Repository: DataDog/dd-trace-java-docker-build
Pull request #95: Replace cimg base image with ubuntu:latest
Author: login: sarahchen6
Created: 2025-05-13T20:13:40Z | Merged: 2025-05-22T13:38:40Z

With our transition from CircleCI to Gitlab, we want to replace the `cimg` base image with the smaller, faster, safer `ubuntu:24.04` image.


Diff:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b67094f..4d9e3bf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,9 +7,7 @@ on:
     branches:
       - master
   schedule:
-    # Tuesday at 10. One day after the CircleCI scheduled upddate
-    # See: https://github.com/CircleCI-Public/cimg-base/blob/main/.circleci/schedule.json
-    - cron: '0 10 * * 2' 
+    - cron: '0 0 * * 0' 
   workflow_dispatch:
 
 jobs:
diff --git a/Dockerfile b/Dockerfile
index 6a6d8a7..033a790 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,9 +4,47 @@ ARG LATEST_VERSION
 FROM eclipse-temurin:${LATEST_VERSION}-jdk-noble AS temurin-latest
 
 # Intermediate image used to prune cruft from JDKs and squash them all.
-FROM cimg/base:current-22.04 AS all-jdk
+FROM ubuntu:24.04 AS all-jdk
 ARG LATEST_VERSION
 
+RUN <<-EOT
+	set -eux
+	apt-get update
+	apt-get install -y sudo
+	groupadd --gid 1001 non-root-group
+	useradd --uid 1001 --gid non-root-group -m non-root-user
+	echo "non-root-user ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/non-root-user
+	chmod 0440 /etc/sudoers.d/non-root-user
+	mkdir -p /home/non-root-user/.config
+	chown -R non-root-user:non-root-group /home/non-root-user/.config
+	apt-get clean
+	rm -rf /var/lib/apt/lists/*
+EOT
+
+USER non-root-user
+WORKDIR /home/non-root-user
+
+RUN <<-EOT
+	set -eux
+	sudo apt-get update
+	sudo apt-get install -y curl tar apt-transport-https ca-certificates gnupg locales jq git gh yq lsb-release lsof
+	sudo locale-gen en_US.UTF-8
+	sudo git config --system --add safe.directory "*"
+	
+	sudo mkdir -p /tmp/docker-install
+	sudo curl -fsSL "https://download.docker.com/linux/static/stable/$(uname -m)/docker-24.0.7.tgz" | sudo tar -xz -C /tmp/docker-install
+	sudo mv /tmp/docker-install/docker/docker /usr/local/bin/
+	sudo rm -rf /tmp/docker-install
+	sudo mkdir -p /usr/local/lib/docker/cli-plugins
+	sudo curl -fsSL "https://github.com/docker/compose/releases/download/v2.24.6/docker-compose-linux-$(uname -m)" -o /usr/local/lib/docker/cli-plugins/docker-compose
+	sudo chmod +x /usr/local/lib/docker/cli-plugins/docker-compose
+	
+	sudo apt-get clean
+	sudo rm -rf /var/lib/apt/lists/*
+EOT
+
+ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
+
 COPY --from=eclipse-temurin:8-jdk-jammy /opt/java/openjdk /usr/lib/jvm/8
 COPY --from=eclipse-temurin:11-jdk-jammy /opt/java/openjdk /usr/lib/jvm/11
 COPY --from=eclipse-temurin:17-jdk-jammy /opt/java/openjdk /usr/lib/jvm/17
@@ -26,23 +64,26 @@ COPY --from=ibm-semeru-runtimes:open-17-jdk-jammy /opt/java/openjdk /usr/lib/jvm
 COPY --from=ghcr.io/graalvm/native-image-community:17-ol9 /usr/lib64/graalvm/graalvm-community-java17 /usr/lib/jvm/graalvm17
 COPY --from=ghcr.io/graalvm/native-image-community:21-ol9 /usr/lib64/graalvm/graalvm-community-java21 /usr/lib/jvm/graalvm21
 
-RUN sudo apt-get -y update && sudo apt-get -y install curl
 # See: https://gist.github.com/wavezhang/ba8425f24a968ec9b2a8619d7c2d86a6
 RUN <<-EOT
 	set -eux
 	sudo mkdir -p /usr/lib/jvm/oracle8
-	curl -L --fail "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=246284_165374ff4ea84ef0bbd821706e29b123" | sudo tar -xvzf - -C /usr/lib/jvm/oracle8 --strip-components 1
+	sudo curl -L --fail "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=252034_8a1589aa0fe24566b4337beee47c2d29" | sudo tar -xvzf - -C /usr/lib/jvm/oracle8 --strip-components 1
 EOT
 
