This repository was archived by the owner on Sep 1, 2026. It is now read-only.
Conversation
Add files via upload
Bump the amazonlinux base image and dnf releasever for the OpenJDK 8 and 17 JRE images, and add a new OpenJDK 21 JRE image following the existing openjdk8/openjdk17 conventions.
There was a problem hiding this comment.
Pull request overview
This PR updates and expands the container image set under images/, primarily targeting Amazon Linux–based Java runtime images, and introduces additional image scaffolding/scripts/configs to align images to a common “fabric8-style” layout (agent-bond + run-java.sh).
Changes:
- Update Amazon Linux base tags / OS update pinning for Amazon OpenJDK JRE images (notably OpenJDK 8/17) to pull in upstream security fixes.
- Add a new Amazon OpenJDK 21 JRE image (Corretto 21) with the same conventions (agent-bond, jmx_exporter config,
run-java.sh). - Add/modify additional image files (e.g., GraalVM image, several OpenJDK 7/8/11 image assets, and documentation/config/script copies).
Reviewed changes
Copilot reviewed 44 out of 44 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
| images/README.md | Adds top-level documentation for the image layout and included tooling (agent-bond + run-java.sh). |
| images/graal/Dockerfile | Adds a GraalVM-based image definition including agent-bond and run-java.sh. |
| images/graal/run-java.sh | Adds the Java startup script used to run applications within the container. |
| images/graal/agent-bond-opts | Adds helper script to produce agent-bond JVM args. |
| images/graal/jmx_exporter_config.yml | Adds Prometheus JMX exporter rules configuration. |
| images/centos/openjdk8/jre/Dockerfile | Modifies the CentOS OpenJDK 8 JRE image build steps (notably JDK installation approach/base). |
| images/amazon/openjdk8/jre/Dockerfile | Defines/updates the Amazon OpenJDK 8 JRE image (Corretto 8) and OS update pinning. |
| images/amazon/openjdk8/jre/run-java.sh | Adds the Java startup script for the Amazon OpenJDK 8 JRE image. |
| images/amazon/openjdk8/jre/agent-bond-opts | Adds agent-bond options helper for the Amazon OpenJDK 8 JRE image. |
| images/amazon/openjdk8/jre/jmx_exporter_config.yml | Adds JMX exporter rules for the Amazon OpenJDK 8 JRE image. |
| images/amazon/openjdk8/jre/README.md | Adds documentation for the Amazon OpenJDK 8 JRE image. |
| images/amazon/openjdk8/jdk/Dockerfile | Defines/updates the Amazon OpenJDK 8 JDK image (Corretto 8 + devel). |
| images/amazon/openjdk8/jdk/run-java.sh | Adds the Java startup script for the Amazon OpenJDK 8 JDK image. |
| images/amazon/openjdk8/jdk/agent-bond-opts | Adds agent-bond options helper for the Amazon OpenJDK 8 JDK image. |
| images/amazon/openjdk8/jdk/jmx_exporter_config.yml | Adds JMX exporter rules for the Amazon OpenJDK 8 JDK image. |
| images/amazon/openjdk8/jdk/README.md | Adds documentation for the Amazon OpenJDK 8 JDK image. |
| images/amazon/openjdk7/jre/Dockerfile | Defines the Amazon OpenJDK 7 JRE image structure and runtime user setup. |
| images/amazon/openjdk7/jre/run-java.sh | Adds the Java startup script for the Amazon OpenJDK 7 JRE image. |
| images/amazon/openjdk7/jre/agent-bond-opts | Adds agent-bond options helper for the Amazon OpenJDK 7 JRE image. |
| images/amazon/openjdk7/jre/jmx_exporter_config.yml | Adds JMX exporter rules for the Amazon OpenJDK 7 JRE image. |
| images/amazon/openjdk7/jre/README.md | Adds documentation for the Amazon OpenJDK 7 JRE image. |
| images/amazon/openjdk7/jdk/Dockerfile | Defines the Amazon OpenJDK 7 JDK image structure and runtime user setup. |
| images/amazon/openjdk7/jdk/run-java.sh | Adds the Java startup script for the Amazon OpenJDK 7 JDK image. |
| images/amazon/openjdk7/jdk/agent-bond-opts | Adds agent-bond options helper for the Amazon OpenJDK 7 JDK image. |
| images/amazon/openjdk7/jdk/jmx_exporter_config.yml | Adds JMX exporter rules for the Amazon OpenJDK 7 JDK image. |
| images/amazon/openjdk7/jdk/README.md | Adds documentation for the Amazon OpenJDK 7 JDK image. |
| images/amazon/openjdk11/jre/Dockerfile | Defines the OpenJDK 11 JRE image (CentOS-based) and supporting assets. |
| images/amazon/openjdk11/jre/agent-bond-opts | Adds agent-bond options helper for the OpenJDK 11 JRE image. |
| images/amazon/openjdk11/jre/jmx_exporter_config.yml | Adds JMX exporter rules for the OpenJDK 11 JRE image. |
| images/amazon/openjdk11/jre/README.md | Adds documentation for the OpenJDK 11 JRE image. |
| images/amazon/openjdk11/jdk/Dockerfile | Defines the Amazon OpenJDK 11 JDK image (Corretto 11 + devel). |
| images/amazon/openjdk11/jdk/agent-bond-opts | Adds agent-bond options helper for the Amazon OpenJDK 11 JDK image. |
