Getting the jdk path

Image Builds
1

If I got following

dockerfile

FROM quay.io/centos7/openjdk-17-centos7

How do I get the location of the JDK within the dockfile? as I want to update a file in the JDK within the container.

Alternatively, can I specify which location that jdk 17 copy to? or perhaps creating a simlink?

2

Every image maintainer creates an image according their needs and their desired approach.
Without seeing the Dockerfile or seeing the image, it is impossible to know where something is located in the image, as you can’t know whether it’s installed via repository package, or by downloading it and extracting to whatever folder they see fit.

Can you rephrase “Alternatively, can I specify which location that jdk 17 copy to? or perhaps creating a simlink?”. Why would that be relevant? if the binaries of the jdk are accessible from the path, why would you need to know the exact path?

What is your use case (as in the broader picture) ?

3

Well I want to update the securty.java file within the JDK for the container at the point of creating the image with my own version.

This is what I got now

FROM quay.io/centos7/openjdk-17-centos7

COPY ./custom.java.security /etc/java/java-17-openjdk/java-17-openjdk-xxx-xxx.x86_64/conf/security/java.security

But the problem is this part of the path can get change, “java-17-openjdk-xxx-xxx.x86_64”

So what I want a way to updatge the java.security doesnt matter which JDK, I get pulled in.

4

I see, You want to configure the cryptographic settings.
I have no idea how this needs to be handled in this image.

But we can try to learn something about the image:
What environment variables exists? You should find something like JAVA_HOME and maybe JAVA_VERSION:

docker run -ti --rm --entrypoint env quay.io/centos7/openjdk-17-centos7

Then you could check if the file is really at the location you are expecting it:

docker run -ti --rm --entrypoint find quay.io/centos7/openjdk-17-centos7 / -name java.security

Though isn’t this property supposed to allow overriding the defaults?

java -Djava.security.properties==file:/path/to/your/security.policy

I remember that we had to add “Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files” until JDK 8, but starting with Java 9 the stronger cryptographic algorithms are enabled by default.

Note: if this image uses Oracles OpenJDK, please be aware that it is not security patched once it’s made GA. If this comes with the OpenJDK supported by Redhat than you should be fine . If your target environment for container based on this image is AWS, you might want to use the Amazon Corretto. Whenever I require a jre or jdk, I use Eclipse Temurin (unless it’s for AWS workload)