 # Install Ubuntu's OpenJDK 17 and fix broken symlinks:
 # some files in /usr/lib/jvm/ubuntu17 are symlinks to /etc/java-17-openjdk/, so we just copy all symlinks targets.
 RUN <<-EOT
 	set -eux
-	sudo apt-get install openjdk-17-jdk
+	sudo apt-get update
+	sudo apt-get install -y openjdk-17-jdk
 	sudo mv /usr/lib/jvm/java-17-openjdk-amd64 /usr/lib/jvm/ubuntu17
+	sudo mkdir -p /usr/lib/jvm/ubuntu17/conf/ /usr/lib/jvm/ubuntu17/lib/
 	sudo cp -rf --remove-destination /etc/java-17-openjdk/* /usr/lib/jvm/ubuntu17/conf/
 	sudo cp -rf --remove-destination /etc/java-17-openjdk/* /usr/lib/jvm/ubuntu17/lib/
 	sudo cp -f --remove-destination /etc/java-17-openjdk/jvm-amd64.cfg /usr/lib/jvm/ubuntu17/lib/
+	sudo apt-get clean
+	sudo rm -rf /var/lib/apt/lists/*
 EOT
 
 # Remove cruft from JDKs that is not used in the build process.
@@ -65,28 +106,52 @@ COPY --from=all-jdk /usr/lib/jvm/21 /usr/lib/jvm/21
 COPY --from=all-jdk /usr/lib/jvm/${LATEST_VERSION} /usr/lib/jvm/${LATEST_VERSION}
 
 # Base image with minimum requirements to build the project.
-# Based on CircleCI Base Image with Ubuntu 22.04.3 LTS, present in most runners.
-FROM cimg/base:current-22.04 AS base
+# Based on the latest Ubuntu LTS image.
+FROM ubuntu:24.04 AS base
 ARG LATEST_VERSION
 ENV LATEST_VERSION=${LATEST_VERSION}
 
 # https://docs.github.com/en/packages/learn-github-packages/connecting-a-repository-to-a-package
 LABEL org.opencontainers.image.source=https://github.com/DataDog/dd-trace-java-docker-build
 
-# Replace Docker Compose and yq versions by latest and remove docker-switch from CircleCI Base Image for security purposes.
 RUN <<-EOT
-	set -eu
-	dockerPluginDir=/usr/local/lib/docker/cli-plugins
-	sudo curl -sSL "https://github.com/docker/compose/releases/latest/download/docker-compose-linux-$(uname -m)" -o $dockerPluginDir/docker-compose
-	sudo chmod +x $dockerPluginDir/docker-compose
-	sudo sudo update-alternatives --remove docker-compose /usr/local/bin/compose-switch
-	sudo rm -f /usr/local/bin/compose-switch
-	sudo rm /usr/local/bin/{install-man-page.sh,yq*}
-	curl -sSL "https://github.com/mikefarah/yq/releases/latest/download/yq_linux_$(dpkg --print-architecture).tar.gz" | sudo tar -xz -C /usr/local/bin --wildcards --no-anchored 'yq_linux_*'
-	sudo mv /usr/local/bin/yq{_linux_*,}
-	sudo chown root:root /usr/local/bin/yq
+	set -eux
+	apt-get update
+	apt-get install -y sudo
+	groupadd --gid 1001 non-root-group
+	useradd --uid 1001 --gid non-root-group -m non-root-user
+	echo "non-root-user ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/non-root-user
+	chmod 0440 /etc/sudoers.d/non-root-user
+	mkdir -p /home/non-root-user/.config
+	chown -R non-root-user:non-root-group /home/non-root-user/.config
+	apt-get clean
+	rm -rf /var/lib/apt/lists/*
 EOT
 
