Page MenuHomePhabricator

Create openjdk-21 docker images based on Bookworm
Closed, ResolvedPublic

Description

OpenSearch 3 requires Java 21 or later, and our security posture (discourages? prohibits?) using the embedded JDK that comes with OpenSearch.

As such, we'll need:

  • Create openjdk-21 docker images and publish them to our docker-images repo
  • Deploy production images
  • Verify they are viable as a source for OpenSearch 3 images moved to T414693

Details

Other Assignee
RKemper
Related Changes in Gerrit:

Event Timeline

Change #1227376 had a related patch set uploaded (by Bking; author: Bking):

[operations/docker-images/production-images@master] java: create openjdk-21 image

https://gerrit.wikimedia.org/r/1227376

bking changed the task status from Open to In Progress.Jan 15 2026, 4:54 PM
bking claimed this task.
bking triaged this task as High priority.
bking updated Other Assignee, added: bking.
bking updated Other Assignee, removed: bking.

Change #1227376 merged by Bking:

[operations/docker-images/production-images@master] java: create openjdk-21 image

https://gerrit.wikimedia.org/r/1227376

Brian and I are testing out building of https://gerrit.wikimedia.org/r/c/operations/docker-images/production-images/+/1227376 like so:

root@build2001:/srv/images/production-images# /srv/deployment/docker-pkg/venv/bin/docker-pkg -c /etc/production-images/config.yaml build images/ --select '*openjdk-21-jre-bookworm*'
== Step 0: scanning /srv/images/production-images/images/ ==
Will build the following images:
== Step 1: building images ==
== Step 2: publishing ==
== Build done! ==
You can see the logs at ./docker-pkg-build.log
root@build2001:/srv/images/production-images# /srv/deployment/docker-pkg/venv/bin/docker-pkg -c /etc/production-images/config.yaml build images/ --select '*jre*'
== Step 0: scanning /srv/images/production-images/images/ ==
Will build the following images:
* docker-registry.discovery.wmnet/openjdk-21-jre:0.1
== Step 1: building images ==
* Built image docker-registry.discovery.wmnet/openjdk-21-jre:0.1
== Step 2: publishing ==
Successfully published image docker-registry.discovery.wmnet/openjdk-21-jre:0.1
== Build done! ==
You can see the logs at ./docker-pkg-build.log

Actually working build string this time

The openjdk-21 image is built; work to create an OpenSearch 3 image based upon it continues in T414693. Closing...