Today we are announcing chiseled containers for OpenJRE 8, 17 and 21 (Open Java Runtime Environment), coming from the OpenJDK project. These images are highly optimized for size and security, containing only the dependencies that are strictly necessary. They are available for both AMD64 and ARM64 architectures and benefit from 12 years of security support.

You can download the images from the following links:

• Dockerhub
• Amazon Elastic Container Registry (ECR)

We also completed a set of benchmarks to compare the images toChiseled Ubuntu containers to similar JRE images, and you can find the links to the Github repos further down in the page.

What are Chiseled JRE containers

Chiseled containers represent Canonical’s take on distroless container images. They are created using Chisel, an open source tool developed by Canonical that allows users to extract well-defined portions (aka slices) of Debian packages into a filesystem. Just like ordinary Debian packages, slices carry their own content and set of dependencies to other internal and external slices.

The Chiseled Ubuntu containers for JRE image packs the OpenJRE (Open Java Runtime Environment), coming from the OpenJDK project, a free and open source implementation of the Java Platform, Standard Edition (Java SE). In the context of JRE, Chisel allows the creation of super small images that can be used as a runtime, final-stage base image for compatible Java applications. Chiseled images not only remove the package manager, bash or superfluous components of OpenJDK, but also all unused dependencies or portions of dependencies.

Improved size and developer experience

We have benchmarked the Chiseled Ubuntu JRE images against the relevant alternatives from Eclipse Adoptium (Temurin), Amazon Corretto and Azul Zulu. The results have highlighted that:

• The Chiseled Ubuntu JRE image of OpenJDK 17 provides approximately a 51% reduction in the size of the compressed image compared to Temurin runtime image, a 65% reduction compared to the Amazon Corretto runtime image and a 30% reduction compared to the Azul Zulu runtime image
• The Chiseled Ubuntu JRE image of OpenJDK 8 provides a 52% reduction in the size of the compressed image compared to Temurin and 1% smaller than the Amazon Corretto image. Azul Zulu does not provide a JRE image and it was not evaluated.

In both instances we did not identify any statistically significant degradation of startup performance or throughput compared to the other images analyzed. The detailed benchmarks results will be published in subsequent blogs.

As a result, Chiseled Ubuntu JRE images will result in a lower resource and bandwidth utilization, which in turn mean significant cost savings when used at scale in a cloud environment. You can build and package your Java application simply by creating a new build stage from a base image.

You can read more about Chisel in the product documentation and you can access the Github repositories from the following links to find an in-depth performance analysis:

• Chiseled Ubuntu containers for JRE 8 repository
• Chiseled Ubuntu containers for JRE 17 repository
• Chiseled Ubuntu containers for JRE 21 repository

Trusted provenance and strong security guarantees

Chiseled Ubuntu images inherit Ubuntu’s long-term support guarantees and are updated within the same release cycle using the self-same packages as within other LTS components. They are fully supported by Canonical:

• Up to 12-year security patching for Ubuntu Pro customers on all Ubuntu packages
• Optional weekday or 24/7 customer support
• 100% library and release cycle alignment with Ubuntu LTS

According to the 2023 Sysdig report, Java packages are the riskiest, representing over 60% of vulnerabilities exposed at runtime. With Java 8 and 17 still representing the dominant Java versions in large enterprises according to the latest Jetbrains and New Relic surveys, Canonical LTS guarantees means that developer teams can extend the life of their existing applications, without needing to operate a tradeoff between costly upgrades and security risk exposure.

Extend support to your workload with Everything LTS

Canonical’s Everything LTS  offers 12-year LTS for any open source Docker image, on any CNCF compliant Kubernetes distribution, which is ideal for organizations looking for extended support for their workloads.  With Everything LTS, Canonical’s expert engineering team will build distroless Docker images to customer specifications (including upstream components not packaged in Ubuntu) and fix critical CVEs within 24 hours, supported on RHEL, Ubuntu, VMware or public cloud K8s for 12+ years.

You can read more about Chiseled Ubuntu and Everything LTS in our blog:

• Chiseled Ubuntu: the perfect present for your containerized and cloud applications
• Chiseled Ubuntu containers: the benefits of combining Distroless and Ubuntu
• Announcing .NET Chiselled Containers
• Canonical offers 12 year LTS for any open source Docker image