/WEB-INF/appengine-web.xml
index 126835223..3b764cb52 100644
--- a/core/src/main/java/google/registry/env/sandbox/pubapi/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/sandbox/pubapi/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>pubapi</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -11,12 +11,17 @@
   </manual-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="sandbox"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
     <include path="/assets/js/**" expiration="1d"/>
diff --git a/core/src/main/java/google/registry/env/sandbox/tools/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/sandbox/tools/WEB-INF/appengine-web.xml
index 8262a7ac8..47d903dad 100644
--- a/core/src/main/java/google/registry/env/sandbox/tools/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/sandbox/tools/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>tools</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="sandbox"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
     <include path="/assets/js/**" expiration="1d"/>
diff --git a/jetty/Dockerfile b/jetty/Dockerfile
index 406fec7da..366dfe1cc 100644
--- a/jetty/Dockerfile
+++ b/jetty/Dockerfile
@@ -1,4 +1,4 @@
-FROM jetty:12-jdk17
+FROM jetty:12-jdk21
 ADD --chown=jetty:jetty build/jetty-base /jetty-base
 ENV JETTY_BASE=/jetty-base
 WORKDIR "$JETTY_BASE"
diff --git a/proxy/Dockerfile b/proxy/Dockerfile
index 545c84e1e..62b53bc79 100644
--- a/proxy/Dockerfile
+++ b/proxy/Dockerfile
@@ -1,4 +1,4 @@
-FROM gcr.io/distroless/java
+FROM eclipse-temurin:21
 ADD build/libs/proxy_server.jar .
 ENTRYPOINT ["java", "-jar", "proxy_server.jar"]
 EXPOSE 30000 30001 30002 30010 30012
diff --git a/release/stage_beam_pipeline.sh b/release/stage_beam_pipeline.sh
index 8247e6dce..0e27d36eb 100755
--- a/release/stage_beam_pipeline.sh
+++ b/release/stage_beam_pipeline.sh
@@ -71,7 +71,7 @@ while (( "$#" > 0 )); do
     "gs://${dev_project}-deploy/${release_tag}/beam/${metadata_basename}" \
     --image-gcr-path "${image_name}:${release_tag}" \
     --sdk-language "JAVA" \
-    --flex-template-base-image JAVA17 \
+    --flex-template-base-image gcr.io/dataflow-templates-base/java21-template-launcher-base:latest \
     --metadata-file "./core/src/main/resources/${metadata_pathname}" \
     --jar "./core/build/libs/${uberjar_name}.jar" \
     --env FLEX_TEMPLATE_JAVA_MAIN_CLASS="${main_class}" \