+USER non-root-user
+WORKDIR /home/non-root-user
+
+RUN <<-EOT
+	set -eux
+	sudo apt-get update
+	sudo apt-get install -y curl tar apt-transport-https ca-certificates gnupg socat less debian-goodies autossh ca-certificates-java python3-pip locales jq git gh yq lsb-release lsof
+	sudo locale-gen en_US.UTF-8
+	sudo git config --system --add safe.directory "*"
+	
+	sudo mkdir -p /tmp/docker-install
+	sudo curl -fsSL "https://download.docker.com/linux/static/stable/$(uname -m)/docker-24.0.7.tgz" | sudo tar -xz -C /tmp/docker-install
+	sudo mv /tmp/docker-install/docker/docker /usr/local/bin/
+	sudo rm -rf /tmp/docker-install
+	sudo mkdir -p /usr/local/lib/docker/cli-plugins
+	sudo curl -fsSL "https://github.com/docker/compose/releases/download/v2.24.6/docker-compose-linux-$(uname -m)" -o /usr/local/lib/docker/cli-plugins/docker-compose
+	sudo chmod +x /usr/local/lib/docker/cli-plugins/docker-compose
+	
+	sudo apt-get clean
+	sudo rm -rf /var/lib/apt/lists/*
+EOT
+
+ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
+
 COPY --from=default-jdk /usr/lib/jvm /usr/lib/jvm
 
 COPY autoforward.py /usr/local/bin/autoforward
@@ -98,19 +163,13 @@ COPY autoforward.py /usr/local/bin/autoforward
 RUN <<-EOT
 	set -eux
 	sudo apt-get update
-	sudo apt-get install --no-install-recommends apt-transport-https socat
-	sudo apt-get install --no-install-recommends vim less debian-goodies
-	sudo apt-get install --no-install-recommends autossh
-	sudo apt-get install ca-certificates-java
-	sudo apt install python3-pip
-	sudo apt-get -y clean
-	sudo rm -rf /var/lib/apt/lists/*
-	pip3 install awscli
-	pip3 install requests requests-unixsocket2
-	pip3 cache purge
+	sudo pip3 install --break-system-packages awscli requests requests-unixsocket2
+	sudo pip3 cache purge
 	sudo chmod +x /usr/local/bin/autoforward
 	sudo curl -L --fail "https://github.com/DataDog/datadog-ci/releases/latest/download/datadog-ci_linux-x64" --output "/usr/local/bin/datadog-ci"
 	sudo chmod +x /usr/local/bin/datadog-ci
+	sudo apt-get clean
+	sudo rm -rf /var/lib/apt/lists/*
 EOT
 
 # IBM specific env variables
@@ -134,6 +193,9 @@ FROM base AS variant
 ARG VARIANT_LOWER
 ARG VARIANT_UPPER
 
+USER non-root-user
+WORKDIR /home/non-root-user
+
 COPY --from=all-jdk /usr/lib/jvm/${VARIANT_LOWER} /usr/lib/jvm/${VARIANT_LOWER}
 ENV JAVA_${VARIANT_UPPER}_HOME=/usr/lib/jvm/${VARIANT_LOWER}
 ENV JAVA_${VARIANT_LOWER}_HOME=/usr/lib/jvm/${VARIANT_LOWER}
@@ -141,6 +203,9 @@ ENV JAVA_${VARIANT_LOWER}_HOME=/usr/lib/jvm/${VARIANT_LOWER}
 # Full image for debugging, contains all JDKs.
 FROM base AS full
 
+USER non-root-user
+WORKDIR /home/non-root-user
+
 COPY --from=all-jdk /usr/lib/jvm/7 /usr/lib/jvm/7
 COPY --from=all-jdk /usr/lib/jvm/zulu8 /usr/lib/jvm/zulu8
 COPY --from=all-jdk /usr/lib/jvm/zulu11 /usr/lib/jvm/zulu11


Reviews:
user: login: sarahchen6
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-14T16:53:40Z
user: login: sarahchen6
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-14T17:05:39Z
user: login: delner
body: General Docker changes look good to me. Not sure how to answer the question about `pip` and `--break-system-packages`.
state: APPROVED
author_association: NONE
submitted_at: 2025-05-14T17:36:25Z
user: login: bric3
body: I believe the built image is missing a few tools used in the scripts here and there in dd-trace-java.

Got a few questions / remarks though, that may be addressed later.

1. I noticed the versioning is based on year + month

   https://github.com/DataDog/dd-trace-java-docker-build/blob/3c26d22370f4aec3c72a674677213a62e223bc9d/build#L212-L212

   Since this is like a major change shall we label this differently? That said this could affect other part of the build pipelines.

