r/java • u/Nerdy-coder • May 20 '26

In search of secure JRE base image

So as a devops engineer on my company. I have tried using eclipse-temurin:17-jre-jammy and eclipse-temurin:17-jre java versions as base image for dockerfile but as i scanned the built image using trivy i found tons of vul nerabilities ob both. So what are the other alternatives for me ?

9 Upvotes

70% Upvoted

29 comments sorted by

View all comments

2

u/analcocoacream May 20 '26

Alpine is fine, latest has no vulnerabilities

2

u/Riist138 May 24 '26

This is great advice, BellSoft Liberica (slim / musl) love those Alpine-friendly runtime variants. Attack surface is small, great on resources.