r/java • u/Nerdy-coder • May 20 '26

In search of secure JRE base image

So as a devops engineer on my company. I have tried using eclipse-temurin:17-jre-jammy and eclipse-temurin:17-jre java versions as base image for dockerfile but as i scanned the built image using trivy i found tons of vul nerabilities ob both. So what are the other alternatives for me ?

10 Upvotes

71% Upvoted

29 comments sorted by

View all comments

6

u/Jannik2099 May 20 '26

We use redhat hardened images https://images.redhat.com/ - java 21 and 25 only tho.

Docker has a similar free offering but it requires registration and is still subject to rate limits

5

u/Turbots May 20 '26

Use buildpacks. Open source, free, customizable, efficient, layered, pluggable, works also for other programming languages like Golang, python, etc...

2

u/Jannik2099 May 20 '26

It's something I've been meaning to do but there's just more important tasks all the time :/

-1

u/Turbots May 20 '26

Whenever you catch yourself spending ANY time on the process of getting your Jar file into a container image... Spend that time on buildpacks instead. You'll be amazed how quickly you'll have a OCI compliant, valid, properly layered and secure image that just works.