[Bug]: JDK 25 image doesn't include curl?

[gaeljw]

Please add the exact image (with tag) that you are using

eclipse-temurin:jdk-25-noble

Please add the version of Docker you are running

podman version 5.5.2

What happened?

(Apologies, I haven't dig yet on the possible root cause, just sharing the issue in case other people face it)

The JDK 25 image does not contain curl binary (and likely others) even though it's based on the same image than JDK 21 (Ubuntu Noble).

JDK 25, KO 💥:

$ podman run --rm -it eclipse-temurin:25-jdk-noble bash 
root@40f3f51042d4:/# curl
bash: curl: command not found

JDK 21, OK ✅:

$ podman run --rm -it eclipse-temurin:21-jdk-noble bash
root@ad226aa7a48d:/# curl
curl: try 'curl --help' or 'curl --manual' for more information

Is this expected or maybe an issue in the release process?

[karianna]

This appears to be deliberate it appears that curl was replaced with wget for >= jdk 22 images. I'm not sure as to why yet though.

[gaeljw]

Interesting, I was convinced curl was present in the base Ubuntu image. I'm surprised that it's added by the eclipse-temurin image. By then it makes more sense :)

[gaeljw]

Relates to #255 and #242

[DRoppelt]

it seems reasonable to omit curl. Adding libs that are not necessary for the JVM, and are only for tooling around building, should be reduced. Reducing CVE surface etc.

even wget seems like something that should only be an implementation detail of how the images are build and not end up in the final image. Similar to how the "how to make your own JRE" uses a "FROM ... COPY ..." instead of wget/curl-ing something from outside https://hub.docker.com/_/eclipse-temurin#using-a-different-base-image

# Example
FROM <base image>
ENV JAVA_HOME=/opt/java/openjdk
COPY --from=eclipse-temurin:21 $JAVA_HOME $JAVA_HOME
ENV PATH="${JAVA_HOME}/bin:${PATH}"

On the contray, ubuntu is not really the go-to OS anyways when it is about reducing attack surface

This PR relates to reducing/removing build-only tools, where wget appears to also not be installed with 25 and up anymore #752

[gaeljw]

I'm fine with the decision then.

It was surprising though. I'm not sure if you have some kind of changelog where such changes could be logged in the future?

You can close the ticket anyways if this is an intended change, thanks for clarifications :)