niceos/openjdk25 repository overview

⁠☕ NiceOS OpenJDK 25 GA

⁠An alternative to Bitnami images — secure, minimal, reproducible container base.

Java 25 GA on a purpose-built container OS — minimal, predictable, and secure. Base OS: NiceOS Base → a container-first Linux engineered for clarity and safety (not a trimmed general-purpose distro). Learn more about the base at https://hub.docker.com/r/niceos/base-os⁠.

⁠📌 Tag Policy

This repository uses a rolling GA strategy:

• 25.0.0 — moving (will be refreshed with security and base OS updates, but always stays in the 25.0.x GA line).
• latest — moving (always points to the newest GA).

⁠TL;DR

Run Java (moving tag):

docker run --rm niceos/openjdk25:25.0.0 java -version

Use latest for dev:

docker run --rm niceos/openjdk25:latest java -version

Run your JAR:

docker run --rm -v "$PWD"/app.jar:/app/app.jar niceos/openjdk25:25.0.0 \
  java -jar /app/app.jar

Docker Compose:

services:
  java:
    image: niceos/openjdk25:25.0.0
    volumes:
      - ./app.jar:/app/app.jar
    command: ["java", "-jar", "/app/app.jar"]

Kubernetes (minimal Deployment):

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-java
spec:
  replicas: 1
  selector: { matchLabels: { app: my-java } }
  template:
    metadata: { labels: { app: my-java } }
    spec:
      securityContext: { runAsUser: 10001, runAsGroup: 10001 }
      containers:
        - name: app
          image: niceos/openjdk25:25.0.0
          args: ["java","-jar","/app/app.jar"]
          volumeMounts:
            - name: appjar
              mountPath: /app/app.jar
              subPath: app.jar
          readinessProbe:
            exec: { command: ["java","-version"] }
            initialDelaySeconds: 5
            periodSeconds: 15
      volumes:
        - name: appjar
          configMap: { name: my-java-jar }

⁠🧩 Overview

NiceOS OpenJDK 25 GA delivers a clean, production-ready Java 25 runtime on NiceOS Base — a Linux distribution built exclusively for containers. This is not “Java on a repackaged distro”; it’s Java on a container-first OS designed for minimalism, security, and reproducibility.

Core principles

• 🧹 Clean: no package managers, compilers, or background daemons.
• 🔒 Secure: each build is scanned; critical CVEs block release.
• ♻️ Rolling: monthly refreshes; urgent fixes shipped as needed.
• 🧾 Transparent: SBOM and vulnerability reports embedded in the image.

⁠🔄 Updates & Release Model

• Monthly refreshes after QA/integration.
• Critical CVEs patched immediately.
• OpenJDK sync — images track upstream GA updates shortly after release.

⁠📦 What’s Inside

Included:

• OpenJDK 25 GA (JDK + JRE)
• glibc, OpenSSL, trusted CA certificates
• Text rendering libs (freetype, harfbuzz)
• Minimal POSIX tools

Excluded:

• ❌ No package manager
• ❌ No build toolchains
• ❌ No init systems

⁠🛡 Security & Transparency

• Multi-engine vulnerability scanning.
• SBOM (SPDX + CycloneDX).
• Blocker policy: no image ships with critical CVEs.
• Reports are inside:

/nicesoft/niceos/reports/

⁠⚙️ JVM Tuning (env vars)

• JAVA_TOOL_OPTIONS → portable JVM flags
• JDK_JAVA_OPTIONS → alternative entry

Examples:

-e JAVA_TOOL_OPTIONS="-XX:+ExitOnOutOfMemoryError -XX:MaxRAMPercentage=70"
-e JAVA_TOOL_OPTIONS="-XX:ActiveProcessorCount=2 -XX:InitialRAMPercentage=15 -XX:MaxRAMPercentage=70"

GC:

• G1GC default
• ZGC available (-XX:+UseZGC)

⁠🔧 Usage Patterns

Minimal Dockerfile:

FROM niceos/openjdk25:25.0.0
WORKDIR /app
COPY myapp.jar .
CMD ["java", "-jar", "myapp.jar"]

Multi-stage with Maven:

FROM maven:3-eclipse-temurin AS build
WORKDIR /src
COPY . .
RUN mvn -q -DskipTests package

FROM niceos/openjdk25:25.0.0
WORKDIR /app
COPY --from=build /src/target/*.jar /app/app.jar
ENV JAVA_TOOL_OPTIONS="-XX:+ExitOnOutOfMemoryError -XX:MaxRAMPercentage=70"
CMD ["java","-jar","/app/app.jar"]

⁠❓ FAQ

• Pinned tags? → none for GA, use 25.0.0.
• Root? → discouraged, use NICEOS_ALLOW_ROOT=1 only if needed.
• Reports? → inside /nicesoft/niceos/reports/.
• Arch? → x86_64.

⁠📖 Support

• Email: [email protected]⁠
• Base OS: https://hub.docker.com/r/niceos/base-os⁠

⁠License

Apache License 2.0. Copyright © 2025 NiceSOFT LLC

⁠✅ Practical checklist

• Use 25.0.0 in production (deterministic digest).
• Add JVM tuning via JAVA_TOOL_OPTIONS.
• Apply healthcheck (java -version).
• Handle custom CAs with make-ca.
• Multi-stage builds keep images slim.