Corretto Docker

Master repository where Dockerfiles for Amazon Corretto are hosted. These docker files are used to build images for Amazon Corretto Offical Images and ECR images.

Usage

The docker images are available on Amazon Corretto Official Images

To use Amazon Corretto Official Images from Docker hub run

docker pull amazoncorretto:11

The docker images are also available on Amazon ECR.

To use the docker images from Amazon ECR, you would need to authenticate with the ECR registry (id: 489478819445) with the help of instruction from here. Once authenticated, Amazon Corretto docker images can be pulled using command

docker pull 489478819445.dkr.ecr.us-west-2.amazonaws.com/amazoncorretto:latest
docker run -it 489478819445.dkr.ecr.us-west-2.amazonaws.com/amazoncorretto:latest /bin/bash

You can view the available tags, run

aws ecr list-images --region us-west-2 --registry-id 489478819445 --repository-name amazoncorretto | jq -r '.imageIds[] | .imageTag'

Supported Tags

• 8, 8u342, 8u342-al2, 8-al2-full,8-al2-jdk, latest
• 11, 11.0.16, 11.0.16-al2, 11-al2-jdk, 11-al2-full
• 8-alpine, 8u322-alpine, 8-alpine-full, 8-alpine-jdk
• 8-alpine-jre, 8u322-alpine-jre
• 8-alpine3.13, 8u322-alpine3.13, 8-alpine3.13-full, 8-alpine3.13-jdk
• 8-alpine3.13-jre, 8u322-alpine3.13-jre
• 8-alpine3.14, 8u322-alpine3.14, 8-alpine3.14-full, 8-alpine3.14-jdk
• 8-alpine3.14-jre, 8u322-alpine3.14-jre
• 11-alpine, 11.0.14-alpine, 11-alpine-full, 11-alpine-jdk
• 11-alpine3.13, 11.0.14-alpine3.13, 11-alpine3.13-full, 11-alpine3.13-jdk
• 11-alpine3.14, 11.0.14-alpine3.14, 11-alpine3.14-full, 11-alpine3.14-jdk
• 17, 17-al2-jdk, 17-al2-full
• 17-alpine3.13, 17.0.2-alpine3.13, 17-alpine3.13-full, 17-alpine3.13-jdk
• 17-alpine3.14, 17.0.2-alpine3.14, 17-alpine3.14-full, 17-alpine3.14-jdk, 17-alpine, 17.0.2-alpine, 17-alpine-full, 17-alpine-jdk

Building

To build the docker images, you can use the following command.

docker build -t amazon-corretto-{major_version} -f ./{major_version}/{jdk|jre|slim}/{al2|alpine|debian}/Dockerfile .

Security

If you would like to report a potential security issue in this project, please do not create a GitHub issue. Instead, please follow the instructions here or email AWS security directly.

Why does security scanner show that a docker image has a CVE?

⚠️ If you are using a Corretto Docker image with an AL2 guest, then Amazon’s ECS scanning function can result in a ALAS2-2021-1731 notification. However, there is no reason to update the Corretto application within Docker. You can safely ignore this ALAS. Once the next Corretto quarterly release is posted, currently scheduled for January 19, 2022, the alarm condition will be satisfied. This notice only affects the following Corretto Docker images with AL2 in the Docker ECR:

• 11, 11.0.16, 11.0.16-al2, 11-al2-jdk, 11-al2-full
• 17, 17-al2-jdk, 17-al2-full

---

If a security scanner reports that an amazoncorretto image includes a CVE, the first recommended action is to pull an updated version of this image.

If no updated image is available, run the appropriate command to update packages for the platform, ie. run "apk -U upgrade" for Alpine or "yum update -y --security" for AmazonLinux in your Dockerfiles or systems to resolve the issue immediately.

If no updated package is available, please treat this as a potential security issue and follow these instructions or email AWS security directly at aws-security@amazon.com.

It is the responsibility of the base docker image supplier to provide timely security updates to images and packages. The amazoncorretto images are automatically rebuilt when a new base image is made available, but we do not make changes to our Dockerfiles to pull in one-off package updates. If a new base image has not yet been made generally available by a base docker image maintainer, please contact that maintainer to request that the issue be addressed.

Note that there are multiple reasons why a CVE may appear to be present in a docker image, as explained in the docker library FAQs.