GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — fix: move base images to distroless cc-debian13 by ravisingal · Pull Request #59 · hypertrace/docker-java-base

Conversation

@ravisingal

@ravisingal ravisingal commented Oct 25, 2026

Copy link
Copy Markdown
Contributor

Why

Debian 12 (bookworm) is approaching the end of its full-support window. This moves the runtime base for both Java images to gcr.io/distroless/cc-debian13.

Changes

  • java-11/base.image, java-21/base.image — point at gcr.io/distroless/cc-debian13:debug at the current digest.
  • update-docker-args.yml — the weekly digest-bump workflow now tracks cc-debian13, so it won't revert the migration.
  • jre and builder stages → debian:trixie-slim, so the JRE and jemalloc are built against the same glibc (2.41) as the runtime base.
  • ssl stage → gcr.io/distroless/java-base-debian13:debug, so the Java cacerts come from a matching release.
  • zlib handling — cc-debian13 already ships libz.so.1 -> libz.so.1.3.1, unlike cc-debian12. Copying libz in from the build stage is no longer needed (and would now fail: the old ln -s collides with the base's own symlink). It's replaced by an assertion that the base still provides the library, left unversioned so a routine zlib patch bump doesn't break the weekly digest PR.
  • java-11/Dockerfile — As builder → AS builder, clearing the FromAsCasing build warning.

Testing

Both images built locally on amd64 and arm64:

Check java-11 java-21
Build pass pass
java -version Zulu 11.0.33 Zulu 21.0.13
jemalloc LD_PRELOAD resolves resolves
/etc/ssl/certs/java/cacerts present present
eMudhra entry in blocked.certs present present

The zlib assertion was also checked against a deliberately bad path to confirm it fails the build rather than passing silently.

Remaining build warnings are pre-existing InvalidDefaultArgInFrom notices for ARG BASE_IMAGE, which both CI workflows always supply.

🤖 Generated with Claude Code

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@ravisingal @claude
fix: move base images to distroless cc-debian13
b4b8bbb 
Debian 12 (bookworm) is approaching the end of its full-support window, so
move the runtime base for both Java images to gcr.io/distroless/cc-debian13.

The helper stages move to trixie alongside it so the JRE and jemalloc are
built against the same glibc (2.41) as the runtime base, and the SSL stage
moves to java-base-debian13 so the Java cacerts come from a matching release.

cc-debian13 already ships zlib (libz.so.1 -> libz.so.1.3.1), unlike
cc-debian12, so copying libz in from the build stage is no longer needed.
Replace it with an assertion that the base still provides the library, left
unversioned so a routine zlib patch bump does not break the weekly
update-docker-args PR.

Verified by building both images on amd64 and arm64: java 11.0.33 and
21.0.13 start, jemalloc preloads, cacerts are present, and the eMudhra
blocked.certs entry survives jlink.

Co-Authored-By: Claude Opus 5 <[email protected]>
@ravisingal
ravisingal requested review from JBAhire, aaron-steinfeld and kotharironak as code owners October 25, 2026 11:09
@ravisingal

ravisingal commented Oct 25, 2026

Copy link
Copy Markdown
Contributor Author

Root CA certificate emSign ECC Root CA - G3 is removed from the base image.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
hibohra1398
hibohra1398 approved these changes Oct 25, 2026
View reviewed changes
aaron-steinfeld
aaron-steinfeld approved these changes Oct 26, 2026
View reviewed changes
@ravisingal
ravisingal merged commit c960c85 into main Oct 26, 2026
5 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@ravisingal
ravisingal deleted the fix/cc-debian13-base branch October 26, 2026 04:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@aaron-steinfeld aaron-steinfeld aaron-steinfeld approved these changes
@hibohra1398 hibohra1398 hibohra1398 approved these changes
@JBAhire JBAhire Awaiting requested review from JBAhire JBAhire is a code owner
@kotharironak kotharironak Awaiting requested review from kotharironak kotharironak is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@ravisingal @aaron-steinfeld @hibohra1398
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.