| images/amazon/openjdk11/jdk/jmx_exporter_config.yml | Adds JMX exporter rules for the Amazon OpenJDK 11 JDK image. |
| images/amazon/openjdk11/jdk/README.md | Adds documentation for the Amazon OpenJDK 11 JDK image. |
| images/amazon/openjdk17/jre/Dockerfile | Defines/updates the Amazon OpenJDK 17 JRE image (Corretto 17) and OS update pinning. |
| images/amazon/openjdk17/jre/agent-bond-opts | Adds agent-bond options helper for the Amazon OpenJDK 17 JRE image. |
| images/amazon/openjdk17/jre/jmx_exporter_config.yml | Adds JMX exporter rules for the Amazon OpenJDK 17 JRE image. |
| images/amazon/openjdk21/jre/Dockerfile | Adds the new Amazon OpenJDK 21 JRE image (Corretto 21) and OS update pinning. |
| images/amazon/openjdk21/jre/agent-bond-opts | Adds agent-bond options helper for the Amazon OpenJDK 21 JRE image. |
| images/amazon/openjdk21/jre/jmx_exporter_config.yml | Adds JMX exporter rules for the Amazon OpenJDK 21 JRE image. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+48
to
+50
| #fix for CVE-2023-4911 for GLIBC | ||
| RUN dnf update --releasever 2023.2.20231002 -y | ||
|
|
Comment on lines
+51
to
+56
| RUN dnf update --releasever 2023.6.20241212.0 -y | ||
|
|
||
| USER root | ||
|
|
||
|
|
||
| CMD [ "/deployments/run-java.sh" ] No newline at end of file |
Comment on lines
+51
to
+56
| RUN dnf update --releasever 2023.12.20260817.0 -y | ||
|
|
||
| USER root | ||
|
|
||
|
|
||
| CMD [ "/deployments/run-java.sh" ] No newline at end of file |
Comment on lines
+21
to
+23
| && export JAVA_HOME=/usr/java/jdk1.8.0_131 >> /etc/profile \ | ||
| && export JRE_HOME=/usr/java/jdk1.8.0_131/jre >> /etc/profile \ | ||
| && export PATH=$PATH:$JAVA_HOME/bin:$JRE_HOME/bin >> /etc/profile \ |
| RUN yum install -y wget tar gzip \ | ||
| && mkdir /usr/java \ | ||
| && cd /usr/java \ | ||
| && wget --no-cookies --no-check-certificate --header "Cookie: gpw_e24=http%3A%2F%2Fwww.oracle.com%2F; oraclelicense=accept-securebackup-cookie" "http://download.oracle.com/otn-pub/java/jdk/8u131-b11/d54c1d3a095b4ff2b6607d096fa80163/jdk-8u131-linux-x64.tar.gz" \ |
| EXEC_ARGS="" | ||
| if [ -n "${JAVA_APP_NAME:-}" ]; then | ||
| # Not all shells support the 'exec -a newname' syntax.. | ||
| if $(exec -a test true 2>/dev/null); then |
| EXEC_ARGS="" | ||
| if [ -n "${JAVA_APP_NAME:-}" ]; then | ||
| # Not all shells support the 'exec -a newname' syntax.. | ||
| if $(exec -a test true 2>/dev/null); then |
| EXEC_ARGS="" | ||
| if [ -n "${JAVA_APP_NAME:-}" ]; then | ||
| # Not all shells support the 'exec -a newname' syntax.. | ||
| if $(exec -a test true 2>/dev/null); then |
Author
|
not right. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Updates the Amazon Linux base image and
dnfreleasever pinned in the OpenJDK 8 and OpenJDK 17 JRE Dockerfiles to pull in upstream OS package fixes (including the patchedlibpngpackage), and adds a new OpenJDK 21 JRE image following the same conventions as the existingopenjdk8/openjdk17images.Ticket(s):
SECURITY # 2816 - CVE-2026-25646 — libpng out-of-bounds read
Type of Change
Summary of Changes
images/amazon/openjdk8/jre/Dockerfile: bumpFROM amazonlinuxbase tag anddnf update --releaseverto2023.6.20241212.0images/amazon/openjdk17/jre/Dockerfile: bumpFROM amazonlinuxbase tag anddnf update --releaseverto2023.6.20241212.0images/amazon/openjdk21/jre/: new image (Dockerfile,run-java.sh,jmx_exporter_config.yml,agent-bond-opts) mirroring the existingopenjdk8/openjdk17JRE image structure, installingjava-21-amazon-correttoImpact Analysis
Areas affected: Amazon Linux base container images for OpenJDK 8, 17 (JRE), and a new OpenJDK 21 JRE image
Risk level: Low — base image/package version bumps and an additive new image; no changes to existing runtime behavior of unaffected images
Backwards compatibility: No API/schema changes. Existing OpenJDK 8/17 image consumers get an updated base OS with patched packages (including the fixed
libpng); OpenJDK 21 is a net-new image tag and does not affect existing consumersNotable pattern changes: None (no feature flags, migrations, or public API surface changes)
QA Test Plan
images/amazon/openjdk8/jre/Dockerfileandimages/amazon/openjdk17/jre/Dockerfileand confirm the images build successfully with the updatedamazonlinuxbase tagrpm -q libpnginside the container) and confirm thelibpngpackage version is2:1.6.37-10.amzn2023.0.11or later, resolving CVE-2026-25646images/amazon/openjdk21/jre/Dockerfileand confirm it builds successfully and installsjava-21-amazon-correttodocker run <image>) with a sample deployment under/deploymentsand confirmrun-java.shstarts the JVM correctly and the Jolokia/jmx_exporter agent-bond ports (8778, 9779) are exposed