jre

Each tag is a multi-arch index (amd64 + arm64) pinned by digest. Tagged by version, never :latest.

Use it as a base image

Reference it in the FROM line of your Dockerfile. Nonroot, read-only root filesystem, built for amd64 and arm64.

FROM ghcr.io/quenchworks/images/jre:25.0.4

Or pull it directly

docker pull ghcr.io/quenchworks/images/jre:25.0.4

Version line

25.0.4

Latest line

21.0.11, 17.0.19, 25.0.4

Architectures

amd64, arm64

Runs as

nonroot (uid 1001)

Root filesystem

read-only

License

GPL-2.0-with-classpath-exception

Verify the supply chain

This image is cosign-signed and carries an SPDX SBOM and a SLSA build-provenance attestation on the same digest. Check all three before you build on it:

# 1. signature — built and signed by QuenchWorks CI
cosign verify ghcr.io/quenchworks/images/jre:25.0.4 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. SLSA build provenance — which workflow built it, from what
cosign verify-attestation --type https://slsa.dev/provenance/v1 ghcr.io/quenchworks/images/jre:25.0.4 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 3. SPDX SBOM — the package inventory
cosign verify-attestation --type https://spdx.dev/Document/v2.3 ghcr.io/quenchworks/images/jre:25.0.4 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

See the SBOM & provenance guide for reading the SBOM and using these checks in CI.

Best-practice Dockerfile for 25.0.4

jre is a runtime base you copy a built jar onto, not something you compile in. Here the jar is packaged with the matching JDK in the build stage and the jre image is the final stage that runs it.

1
# Build stage: compile and package the jar with the full JDK.
2
FROM ghcr.io/quenchworks/images/jdk:25.0.4 AS build
3
USER root
4
WORKDIR /app
5
ENV MAVEN_OPTS=-Dmaven.repo.local=/tmp/.m2
6

7
COPY pom.xml ./
8
RUN ["./mvnw", "-B", "-Dmaven.repo.local=/tmp/.m2", "dependency:go-offline"]
9
COPY src ./src
10
RUN ["./mvnw", "-B", "-o", "-Dmaven.repo.local=/tmp/.m2", "package", "-DskipTests"]
11

12
# This image is the final runtime stage: run the jar, nonroot.
13
FROM ghcr.io/quenchworks/images/jre:25.0.4 AS runtime
14
WORKDIR /app
15
COPY --from=build /app/target/*.jar /app/app.jar
16
USER 1001
17
EXPOSE 8080
18
ENTRYPOINT ["java", "-Djava.io.tmpdir=/tmp", "-jar", "/app/app.jar"]

This Dockerfile is pinned to the 25.0.4 line. For the line-by-line walkthrough and ecosystem variants (npm/Yarn, pip/uv/Poetry, Maven/Gradle), see the Build a Java appguide.