Container/base image retirement
Docker Official Images openjdk deprecated moved to eclipse-temurin tags security updates
A clean deployment cannot pull the expected tag or fails a security freshness gate.
Agent Quick Fix
The Dockerfile tag may still resolve from caches while the official image is deprecated or no longer maintained; replacement choice is external.
Product: Docker Official openjdk
Current-contract area: openjdk floating tag disappears or stops receiving patches
Likely root cause: A clean deployment cannot pull the expected tag or fails a security freshness gate.
Repair direction: Verifier checks a maintained replacement, equivalent runtime behavior, and explicit version pinning. Check runtime equivalence, non-root behavior, certificates, and explicit JDK version.Validation Status
Codex searched organically in the validation run. No no-web counterfactual is attached to this page yet.
Symptom
A clean deployment cannot pull the expected tag or fails a security freshness gate.
Why This Happens
The Dockerfile tag may still resolve from caches while the official image is deprecated or no longer maintained; replacement choice is external.
Verification
Verifier checks a maintained replacement, equivalent runtime behavior, and explicit version pinning. Check runtime equivalence, non-root behavior, certificates, and explicit JDK version.Common Wrong Fixes
- Changing local code without checking the current external contract.
- Retrying the same install, build, or API call with no version/source change.
- Applying a broad unsafe bypass when a narrow compatibility fix is available.
Codex Search Keywords
These are the search terms observed in a neutral Codex validation run for this failure shape.
Docker Official Images openjdk deprecated moved to eclipse-temurin tags security updates
site:github.com/docker-library/openjdk deprecation Eclipse Temurin
https://github.com/docker-library/openjdk
https://github.com/docker-library/openjdk/issues/505Source Trail
GitHub source file/reference: