Alfresco Docker Base Java

This repository provides the base Docker images for Java LTS versions Rocky Linux 8 and 9 that are meant to be used within the Alfresco engineering to build Docker images for Java applications.

Flavours

Choose between one of the available flavours built from this repository:

Java version	Java flavour	OS	Image ref
17	jre	Rocky Linux 8	`alfresco/alfresco-base-java:jre17-rockylinux8`
11	jre	Rocky Linux 8	`alfresco/alfresco-base-java:jre11-rockylinux8`
17	jre	Rocky Linux 9	`alfresco/alfresco-base-java:jre17-rockylinux9`
21	jre	Rocky Linux 9	`alfresco/alfresco-base-java:jre21-rockylinux9`

The images are available on:

Docker Hub, image name: alfresco/alfresco-base-java
Quay (enterprise credentials required), image name: quay.io/alfresco/alfresco-base-java

Image pinning

To ensure the propagation of security fixes from upstream projects, all supported tags are mutable and undergo periodic rebuilding.

Pin by digest

The suggested approach is to pin the sha256 digest for best reproducibility in your Dockerfile, for example:

FROM alfresco/alfresco-base-java:jre17-rockylinux9@sha256:b749868ceb42bd6f58ae2f143e8c16af4752fad7b40eb1085c014cbfcecb1ffc

To discover the latest image digest, just run docker pull <image-ref> and then run docker images --digests.

$ docker pull alfresco/alfresco-base-java:jre17-rockylinux9
489e1be6ce56: Already exists
66defdfd2e26: Download complete
41c3b80bc03b: Download complete
be4e433e73b5: Download complete
docker.io/alfresco/alfresco-base-java:jre17-rockylinux9

$ docker images --digests
REPOSITORY                    TAG                 DIGEST                                                                    IMAGE ID       CREATED          SIZE
alfresco/alfresco-base-java   jre17-rockylinux9   sha256:b749868ceb42bd6f58ae2f143e8c16af4752fad7b40eb1085c014cbfcecb1ffc   be4e433e73b5   14 minutes ago   410MB

This configuration approach is compatible with Dependabot.

Pin by immutable tags

Additional tags are being pushed for master releases, following the pattern $tag-YYMMDDHHMM. Those tags are never overwritten and can be used as a more intuitive approach. You can still use it in combination with digest for increased security.

Quay.io doesn't retain previous images when a tag is overwritten, so using an immutable tag is mandatory in order to avoid getting Manifest not found error once a mutable tag get updated.

Development

While any docker installation will produce valid images, building with BuildKit has proven being more efficient and clever with Multistage builds. If you are building images locally, we recommend enabling it.

Naming specs

The images built from this repository are named as follow:

<JAVA_DISTRIBUTION_TYPE><JAVA_MAJOR_VERSION>-<OS_DISTRIBUTION_NAME><OS_DISTRIBUTION_VERSION>

Build an image locally

To build a local version of the base java image follow the instructions below:

docker build -t alfresco-base-java . \
  --build-arg DISTRIB_NAME=$DISTRIB_NAME \
  --build-arg DISTRIB_MAJOR=$DISTRIB_MAJOR \
  --build-arg JAVA_MAJOR=$JAVA_MAJOR \
  --build-arg JDIST=$JDIST \
  --no-cache --target JAVA_BASE_IMAGE

Release

New images are built automatically on each new commit on master and on a weekly schedule.

Glossary

What is a base image.

Downstream projects

Known projects currently using the base image:

Alfresco/alfresco-docker-base-java