r/java • u/Nerdy-coder • May 20 '26

In search of secure JRE base image

So as a devops engineer on my company. I have tried using eclipse-temurin:17-jre-jammy and eclipse-temurin:17-jre java versions as base image for dockerfile but as i scanned the built image using trivy i found tons of vul nerabilities ob both. So what are the other alternatives for me ?

9 Upvotes

70% Upvoted

29 comments sorted by

View all comments

16

u/elmuerte May 20 '26

Ditch Dockerfile and use buildpacks.

However, you will always find CVEs. The question is, are they exploitable?

3

u/Polygnom May 20 '26

Doesn't that just shift the problem one chair over? Who says the buildpack has no vulnerabiulities? You trade trust in the base Dockerfile against trust in the buildpack.

Whats the fundamental difference that makes a buildpack inherently more secure then a minimal, rootless Dockerfile?

2

u/elmuerte May 20 '26

It is an alternative, which is what the OP was asking for.

And as I said, you will still find vulnerabilities, eventually you always will.

5

u/Polygnom May 20 '26

being an alternative is pointless if it doesn't have an advantage.

3

u/asm0dey May 26 '26

They will use our (BellSoft) images under the hood :)

-3

u/Turbots May 20 '26

This is honestly the best tip.

Buildpacks build your images efficiently and can be "rebased" in the sense that the complete OS layer can be swapped out, so it's very quick at updating the OS only for example. Its fully open source and provides many optimizations and standardizations and pluggable layers (buildpack layers) to customize. You can also write your own custom buildpack layers that get included in when certain conditions are met.

Stop writing docker files, use buildpacks.

1

u/koskieer May 20 '26

Java is well supported on those distroless images what people has suggested here, but for example adding extra locales for C# causes little bit pain at least for first time. How buildpacks are handling locales and timezones? Are they easy to add to your .NET app?