Clojure Docker images breaking change

[Wes Morgan]

Heads up, there are some breaking changes coming very soon for some of the Clojure Docker images.

Specifically the Java 17+ images will be migrating from the old upstream "openjdk" images to the "eclipse-temurin" (the successor to AdoptOpenJDK) upstream images. This change is being forced on us because the Docker Official Image maintainers are being forced to remove the openjdk:17 images due to Oracle no longer producing the "vanilla" builds these were based on for any version past 17.0.2 (and 17.0.3 is already out w/ some important security fixes). You can read more about that here: https://github.com/docker-library/openjdk/pull/495

Probably the biggest change you'll notice is that the new upstream images are based on Ubuntu instead of Debian. There is also an Alpine-based image available upstream, so we will be releasing alpine variants for Java 17+ too. But be aware that those are currently linux/amd64 only (whereas the Ubuntu-based images are available for linux/amd64, linux/arm64, & linux/arm).

So what do you need to do? It depends. :)

Are you using Java 8 or 11 images (e.g. Docker tags containing "openjdk-8-" or "openjdk-11-")?

•  You don't need to do anything for now. In the interest of minimizing breakage, we're staying on the still-supported openjdk:8 and openjdk:11 upstream images for the time being.
  

Are you using Java 17 (the current LTS release) or higher images (e.g. Docker tags containing "openjdk-17-" or without any jdk specifier)?

• If you're using Docker tags with "openjdk" in them, you'll need to change that to "temurin".
• If you're using Docker tags without any jdk specifier in them, be aware that you'll get temurin instead of openjdk in a pull in the near future. As always we recommend specifying this so you can opt-in to the shift once you're ready to start testing the change.
• If you're using Docker tags with a Debian release name in them, you'll need to change those to the Ubuntu release name "focal" (e.g. "bullseye" -> "focal"). Or you could switch to "alpine" but that would potentially require more significant changes in your Docker image(s).
• Note that there is no "slim-focal". If you're using "slim-buster" or "slim-bullseye" then you'll either need to accept the larger "focal" image or adopt the "alpine" variant if you can (e.g. if you're running only on linux/amd64). The eclipse-temurin focal images are of a similar size as the old openjdk buster & bullseye images (~230MB for Java 17 on linux/amd64). The slim variants shaved ~20-30 MB off of that. If you'd like a slimmer Ubuntu-based image, you'll need to politely ask the eclipse-temurin image maintainers to publish one. If you succeed we'll start building on it!

As usual the openjdk-17+ images aren't going to disappear from Docker Hub anytime soon (that I'm aware of), but we recommend not using them any longer than you have to once we release the new temurin images. As mentioned above, there are already important security patches in 17.0.3 that you'll only get with the move to temurin.

Let me know if you have any questions about any of this. The change should occur in a few days at the most.

[Wes Morgan]

Unfortunately the original plan of leaving openjdk:8 and openjdk:11-based images alone isn't going to work. Upstream has recently announced that even the old openjdk:8 and openjdk:11 images are being deprecated and will no longer receive updates (security and otherwise).

So that means we need to release new clojure images even for those older JDK versions, and it is strongly recommended that you move to them.

Similar to what we previously did for the Java 17+ images, we'll be moving the Java 8 & 11 images to the eclipse-temurin upstream. The biggest change there will be the switch from Debian to Ubuntu inside the images. Some of your images will still just work, but many will break. All need to be tested.

You can control the timing of when you make the transition by ensuring you specify the distro in your Docker tags. For example: clojure:openjdk-11-tools-deps-slim-bullseye or clojure:openjdk-8-lein-2.9.8-buster. slim-bullseye has been the default for awhile now, so if you currently aren't specifying a distro, that's the one you want to ensure nothing actually changes in your images while you test the new ones (unless you haven't built the image in many months).

Once you make sure you have the "bullseye", "slim-bullseye", "buster", or "slim-buster" distro specifier in your existing tags, start testing your images with "temurin" in place of "openjdk" and "jammy" (latest LTS Ubuntu release) or "focal" (previous LTS Ubuntu release) in place of whatever distro you were specifying before. So the two previous examples would become clojure:temurin-11-tools-deps-jammy and clojure:temurin-8-lein-2.9.8-focal (assuming you need to stay on the older release; move to jammy if possible), respectively.

We will be making jammy-based images available for all Java versions as well. Up until now we were only providing focal-based images.

This change will take effect in the next few days.

Let me know if you have any questions about this, and I apologize for the inconvenience.