From cd65e6deab89cac023b251c257fe79e3f193000e Mon Sep 17 00:00:00 2001 From: David Reed Date: Thu, 22 Oct 2026 11:00:46 -0600 Subject: [PATCH 1/4] [eMudhra 53119][Docker] Move the echo-command-app example to distroless java21-debian13 gcr.io/distroless/java:11 is deprecated and based on Debian 11 (bullseye), which has no fixed ca-certificates package. Pin the java21-debian13 digest uploaded 2026-10-21 and build with gradle:8-jdk21 to match. Co-Authored-By: Claude --- bolt-docker-examples/echo-command-app/Dockerfile | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/bolt-docker-examples/echo-command-app/Dockerfile b/bolt-docker-examples/echo-command-app/Dockerfile index 87cf4c24c..c28906106 100644 --- a/bolt-docker-examples/echo-command-app/Dockerfile +++ b/bolt-docker-examples/echo-command-app/Dockerfile @@ -1,9 +1,12 @@ -FROM gradle:8-jdk11 AS build +FROM gradle:8-jdk21 AS build COPY . /home/gradle/src WORKDIR /home/gradle/src RUN gradle build -FROM gcr.io/distroless/java:11 +# gcr.io/distroless/java:11 is deprecated and based on Debian 11 (bullseye), which +# has no fixed ca-certificates package (eMudhra 53119). java21-debian13:latest, +# pinned to the digest uploaded 2026-10-21 (ships ca-certificates 20250419+deb13u1). +FROM gcr.io/distroless/java21-debian13@sha256:81093f54a674ffc9bcc1ba5b8fe75158bf6c56e592ec6513b1603a0bda485388 COPY --from=build /home/gradle/src/build/libs /app EXPOSE 8080 ENTRYPOINT ["java", "-jar", "/app/slack-app-backend.jar"] From 26d517b2e184fd8fb9fd196129eaa3d909525d79 Mon Sep 17 00:00:00 2001 From: David Reed Date: Thu, 22 Oct 2026 11:54:57 -0600 Subject: [PATCH 2/4] [eMudhra 53119][Docker] Narrow: use distroless java17-debian13, keep jdk11 build stage java17-debian13:latest was rebuilt on 2026-10-21 with ca-certificates 20250419+deb13u1, and it is a smaller JDK step from 11 than java21. The gradle:8-jdk11 build stage is not shipped, and the Java 11 bytecode it produces runs on 17, so that stage is restored. Co-Authored-By: Claude --- bolt-docker-examples/echo-command-app/Dockerfile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/bolt-docker-examples/echo-command-app/Dockerfile b/bolt-docker-examples/echo-command-app/Dockerfile index c28906106..485df1a1d 100644 --- a/bolt-docker-examples/echo-command-app/Dockerfile +++ b/bolt-docker-examples/echo-command-app/Dockerfile @@ -1,12 +1,12 @@ -FROM gradle:8-jdk21 AS build +FROM gradle:8-jdk11 AS build COPY . /home/gradle/src WORKDIR /home/gradle/src RUN gradle build # gcr.io/distroless/java:11 is deprecated and based on Debian 11 (bullseye), which -# has no fixed ca-certificates package (eMudhra 53119). java21-debian13:latest, +# has no fixed ca-certificates package (eMudhra 53119). java17-debian13:latest, # pinned to the digest uploaded 2026-10-21 (ships ca-certificates 20250419+deb13u1). -FROM gcr.io/distroless/java21-debian13@sha256:81093f54a674ffc9bcc1ba5b8fe75158bf6c56e592ec6513b1603a0bda485388 +FROM gcr.io/distroless/java17-debian13@sha256:bc5ad38faf0501a7f60859f85f00cfb285639736e2e948a2d98262f5b022a934 COPY --from=build /home/gradle/src/build/libs /app EXPOSE 8080 ENTRYPOINT ["java", "-jar", "/app/slack-app-backend.jar"] From de56367ffcf230167648f6cda0abeabf7ed02933 Mon Sep 17 00:00:00 2001 From: Michael Brooks Date: Mon, 26 Oct 2026 16:42:15 -0700 Subject: [PATCH 3/4] chore: use the distroless java17-debian13 tag instead of a digest pin A digest pin freezes the example on one image, so developers who copy it never get later distroless security fixes. --- bolt-docker-examples/echo-command-app/Dockerfile | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/bolt-docker-examples/echo-command-app/Dockerfile b/bolt-docker-examples/echo-command-app/Dockerfile index 485df1a1d..a8ec05a97 100644 --- a/bolt-docker-examples/echo-command-app/Dockerfile +++ b/bolt-docker-examples/echo-command-app/Dockerfile @@ -3,10 +3,8 @@ COPY . /home/gradle/src WORKDIR /home/gradle/src RUN gradle build -# gcr.io/distroless/java:11 is deprecated and based on Debian 11 (bullseye), which -# has no fixed ca-certificates package (eMudhra 53119). java17-debian13:latest, -# pinned to the digest uploaded 2026-10-21 (ships ca-certificates 20250419+deb13u1). -FROM gcr.io/distroless/java17-debian13@sha256:bc5ad38faf0501a7f60859f85f00cfb285639736e2e948a2d98262f5b022a934 +# Debian 13 base, since gcr.io/distroless/java:11 (Debian 11) no longer gets ca-certificates fixes. +FROM gcr.io/distroless/java17-debian13 COPY --from=build /home/gradle/src/build/libs /app EXPOSE 8080 ENTRYPOINT ["java", "-jar", "/app/slack-app-backend.jar"] From 208ed85510ca398dd8d64544f2f0ab5fd4de46bd Mon Sep 17 00:00:00 2001 From: Eden Zimbelman Date: Mon, 26 Oct 2026 16:46:50 -0700 Subject: [PATCH 4/4] docs: remove comment of outdated certificates in docker --- bolt-docker-examples/echo-command-app/Dockerfile | 1 - 1 file changed, 1 deletion(-) diff --git a/bolt-docker-examples/echo-command-app/Dockerfile b/bolt-docker-examples/echo-command-app/Dockerfile index a8ec05a97..361d2ae28 100644 --- a/bolt-docker-examples/echo-command-app/Dockerfile +++ b/bolt-docker-examples/echo-command-app/Dockerfile @@ -3,7 +3,6 @@ COPY . /home/gradle/src WORKDIR /home/gradle/src RUN gradle build -# Debian 13 base, since gcr.io/distroless/java:11 (Debian 11) no longer gets ca-certificates fixes. FROM gcr.io/distroless/java17-debian13 COPY --from=build /home/gradle/src/build/libs /app EXPOSE 8080