Why Jib dropped support for distroless base image?

Question

It looks like starting with Jib 3.0; you no longer have default distroless images for your Java applications. Instead, you will get an adoptOpenjdk base image if you don't specify one. You still can configure and use distroless base images as per this link. I am just wondering if the adoptOpenJDK image is more secure, slimmer than distroless?. What's the benefit?

Monies

Answer 1

The Jib team was maintaining the Java specific images for distroless. Debian, from which distroless obtains its packages, dropped support for Java8 starting with Debian10. Java8 builds used Debian9 dependencies (outdated), which led to many many CVEs in the container image. This is a problem for users who require Java8 (lots of jib users), and at the moment the Jib team does not have the bandwidth to put together a high quality Java8 product for distroless.

Switching the default to adoptopenjdk, gives users consistently maintained images by adoptOpenJDK folks.

This is no means a knock on Distroless, it is still a great project, however a lack of resources and a complicated Java situation has led us here. Distroless is an opensource project, and anyone willing to create or update the workflow for Java8 can contribute directly. As far as I know, the distroless Java11 images is still available based on Debian10 packages, and you can use that as a base image if you like.

Abnaki

Is there any talk about the continuation of distroless/java in the medium term? I imagine jib defaults was the largest driver of distroless/java usage. Now that it is no longer default that usage will wane over time. This makes investment in distroless/java harder to justify over time. – Bangle

Distroless static and base are still widely used. As for Java, since it's built upon debian packages, releases will probably track how debian releases Java. – Abnaki

Sorry to bring this up again, but there is so little to be found about thr topic. So what's your opinion on this a year later @loosebazooka? Is distroless recommended with java 17, or should i use adoptOpenJDK because it's jib's default? – Kultur

Java 11 and Java 17 distroless are maintained and should be good to use. – Abnaki