2. Circle CI image appear to use the `circleci` user, this requires commands to be run as sudo. Should we reproduce this behavior?
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-14T21:33:48Z
user: login: sarahchen6
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-14T22:04:07Z
user: login: sarahchen6
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-15T01:32:27Z
user: login: PerfectSlayer
body: Looking good. 

Few comments about cleaning it up further:
* Is the `yq`, `docker` and `docker-compose` still needed? I used to install them manually to override the outdated version from the CircleCI image but I don't know if they are used.
* Similarly I don't know if autoforward is still used 🤷 
* And I ask to @smola what `ubuntu17` is for and if it is still relevant

Do you know how to test the image from your PR in the CI to test it? 
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-16T09:30:39Z
user: login: sarahchen6
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-16T13:42:59Z
user: login: sarahchen6
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-16T13:53:24Z
user: login: sarahchen6
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-16T13:54:21Z
user: login: bric3
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-16T15:24:00Z
user: login: bric3
body: For the tags, it's just that the current image inherit `cimg`, while this PR changes it to ubuntu, I pondered on making the change of the _base image_ more visible via tags.
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-16T16:03:32Z
user: login: sarahchen6
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-16T18:08:46Z

Review comments:
diff_hunk: @@ -21,28 +21,34 @@ COPY --from=ibm-semeru-runtimes:open-17-jdk-jammy /opt/java/openjdk /usr/lib/jvm
 COPY --from=ghcr.io/graalvm/native-image-community:17-ol9 /usr/lib64/graalvm/graalvm-community-java17 /usr/lib/jvm/graalvm17
 COPY --from=ghcr.io/graalvm/native-image-community:21-ol9 /usr/lib64/graalvm/graalvm-community-java21 /usr/lib/jvm/graalvm21
 
-RUN sudo apt-get -y update && sudo apt-get -y install curl
+RUN apt-get update && \
+    apt-get install -y curl tar apt-transport-https ca-certificates gnupg wget && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
path: Dockerfile
user: login: sarahchen6
body: I added `apt-get clean && \ rm -rf /var/lib/apt/lists/*` here and in other places of the file to help [minimize container image size](https://opensource.com/article/20/5/optimize-container-builds)..?
created_at: 2025-05-14T16:53:40Z
author_association: CONTRIBUTOR
diff_hunk: @@ -88,20 +99,14 @@ COPY autoforward.py /usr/local/bin/autoforward
 # - datadog-ci: Datadog CI tool
 RUN <<-EOT
 	set -eux
-	sudo apt-get update
-	sudo apt-get install --no-install-recommends apt-transport-https socat
-	sudo apt-get install --no-install-recommends vim less debian-goodies
-	sudo apt-get install --no-install-recommends autossh
-	sudo apt-get install ca-certificates-java
-	sudo apt install python3-pip
-	sudo apt-get -y clean
-	sudo rm -rf /var/lib/apt/lists/*
-	pip3 install awscli
-	pip3 install requests requests-unixsocket2
+	apt-get update
+	pip3 install --break-system-packages awscli requests requests-unixsocket2
path: Dockerfile
user: login: sarahchen6
body: used `--break-system-packages` to avoid issues with installing packages alongside the system's ([blog ref](https://veronneau.org/python-311-pip-and-breaking-system-packages.html))
created_at: 2025-05-14T17:05:38Z
author_association: CONTRIBUTOR
diff_hunk: @@ -21,28 +21,34 @@ COPY --from=ibm-semeru-runtimes:open-17-jdk-jammy /opt/java/openjdk /usr/lib/jvm
 COPY --from=ghcr.io/graalvm/native-image-community:17-ol9 /usr/lib64/graalvm/graalvm-community-java17 /usr/lib/jvm/graalvm17
 COPY --from=ghcr.io/graalvm/native-image-community:21-ol9 /usr/lib64/graalvm/graalvm-community-java21 /usr/lib/jvm/graalvm21
 
-RUN sudo apt-get -y update && sudo apt-get -y install curl
+RUN apt-get update && \
+    apt-get install -y curl tar apt-transport-https ca-certificates gnupg wget && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
path: Dockerfile
user: login: delner
body: Yes, cleaning this up in the same `RUN` should help minimize image size by reducing size of the individual steps.
created_at: 2025-05-14T17:33:22Z
author_association: NONE
diff_hunk: @@ -21,28 +21,34 @@ COPY --from=ibm-semeru-runtimes:open-17-jdk-jammy /opt/java/openjdk /usr/lib/jvm
 COPY --from=ghcr.io/graalvm/native-image-community:17-ol9 /usr/lib64/graalvm/graalvm-community-java17 /usr/lib/jvm/graalvm17
 COPY --from=ghcr.io/graalvm/native-image-community:21-ol9 /usr/lib64/graalvm/graalvm-community-java21 /usr/lib/jvm/graalvm21
 
