Neo4j Images Security Update

michael.hunger · June 12, 2019, 9:52pm

As of 10th June 2019 all new Neo4j Docker images will be released with a base image of debian-slim instead of alpine linux.

This was prompted by security concerns, which caused the Docker maintainers to pull the alpine images from the official openjdk Docker Hub page.

A discussion and justification for these changes can be found here:

github.com/docker-library/openjdk

Move 8 and 11 to consume from https://adoptopenjdk.net/upstream.html

docker-library:master ← infosiftr:upstream-8-and-11

opened 11:23PM - 22 May 19 UTC

tianon

+916 -1502

Closes #320 > These binaries are built by Red Hat on behalf of the OpenJDK jd…k8u and jdk11u projects. The binaries are created from the unmodified source code at OpenJDK. So to put that another way and be explicitly clear, the builds from https://adoptopenjdk.net/upstream.html are *not* AdoptOpenJDK, but are merely hosted/enabled by the AdoptOpenJDK project as explicitly vanilla builds of the upstream OpenJDK project blessed/supported by the 8u/11u project lead. For context, see https://github.com/docker-library/openjdk/issues/320#issuecomment-494050246: > I am the OpenJDK 8 and 11 Updates OpenJDK project lead. Concrete (potentially breaking) changes that are a consequence of this: 1. no more OpenJDK 7 images (see https://github.com/docker-library/openjdk/issues/320#issuecomment-494417274 -- "7 is still alive but only receives security updates" and "compatibility between 7 and 8 seems to be good enough in most cases") 2. no more OpenJDK 11 JRE images (see https://github.com/docker-library/openjdk/issues/320#issuecomment-494417274 -- "JDK 11 has no official JRE build. The reason for this is that the `jlink` tool allows users to create precisely-targeted stripped JDK images for their applications, and this is IMO better for Docker than a JRE image.") 3. the way OpenJDK is installed in 8 and 11 images is now quite different, and there will be some breakage expected -- I've tried to minimize that as much as possible, but there's only so much I can do here 4. no more OpenJDK 8 Alpine images (Alpine/musl is not officially supported by the OpenJDK project, so this reflects that -- see "Project Portola" for the Alpine porting efforts which I understand are still in need of help) 5. supported architectures are now decreased to match what's "officially" published -- for 8, we drop to just amd64, for 11 we drop to amd64 and arm64v8 @theRealAph if you'd be willing to at least take a cursory look over this, I'd really appreciate it :heart: (probably focused on either the `Dockerfile-adopt-*.template` files or one specific JDK version -- they're all generated from that same content so there's no reason to actually hand-review them all :sweat_smile:) For extra visibility, explicit CC to the maintainers of other official images which are `FROM openjdk`: - clojure: @Quantisan, @cap10morgan, @DeLaGuardo - convertigo: @nicolas-albert, @opicciotto - flink: @patricklucas, @iemejia - geonetwork: @doublebyte1 - gradle: @keeganwitt - groovy: @keeganwitt - jetty: @md5, @gregw - jruby: @cpuguy83 - kaazing-gateway: @kaazing - lightstreamer: @lightstreamer - maven: @carlossg - neo4j: @benbc, @digitalstain - nuxeo: @dmetzler, @akervern - orientdb: @luigidellaquila - rapidoid: @nmihajlovski - solr: @makuk66, @shalinmangar - sonarqube: @janos-ss, @julienlancelot, @christophelevis - storm: @31z4 - tomcat: @tianon, @yosifkit - tomee: @lordofthejars, @otaviojava - xwiki: @xwiki - zookeeper: @31z4 I've personally looked at `tomcat`, and the practical implications there are going to be that we switch from being only JRE variants to being only JDK variants (since we need the JDK to compile Tomcat Native and it wasn't worth doing the legwork to make that work just for OpenJDK 8 JRE, and `jlink` doesn't work there because `tomcat` is intended to host arbitrary user code). I also think it's worthwhile to point out the following other existing (and in-progress) JDK official images: - https://hub.docker.com/_/amazoncorretto - https://hub.docker.com/_/ibmjava - https://github.com/docker-library/official-images/pull/5710 (`adoptopenjdk` proper) Closes #309 Closes #303 Closes #244 Closes #189 Closes #278 Closes #217 Closes #73

Topic		Replies	Views
Log4j Security in Neo4j docker image Docker docker	1	459	December 16, 2021
Request to push the v4 Docker image to neo4j-public/causal-cluster-k8s Docker	5	493	May 4, 2020
Installing neo4j on debian Neo4j Graph Platform	6	417	October 16, 2023
Vulnerabilities in latest docker image of neo4j 4.4.9 General migrated	1	101	July 20, 2022
Neo4j Community compatability with JAVA 11 Operations	22	21044	November 14, 2019

July Summer Fun!

Neo4j Images Security Update

Related topics