From b4b8bbb2cccf984fdce51fb416bc2ab2d1b6821b Mon Sep 17 00:00:00 2001 From: Ravi Singal Date: Sun, 25 Oct 2026 16:39:17 +0530 Subject: [PATCH] fix: move base images to distroless cc-debian13 Debian 12 (bookworm) is approaching the end of its full-support window, so move the runtime base for both Java images to gcr.io/distroless/cc-debian13. The helper stages move to trixie alongside it so the JRE and jemalloc are built against the same glibc (2.41) as the runtime base, and the SSL stage moves to java-base-debian13 so the Java cacerts come from a matching release. cc-debian13 already ships zlib (libz.so.1 -> libz.so.1.3.1), unlike cc-debian12, so copying libz in from the build stage is no longer needed. Replace it with an assertion that the base still provides the library, left unversioned so a routine zlib patch bump does not break the weekly update-docker-args PR. Verified by building both images on amd64 and arm64: java 11.0.33 and 21.0.13 start, jemalloc preloads, cacerts are present, and the eMudhra blocked.certs entry survives jlink. Co-Authored-By: Claude Opus 5 --- .github/workflows/update-docker-args.yml | 2 +- java-11/Dockerfile | 14 +++++++------- java-11/base.image | 2 +- java-21/Dockerfile | 14 +++++++------- java-21/base.image | 2 +- 5 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/workflows/update-docker-args.yml b/.github/workflows/update-docker-args.yml index d4f9a10..e3bccb5 100644 --- a/.github/workflows/update-docker-args.yml +++ b/.github/workflows/update-docker-args.yml @@ -17,7 +17,7 @@ jobs: shell: bash id: args run: | - BASE_IMAGE="gcr.io/distroless/cc-debian12" + BASE_IMAGE="gcr.io/distroless/cc-debian13" BASE_IMAGE_TAG="debug" BASE_IMAGE_DIGEST=$(gcloud container images list-tags $BASE_IMAGE --format json | jq --arg tag "$BASE_IMAGE_TAG" -r '.[] | {digest: .digest, tag: .tags[]} | select(.tag == $tag) | .digest') if [ -n "$BASE_IMAGE_DIGEST" ]; then diff --git a/java-11/Dockerfile b/java-11/Dockerfile index e42d35f..ea67a4a 100644 --- a/java-11/Dockerfile +++ b/java-11/Dockerfile @@ -5,7 +5,7 @@ ARG BASE_IMAGE # Zulu CA build straight from Azul's CDN. The SHA-256 pins the download. jlink copies blocked.certs # from the JDK it runs, so it must be the fixed one. # TEMP: go back to azul/zulu-openjdk-debian once it publishes a tag with the fix. -FROM debian:bookworm-slim AS jre +FROM debian:trixie-slim AS jre ARG JAVA_VERSION ARG TARGETARCH # Update these together with java.version. @@ -73,9 +73,9 @@ jdk.zipfs\ RUN grep -q 7BA62FEC54E9D040556FCA70A6A88F03761C178FA1F7CB8390A73076849F55A2 /jre/lib/security/blocked.certs # Extract java SSL certs -FROM gcr.io/distroless/java-base-debian12:debug AS ssl +FROM gcr.io/distroless/java-base-debian13:debug AS ssl -FROM debian:bookworm-slim As builder +FROM debian:trixie-slim AS builder RUN apt update && apt install -y libjemalloc-dev # stage for amd64 @@ -84,8 +84,8 @@ FROM ${BASE_IMAGE} AS base-amd64 SHELL ["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/busybox/sh", "-c"] RUN ln -s /busybox/sh /bin/sh -COPY --from=jre /lib/x86_64-linux-gnu/libz.so.1.2.13 /lib/x86_64-linux-gnu/libz.so.1.2.13 -RUN ln -s /lib/x86_64-linux-gnu/libz.so.1.2.13 /lib/x86_64-linux-gnu/libz.so.1 +# libz.so.1 is already present in the base image +RUN test -e /lib/x86_64-linux-gnu/libz.so.1 # change default memory allocator to jemalloc COPY --from=builder /usr/lib/x86_64-linux-gnu/libjemalloc* /usr/lib/x86_64-linux-gnu/ @@ -97,8 +97,8 @@ FROM ${BASE_IMAGE} AS base-arm64 SHELL ["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/busybox/sh", "-c"] RUN ln -s /busybox/sh /bin/sh -COPY --from=jre /lib/aarch64-linux-gnu/libz.so.1.2.13 /lib/aarch64-linux-gnu/libz.so.1.2.13 -RUN ln -s /lib/aarch64-linux-gnu/libz.so.1.2.13 /lib/aarch64-linux-gnu/libz.so.1 +# libz.so.1 is already present in the base image +RUN test -e /lib/aarch64-linux-gnu/libz.so.1 # change default memory allocator to jemalloc COPY --from=builder /usr/lib/aarch64-linux-gnu/libjemalloc* /usr/lib/aarch64-linux-gnu/ diff --git a/java-11/base.image b/java-11/base.image index 4828d2b..1c126e2 100644 --- a/java-11/base.image +++ b/java-11/base.image @@ -1 +1 @@ -gcr.io/distroless/cc-debian12:debug@sha256:bc3546a529388660b583cc85ca6559927652d54391dc8059419d7b4bf3921154 +gcr.io/distroless/cc-debian13:debug@sha256:8eb229dfe1ec97410a495e312dfba214afd86bfc72010973e08796ac5e94e234 diff --git a/java-21/Dockerfile b/java-21/Dockerfile index 309a4e2..a25269d 100644 --- a/java-21/Dockerfile +++ b/java-21/Dockerfile @@ -5,7 +5,7 @@ ARG BASE_IMAGE # Zulu CA build straight from Azul's CDN. The SHA-256 pins the download. jlink copies blocked.certs # from the JDK it runs, so it must be the fixed one. # TEMP: go back to azul/zulu-openjdk-debian once it publishes a tag with the fix. -FROM debian:bookworm-slim AS jre +FROM debian:trixie-slim AS jre ARG JAVA_VERSION ARG TARGETARCH # Update these together with java.version. @@ -73,9 +73,9 @@ jdk.zipfs\ RUN grep -q 7BA62FEC54E9D040556FCA70A6A88F03761C178FA1F7CB8390A73076849F55A2 /jre/lib/security/blocked.certs # Extract java SSL certs -FROM gcr.io/distroless/java-base-debian12:debug AS ssl +FROM gcr.io/distroless/java-base-debian13:debug AS ssl -FROM debian:bookworm-slim AS builder +FROM debian:trixie-slim AS builder RUN apt update && apt install -y libjemalloc-dev # stage for amd64 @@ -84,8 +84,8 @@ FROM ${BASE_IMAGE} AS base-amd64 SHELL ["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/busybox/sh", "-c"] RUN ln -s /busybox/sh /bin/sh -COPY --from=jre /lib/x86_64-linux-gnu/libz.so.1.2.13 /lib/x86_64-linux-gnu/libz.so.1.2.13 -RUN ln -s /lib/x86_64-linux-gnu/libz.so.1.2.13 /lib/x86_64-linux-gnu/libz.so.1 +# libz.so.1 is already present in the base image +RUN test -e /lib/x86_64-linux-gnu/libz.so.1 # change default memory allocator to jemalloc COPY --from=builder /usr/lib/x86_64-linux-gnu/libjemalloc* /usr/lib/x86_64-linux-gnu/ @@ -97,8 +97,8 @@ FROM ${BASE_IMAGE} AS base-arm64 SHELL ["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/busybox/sh", "-c"] RUN ln -s /busybox/sh /bin/sh -COPY --from=jre /lib/aarch64-linux-gnu/libz.so.1.2.13 /lib/aarch64-linux-gnu/libz.so.1.2.13 -RUN ln -s /lib/aarch64-linux-gnu/libz.so.1.2.13 /lib/aarch64-linux-gnu/libz.so.1 +# libz.so.1 is already present in the base image +RUN test -e /lib/aarch64-linux-gnu/libz.so.1 # change default memory allocator to jemalloc COPY --from=builder /usr/lib/aarch64-linux-gnu/libjemalloc* /usr/lib/aarch64-linux-gnu/ diff --git a/java-21/base.image b/java-21/base.image index 4828d2b..1c126e2 100644 --- a/java-21/base.image +++ b/java-21/base.image @@ -1 +1 @@ -gcr.io/distroless/cc-debian12:debug@sha256:bc3546a529388660b583cc85ca6559927652d54391dc8059419d7b4bf3921154 +gcr.io/distroless/cc-debian13:debug@sha256:8eb229dfe1ec97410a495e312dfba214afd86bfc72010973e08796ac5e94e234