search

nextgenhealthcare / connect-docker

Official Dockerfiles for Connect https://hub.docker.com/r/nextgenhealthcare/connect
Mozilla Public License 2.0
78 stars 51 forks source link

[Security] Switch base image for multiple builds #22

Closed tonygermano closed 1 year ago

tonygermano commented 2 years ago

The openjdk docker images are deprecated. See https://hub.docker.com/_/openjdk

https://hub.docker.com/_/adoptopenjdk has also been deprecated in favor of https://hub.docker.com/_/eclipse-temurin/. This image has not been updated in a year.

jonbartels commented 2 years ago

I have a local build that appears to work on eclipse-temurin:17-jre and eclipse-temurin:11-jre.

eclipse-temurin:17-jre did require me to add 

    environment:
      - "VMOPTIONS=--add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED"

This was due to an error from the premium clustering plugin.

tonygermano commented 2 years ago

This was not addressed in the 4.1.1 release that just came out today.

narupley commented 1 year ago

Looks like eclipse-termurin is Windows-based?

It sounds like amazoncorretto would be a better choice since it's Linux. And the openjdk Docker Hub page says there is no preference: https://hub.docker.com/_/openjdk

jonbartels commented 1 year ago

@narupley - https://hub.docker.com/_/eclipse-temurin

I am running my Mirth containers on FROM eclipse-temurin:17-jre then layering in parts of the MC image. eclipse-temurin:17-jre is definitely linux based. It is accessed using bash with docker exec has apt, so it is some Debian variant.

One advantage of Coretto is that it packages JavaFX like the old Oracle JDK did. We ran it on the desktop to support MCAL. Zulu is similar.

I think as long as NextGen picks a not-openjdk image with a reasonably recent LTS release it'll be just fine.

tonygermano commented 1 year ago

@narupley https://hub.docker.com/_/eclipse-temurin is the successor of https://hub.docker.com/_/adoptopenjdk, and I think that would make the most sense to use as the default image. It does support Windows, but it also supports Linux on several architectures. That is what most projects use that want a vanilla openjdk.

For the OpenJ9 builds, you should probably be using https://hub.docker.com/_/ibm-semeru-runtimes

The Azul builds shouldn't need to change.

pladesma commented 1 year ago

We pushed the change from openjdk to eclipse-temurin. We'll upload new images on DockerHub with the next MC release.

pladesma commented 1 year ago

Oops. Re-opening because we still need to change the adoptopenjdk images, which is coming soon.

tonygermano commented 1 year ago

Thanks for the update @pladesma . It would be nice if you would consider repushing at least 4.2.0 with the good base images since that is the currently supported latest version.

pladesma commented 1 year ago

We decided to replace both openjdk and adoptopenjdk images with eclipse-temurin. We've updated the image tags for 4.2.0 and pushed new images to DockerHub.

We also took the opportunity to upgrade to JRE/JDK 17 in the current images.