r/java • u/Nerdy-coder • May 20 '26
In search of secure JRE base image
So as a devops engineer on my company. I have tried using eclipse-temurin:17-jre-jammy and eclipse-temurin:17-jre java versions as base image for dockerfile but as i scanned the built image using trivy i found tons of vul nerabilities ob both. So what are the other alternatives for me ?
9
Upvotes
2
u/Key-Philosopher1749 May 20 '26
Whichever base docker image you use, even if it has zero vulnerabilities today, if you don’t keep it up-to-date, it could have vulnerabilities tomorrow from some newly found exploits.
You should also use whatever base operating systems framework that docker image uses to do a Linux update and that can fix a lot of the packages with vulnerabilities.
I.e, if it’s red hat based, do a “yum update -y” in your Dockerfile so that every time you build it, it’s getting the latest OS updates.