Docker: OpenJDK8 uses EOF version of Alpine Linux

[edumco]

The actual Dockerfile uses openjdk8 as base image and that uses an old version of Alpine Linux (3.6) that is not supported since 2019-05-01

LTS versions should use a stable version of every tool or library. When the tool no-longer receives no official support is prone to produce security issues and should be updated.

The PR #956 could solve this issue since it uses adoptopenjdk images that are more up to date

[oleg-nenashev]

As it was agreed with the Platform SIG team a few months ago, we will be moving the image to AdoptOpenJDK base image, as well as all other images in short term. Taking the recent public exposure of the old image, I will deliver an expedited fix for this issue specifically.

[oleg-nenashev]

Pending pull requests:

• Controller (FKA master) image: https://github.com/jenkinsci/docker/pull/975
• Agent images: https://github.com/jenkinsci/docker-ssh-agent/pull/59, https://github.com/jenkinsci/docker-agent/pull/150, https://github.com/jenkinsci/docker-inbound-agent/pull/190

Once agent images are released, we will also need to respin the https://github.com/jenkinsci/jnlp-agents builds

[oleg-nenashev]

According to the feedback from @daniel-beck @aheritier @timja @MarkEWaite , we do not want to do packaging alignment between the old OpenJDK image and the new AdoptOpenJDK one. We do not see any package which would be a concern for the common Jenkins use-cases, and alpine images are supposed to be small. Also, a we jump over multiple Alpine Linux versions with its own breaking changes. Our intend is to release images with explicit notice about potentially breaking changes,

I will re-confirm it at the Platform SIG meeting in 15 min and go ahead with merges if there is no negative feedback

[oleg-nenashev]

Status update for Aug 13, 2020:

1. Agent images have been updated:
   
   
   
   • https://github.com/jenkinsci/docker-agent/releases/tag/4.3-8
   
   
   • https://github.com/jenkinsci/docker-inbound-agent/releases/tag/4.3-9
   
   
   • https://github.com/jenkinsci/docker-ssh-agent/releases/tag/3.0.0
   
   
2. Jenkins Controller images (FKA "master") got a fix in https://github.com/jenkinsci/docker/pull/975 . This fixed will be shipped in the next weekly and LTS releases
3. https://github.com/jenkinsci/jnlp-agents still needs an update for some images. In my TODO list for tomorrow

[slide]

Can we close this out?

[oleg-nenashev]

Yup