The Java runtime environment in your containers could stop receiving updates in the coming months. It's time to take action. This article explains the decisions that led to this issue and proposes a solution.
OpenJDK and Java SE updates
OpenJDK is an open source implementation of the Java Platform, Standard Edition (Java SE), on which multiple companies and contributors collaborate.
A project at OpenJDK represents each new feature release of the Java SE specification. Subsequent updates to those features, including functional and security fixes, are led by maintainers working in the JDK updates project. Long-term supported releases such as Java SE 8 (since March 2014), Java SE 11 (since Sept 2018), and Java SE 17 (since Sept 2021) undergo a quarterly release update under the guidance of a lead maintainer.
The repository maintainers' role is to ensure that updates are both necessary and appropriate for deployed releases. They consider the opinions of multiple contributors when making such update decisions. Many vendors and distributors of Java SE subsequently build from the OpenJDK source code to provide new releases of their own branded Java SE offerings.
Andrew Haley (Red Hat) is the lead maintainer for Java 8 updates and Java 11 updates, and Goetz Lindenmaier (SAP) is the lead maintainer for Java 17 updates. Update maintainers affiliated with companies that provide commercially supported distributions of OpenJDK based on Java SE work as independent contributors to the project.
Docker Hub deprecates OpenJDK images
For many years, the official Docker Hub image builders took OpenJDK Java SE update binaries from Eclipse Adoptium and other locations to build their own image. But in July 2022, the Docker Hub image builders announced the deprecation of this popular image.
Now, Docker asks users to obtain their builds of OpenJDK, either from a commercial Java vendor or directly from the Adoptium project. There will be no further updates to the existing OpenJDK image, so users risk falling behind with functional and security updates to their Java SE usage unless they move to an alternate provider. I believe the official Eclipse Temurin image maintained by the Adoptium project is the obvious choice for a replacement image.
Eclipse Adoptium builds JDKs
OpenJDK does not provide binary updates directly from the update projects. Since July 2022, these long-term supported Java update projects have depended upon Eclipse Adoptium to build and distribute consumable OpenJDK binaries.
Adoptium is a project dedicated to building, testing, and distributing up-to-date and ready-to-use OpenJDK binaries under an open source license. Adoptium calls their builds of OpenJDK, Temurin. They are available across a broad range of processors and operating systems. These Temurin binaries have over half a billion downloads and earned the trust of enterprise production environments worldwide. A vendor-independent working group based at the Eclipse software foundation leads Adoptium.
The Adoptium community provides binaries built directly from OpenJDK source code. These Temurin binaries are available as direct downloads, installers, or container images and are faithful representations of the OpenJDK update source built under controlled conditions.
The official Docker Hub Temurin images contain the latest releases of the OpenJDK updates for several Java SE versions, thoroughly tested with various applications. The images work as direct drop-in replacements for the OpenJDK images. Some OpenJDK images already contain Temurin binaries.
How to move from OpenJDK images to Eclipse Temurin images
The Docker Hub's deprecation decision presents a problem. But there is a solution. We recommend moving from the OpenJDK image to the official Docker Hub Eclipse Temurin image.
The process is simple. All you have to do is identify the FROM lines in Dockerfiles such as this:
FROM: openjdk:17
Change the lines as follows:
FROM eclipse-temurin:17
The process for changing the use of images other than version 17 is equivalent. You can report issues to the Adoptium community.
Red Hat support
We encourage everyone to switch to Eclipse Temurin. Many application images and examples of best practices have successfully made the change.
Red Hat recently announced direct support for Temurin in development and production as part of Red Hat Runtimes, Red Hat OpenShift, and Red Hat Build of OpenJDK. Red Hat support assures customers that the move to Temurin will be smooth, allowing you to continue focusing on building products that integrate and automate modern business applications and processes.
Last updated: September 26, 2022