-RUN sudo apt-get -y update && sudo apt-get -y install curl
+RUN apt-get update && \
+    apt-get install -y curl tar apt-transport-https ca-certificates gnupg wget && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
path: Dockerfile
user: login: bric3
body: **nitpick**: While we're at it we could use the same heredoc formalism for this `run` step now that it's multiline.

```
RUN <<-EOT
	:
EOT
```
created_at: 2025-05-14T19:50:04Z
author_association: CONTRIBUTOR
diff_hunk: @@ -21,28 +21,34 @@ COPY --from=ibm-semeru-runtimes:open-17-jdk-jammy /opt/java/openjdk /usr/lib/jvm
 COPY --from=ghcr.io/graalvm/native-image-community:17-ol9 /usr/lib64/graalvm/graalvm-community-java17 /usr/lib/jvm/graalvm17
 COPY --from=ghcr.io/graalvm/native-image-community:21-ol9 /usr/lib64/graalvm/graalvm-community-java21 /usr/lib/jvm/graalvm21
 
-RUN sudo apt-get -y update && sudo apt-get -y install curl
+RUN apt-get update && \
+    apt-get install -y curl tar apt-transport-https ca-certificates gnupg && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
+
 # See: https://gist.github.com/wavezhang/ba8425f24a968ec9b2a8619d7c2d86a6
 RUN <<-EOT
 	set -eux
-	sudo mkdir -p /usr/lib/jvm/oracle8
-	curl -L --fail "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=246284_165374ff4ea84ef0bbd821706e29b123" | sudo tar -xvzf - -C /usr/lib/jvm/oracle8 --strip-components 1
+	mkdir -p /usr/lib/jvm/oracle8
+	curl -L --fail "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=246284_165374ff4ea84ef0bbd821706e29b123" | tar -xvzf - -C /usr/lib/jvm/oracle8 --strip-components 1
path: Dockerfile
user: login: bric3
body: **question:** This seems to download 1.8.0_u331, I wonder if this update version is necessary or if we should update to something more recent.

```
/oracle8/bin/java -version
java version "1.8.0_331"
Java(TM) SE Runtime Environment (build 1.8.0_331-b09)
Java HotSpot(TM) 64-Bit Server VM (build 25.331-b09, mixed mode)
```

Gitlab runner is probably not concerned, but cgroupv2 landed in update 372 for OpenJDK8.

For u451, this seems to be right link (see [this](https://gist.github.com/wavezhang/ba8425f24a968ec9b2a8619d7c2d86a6?permalink_comment_id=5575184#gistcomment-5575184))

```suggestion
	curl -L --fail "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=252034_8a1589aa0fe24566b4337beee47c2d29" | tar -xvzf - -C /usr/lib/jvm/oracle8 --strip-components 1
```
created_at: 2025-05-14T20:19:10Z
author_association: CONTRIBUTOR
diff_hunk: @@ -59,23 +65,30 @@ COPY --from=all-jdk /usr/lib/jvm/21 /usr/lib/jvm/21
 
 # Base image with minimunm requirenents to build the project.
 # Based on CircleCI Base Image with Ubuntu 22.04.3 LTS, present in most runners.
-FROM cimg/base:current-22.04 AS base
+FROM ubuntu:24.04 AS base
 
 # https://docs.github.com/en/packages/learn-github-packages/connecting-a-repository-to-a-package
 LABEL org.opencontainers.image.source=https://github.com/DataDog/dd-trace-java-docker-build
 
-# Replace Docker Compose and yq versions by latest and remove docker-switch from CircleCI Base Image for security purposes
+RUN apt-get update && \
+    apt-get install -y curl tar apt-transport-https ca-certificates gnupg \
+    socat less debian-goodies autossh ca-certificates-java python3-pip && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    mkdir -p /usr/local/lib/docker/cli-plugins /usr/local/bin
path: Dockerfile
user: login: bric3
body: **nitpick:** use heredoc style
created_at: 2025-05-14T21:23:30Z
author_association: CONTRIBUTOR
diff_hunk: @@ -59,23 +65,30 @@ COPY --from=all-jdk /usr/lib/jvm/21 /usr/lib/jvm/21
 
