Chainguard Image for adoptium-jdk-fips

Minimal Wolfi-based Java JDK image using Adoptium OpenJDK. Used for compiling Java applications.

Chainguard Images are regularly-updated, minimal container images with low-to-zero CVEs.

Download this Image

This image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/adoptium-jdk-fips:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard registry.

Compatibility Notes

Like most available alternatives, Chainguard's Adoptium JDK fips image is built directly from the Adoptium sources. The Chainguard Adoptium JDK fips image has few-to-zero CVEs and does not run as the root user.

Getting Started

The JDK is the standard development system for a Java application. It is used for compiling and packaging Java applications, which are then run on a JRE.

Compiling a Minimal Java Application Example

This section outlines how you can build a Java application with the Chainguard Adoptium JDK fips Image.

Start by creating a sample Java class named HelloWolfi:

cat >HelloWolfi.java <<EOL
class HelloWolfi
{
    public static void main(String args[])
    {
        System.out.println("Hello Wolfi users!");
    }
}
EOL

Then create a multistage Dockerfile, adding the Java class you just created:

cat >Dockerfile <<EOL
FROM cgr.dev/chainguard/adoptium-jdk-fips

COPY HelloWolfi.java /home/build/
RUN javac HelloWolfi.java

FROM cgr.dev/chainguard/jre

COPY --from=0 /home/build/HelloWolfi.class /app/
CMD ["HelloWolfi"]
EOL

Following that, you can build the image:

docker build -t my-java-app .

Note that this example tags the image with my-java-app. You can now run the image by referencing this tag, as in the following command:

docker run my-java-app

Hello Wolfi users!

Using the Chainguard Adoptium JDK fips image in a Jenkins Pipeline

Using a Chainguard Image as part of a CI/CD system like Jenkins might also be a useful option. With the Jenkins Docker agent, you can define multiple steps that use different Chainguard Images. The following is an example using the Chainguard Adoptium JDK fips image as part of a Jenkins pipeline:

pipeline {
    agent {
        docker { image 'cgr.dev/chainguard/adoptium-jdk-fips' }
    }
    stages {
        stage('Test') {
            steps {
                # Use javac, jdeps, jlink, ...
                sh 'javac -version'
            }
        }
    }
}

For a full reference on using various images in a Jenkins pipeline, please refer to the Jenkins documentation.

Using the Chainguard Adoptium JDK fips to create a custom JRE

A less common, but powerful, use case for the Chainguard Adoptium JDK fips image is creating an optimized custom JRE for your Java application. This involves using jdeps to produce the information about the Java modules being used and subsequently using jlink to analyze your application to eliminate all module code not being used by your application. This can create a drastically smaller JRE for a particular application.

Keep in mind that a JRE produced this way is a fit-for-purpose JRE, and is not broadly usable.

For reference, here are two additional articles describing the use of jlink to create optimized application images:

• Creating your own runtime using jlink
• Creating a Custom JRE for your Java Applications

Documentation and Resources

• (Video) How to Migrate a Java Application to Chainguard Images
• (Video) Building Minimal Images for Applications with Runtimes
• (Learning Lab) Chainguard's Java Image Learning Lab
• (Blog) Building minimal and low CVE images for Java

Contact Support

If you have a Zendesk account (typically set up for you by your Customer Success Manager) you can reach out to Chainguard's Customer Success team through our Zendesk portal.

What are Chainguard Images?

Chainguard Images are a collection of container images designed for security and minimalism.

Many Chainguard Images are distroless; they contain only an open-source application and its runtime dependencies. These images do not even contain a shell or package manager. Chainguard Images are built with Wolfi, our Linux undistro designed to produce container images that meet the requirements of a secure software supply chain.

The main features of Chainguard Images include:

• Minimal design, with no unnecessary software bloat
• Automated nightly builds to ensure Images are completely up-to-date and contain all available security patches
• High quality build-time SBOMs (software bills of materials) attesting the provenance of all artifacts within the Image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

-dev Variants

As mentioned previously, Chainguard’s distroless Images have no shell or package manager by default. This is great for security, but sometimes you need these things, especially in builder images. For those cases, most (but not all) Chainguard Images come paired with a -dev variant which does include a shell and package manager.

Although the -dev image variants have similar security features as their distroless versions, such as complete SBOMs and signatures, they feature additional software that is typically not necessary in production environments. The general recommendation is to use the -dev variants only to build the application and then copy all application artifacts into a distroless image, which will result in a final container image that has a minimal attack surface and won’t allow package installations or logins.

That being said, it’s worth noting that -dev variants of Chainguard Images are completely fine to run in production environments. After all, the -dev variants are still more secure than many popular container images based on fully-featured operating systems such as Debian and Ubuntu since they carry less software, follow a more frequent patch cadence, and offer attestations for what they include.

Learn More

To better understand how to work with Chainguard Images, we encourage you to visit Chainguard Academy, our documentation and education platform.