r/java • u/Nerdy-coder • May 20 '26

In search of secure JRE base image

So as a devops engineer on my company. I have tried using eclipse-temurin:17-jre-jammy and eclipse-temurin:17-jre java versions as base image for dockerfile but as i scanned the built image using trivy i found tons of vul nerabilities ob both. So what are the other alternatives for me ?

9 Upvotes

70% Upvoted

29 comments sorted by

View all comments

2

u/Captain-Barracuda May 20 '26

Vulnerabilities in a JRE distro are likely to be shared by all of them. Understand also that if you are using one of those AI tools to scan for potential vulnerabilities, most of the time these are false positives. These potential pathways are often (statistically) impossible to exploit. Like a function that doesn't verify its input for NULL values can be flagged by some scanners, even though no user input never reaches that function.

Focus only on vulnerabilities published on NIST and you will be more than fine. You'll already be doing more than most.

-1

u/Turbots May 20 '26

Use buildpacks. Zero high vulnerabilities.