 # Base image with minimunm requirenents to build the project.
 # Based on CircleCI Base Image with Ubuntu 22.04.3 LTS, present in most runners.
-FROM cimg/base:current-22.04 AS base
+FROM ubuntu:24.04 AS base
 
 # https://docs.github.com/en/packages/learn-github-packages/connecting-a-repository-to-a-package
 LABEL org.opencontainers.image.source=https://github.com/DataDog/dd-trace-java-docker-build
 
-# Replace Docker Compose and yq versions by latest and remove docker-switch from CircleCI Base Image for security purposes
+RUN apt-get update && \
+    apt-get install -y curl tar apt-transport-https ca-certificates gnupg \
+    socat less debian-goodies autossh ca-certificates-java python3-pip && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    mkdir -p /usr/local/lib/docker/cli-plugins /usr/local/bin
path: Dockerfile
user: login: bric3
body: I **believe** this is not enough, we'll miss other executables such as `jq`, `yq`, `git`, `gh` (the github cli), `docker` among others.

Another thing that may bites us is the _locale_ environment variables, we may want to have `LANG=en_US.UTF-8`, `LC_ALL=en_US.UTF-8` (likely doable via this `apt-get install -y locales && locale-gen en_US.UTF-8` and setting the envs `ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'`.
created_at: 2025-05-14T21:25:45Z
author_association: CONTRIBUTOR
diff_hunk: @@ -21,28 +21,34 @@ COPY --from=ibm-semeru-runtimes:open-17-jdk-jammy /opt/java/openjdk /usr/lib/jvm
 COPY --from=ghcr.io/graalvm/native-image-community:17-ol9 /usr/lib64/graalvm/graalvm-community-java17 /usr/lib/jvm/graalvm17
 COPY --from=ghcr.io/graalvm/native-image-community:21-ol9 /usr/lib64/graalvm/graalvm-community-java21 /usr/lib/jvm/graalvm21
 
-RUN sudo apt-get -y update && sudo apt-get -y install curl
+RUN apt-get update && \
+    apt-get install -y curl tar apt-transport-https ca-certificates gnupg && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
+
 # See: https://gist.github.com/wavezhang/ba8425f24a968ec9b2a8619d7c2d86a6
 RUN <<-EOT
 	set -eux
-	sudo mkdir -p /usr/lib/jvm/oracle8
-	curl -L --fail "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=246284_165374ff4ea84ef0bbd821706e29b123" | sudo tar -xvzf - -C /usr/lib/jvm/oracle8 --strip-components 1
+	mkdir -p /usr/lib/jvm/oracle8
+	curl -L --fail "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=246284_165374ff4ea84ef0bbd821706e29b123" | tar -xvzf - -C /usr/lib/jvm/oracle8 --strip-components 1
path: Dockerfile
user: login: sarahchen6
body: Oh cool I see that 8u451 is the latest update of JDK 8 and the link works locally - I get the following when I run `./build` and then `./build --describe`, so I'll go ahead and commit this :)

```
* JAVA_ORACLE8_HOME
java version "1.8.0_451"
Java(TM) SE Runtime Environment (build 1.8.0_451-b10)
Java HotSpot(TM) 64-Bit Server VM (build 25.451-b10, mixed mode)

* JAVA_IBM8_HOME
java version "1.8.0_451"
Java(TM) SE Runtime Environment (build 8.0.8.45 - pxa6480sr8fp45-20250422_01(SR8 FP45))
IBM J9 VM (build 2.9, JRE 1.8.0 Linux amd64-64-Bit Compressed References 20250328_91206 (JIT enabled, AOT enabled)
OpenJ9   - d74d0188283
OMR      - f1d2dd63d
IBM      - 8a61f98)
JCL - 20250411_01 based on Oracle jdk8u451-b10
```
created_at: 2025-05-14T22:04:07Z
author_association: CONTRIBUTOR
diff_hunk: @@ -59,23 +65,30 @@ COPY --from=all-jdk /usr/lib/jvm/21 /usr/lib/jvm/21
 
 # Base image with minimunm requirenents to build the project.
 # Based on CircleCI Base Image with Ubuntu 22.04.3 LTS, present in most runners.
-FROM cimg/base:current-22.04 AS base
+FROM ubuntu:24.04 AS base
 
