[Question] with latest Jetty 12.1.9 on eclipse-temurin the underlying OS is "silently" updated from Ubuntu 24.04 to Ubuntu 26.04

[aschwarte10]

Hi all

we would like to raise a quick discussion / question on the latest Jetty 12.1.9 release on eclipse-temurim

Recently, eclipse-temurin JDK images (e.g., eclipse-temurin:25-jdk have switched the OS to Ubuntu 26.04 (Resolute) by default. As Jetty is using this as base image, there is a "silent" OS update from Ubuntu 24.04 (Jetty 12.1.8) container vs. Ubuntu 26.06 (Jetty 12.1.9)

Functionally we did not observe any problems yet.

However, it looks like other downstream service providers (e.g. AWS ECR inspector / scan) lack support, see aws/containers-roadmap#2815

Would it maybe an option to offer a Jetty variant based on eclipse-temurin:25-jdk-noble? Is that even desired?

Note that this ticket is meant as question - feel free to close when it is sufficiently answered.

[joakime]

I would hope that groups that need AWS compatibility are using the Amazon Corretto based Jetty images.

[aschwarte10]

I would hope that groups that need AWS compatibility are using the Amazon Corretto based Jetty images.

I think this statement is a bit too broad and depends on what kind of compatibility you refer to: we are just using the build infrastructure and AWS inspector for scanning. The AWS inspector is quite generic in its scanning capabilities, and eventually will also get support for Ubuntu 26.06

My question here was more for the awareness and to get opinions

[lachlan-roberts]

We try to avoid creating specialty tags unless there is a specific reason or demand for them, and prefer to rely on the base image with a generic JDK tag.

The main issue is that there are a lot of possible combinations of Jetty version, JDK version, JDK vs JRE, base image distribution, and distribution version. If we tried to cover these speculatively, we would end up with a very large number of tags and Dockerfiles to maintain.

That said, I would not be opposed to adding some 25-jdk-noble variants if requested.

[aschwarte10]

That said, I would not be opposed to adding some 25-jdk-noble variants if requested.

Thanks! this statement makes sense.

Feel free to handle as you see fit for the project - from my side it would help us short-term, but is not strictly required. The ECR scan will eventually add support for ubuntu 26.04 as well

[jetztgradnet]

Heya, I am a colleague of @aschwarte10 and this update was really surprising for us.
The main problem was not necessarily the fact that the image was now running a new OS version (although having this disclosed in some changelog would have been nice for awareness), but that we are now flying blindly wrt. vulnerability scanning, at least those provided by the ECR scans.

I would hope that groups that need AWS compatibility are using the Amazon Corretto based Jetty images.

We ship the same image for all our customers and just happen to use AWS infrastructure for builds. We specifically chose the Temurin Ubuntu base image for wide compatibility and good maintenance.

Having always the newest OS version is good, just in this specific moment, we are kind of hanging in the air wrt. vulnerability (and general) Docker image scans.

Possibly getting some additional voices on aws/containers-roadmap#2815 would already help.

Thanks for your time and maintenance efforts, those are highly appreciated!