Hi, nice list, why is debian not on there?

[bvdriel]

Hi, nice list, we are looking at implementing jre and jdk versions in our cicd pipelines and our application base image policy. I found your site veryhelpful, but i am wondering why temurin is being advised. Currently our team has selected debian jdk and jre, because debian is a well respected provider, and provides steady security updates. i can fully understand that readoning, so my question is, how does the debian jdk stack up to the temurin jdk and shy should we favour one over the other? Would you recommend switching to temurin, and if so, why? forgive me if this information is somewhere on the site, i could not find it using a search for debian.

[jochenchrist]

Thanks for the hint, I will add debian jdk to the list.

Nothing wrong with Debian JDK, but I probably would rather not recommend to use it in production:

• the default-jdk does not specify the exact version, and it may vary on version and architecture. (well you can get around with specifying the major version.)
• Currently there is no OpenJDK 17 build. Buster and Bullseye use a OpenJDK 11 build (which contains the latest 11.0.16 bugfix update). OpenJDK 17 is my current recommendation, and many Java programs have been updated to Java 17.

[jochenchrist]

Related to #16

[bvdriel]

Hi, mmm, my knowledge is limited here i think, but what do you mean by'default-jdk'?
Debian bullseye certainly has Java 17 support it seems?
https://packages.debian.org/bullseye/openjdk-17-jdk

[NikolayMetchev]

Debian JDK is what distroless uses. We were very happy with it, but for some reason they don't keep up with security updates. Perhaps they don't have enough resources. For that reason I figured out how to use Temurin with distroless.