 # https://docs.github.com/en/packages/learn-github-packages/connecting-a-repository-to-a-package
 LABEL org.opencontainers.image.source=https://github.com/DataDog/dd-trace-java-docker-build
 
-# Replace Docker Compose and yq versions by latest and remove docker-switch from CircleCI Base Image for security purposes
+RUN apt-get update && \
+    apt-get install -y curl tar apt-transport-https ca-certificates gnupg \
+    socat less debian-goodies autossh ca-certificates-java python3-pip && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    mkdir -p /usr/local/lib/docker/cli-plugins /usr/local/bin
path: Dockerfile
user: login: sarahchen6
body: Added `locale` environment variables! How could we get a comprehensive list of all of the executables we'd need to add? By parsing through `dd-trace-java`..? 😅
created_at: 2025-05-15T01:32:27Z
author_association: CONTRIBUTOR
diff_hunk: @@ -21,35 +21,52 @@ COPY --from=ibm-semeru-runtimes:open-17-jdk-jammy /opt/java/openjdk /usr/lib/jvm
 COPY --from=ghcr.io/graalvm/native-image-community:17-ol9 /usr/lib64/graalvm/graalvm-community-java17 /usr/lib/jvm/graalvm17
 COPY --from=ghcr.io/graalvm/native-image-community:21-ol9 /usr/lib64/graalvm/graalvm-community-java21 /usr/lib/jvm/graalvm21
 
-RUN sudo apt-get -y update && sudo apt-get -y install curl
+RUN <<-EOT
+	set -eux
+	apt-get update
+	apt-get install -y curl tar apt-transport-https ca-certificates gnupg locales
+	locale-gen en_US.UTF-8
+	groupadd --gid 1001 non-root-user
+	useradd --uid 1001 --gid 1001 -m non-root-user
+	apt-get clean
+	rm -rf /var/lib/apt/lists/*
+EOT
+
+ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
+
 # See: https://gist.github.com/wavezhang/ba8425f24a968ec9b2a8619d7c2d86a6
 RUN <<-EOT
 	set -eux
-	sudo mkdir -p /usr/lib/jvm/oracle8
-	curl -L --fail "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=246284_165374ff4ea84ef0bbd821706e29b123" | sudo tar -xvzf - -C /usr/lib/jvm/oracle8 --strip-components 1
+	mkdir -p /usr/lib/jvm/oracle8
+	curl -L --fail "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=252034_8a1589aa0fe24566b4337beee47c2d29" | tar -xvzf - -C /usr/lib/jvm/oracle8 --strip-components 1
path: Dockerfile
user: login: PerfectSlayer
body: Damned, good catch! We should find a way to get it updated automatically. Any thought?
(this is out of scope for this PR)
created_at: 2025-05-16T09:16:33Z
author_association: CONTRIBUTOR
diff_hunk: @@ -21,35 +21,52 @@ COPY --from=ibm-semeru-runtimes:open-17-jdk-jammy /opt/java/openjdk /usr/lib/jvm
 COPY --from=ghcr.io/graalvm/native-image-community:17-ol9 /usr/lib64/graalvm/graalvm-community-java17 /usr/lib/jvm/graalvm17
 COPY --from=ghcr.io/graalvm/native-image-community:21-ol9 /usr/lib64/graalvm/graalvm-community-java21 /usr/lib/jvm/graalvm21
 
-RUN sudo apt-get -y update && sudo apt-get -y install curl
+RUN <<-EOT
+	set -eux
+	apt-get update
+	apt-get install -y curl tar apt-transport-https ca-certificates gnupg locales
+	locale-gen en_US.UTF-8
+	groupadd --gid 1001 non-root-user
+	useradd --uid 1001 --gid 1001 -m non-root-user
+	apt-get clean
+	rm -rf /var/lib/apt/lists/*
+EOT
+
+ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
+
 # See: https://gist.github.com/wavezhang/ba8425f24a968ec9b2a8619d7c2d86a6
 RUN <<-EOT
 	set -eux
-	sudo mkdir -p /usr/lib/jvm/oracle8
-	curl -L --fail "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=246284_165374ff4ea84ef0bbd821706e29b123" | sudo tar -xvzf - -C /usr/lib/jvm/oracle8 --strip-components 1
+	mkdir -p /usr/lib/jvm/oracle8
+	curl -L --fail "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=252034_8a1589aa0fe24566b4337beee47c2d29" | tar -xvzf - -C /usr/lib/jvm/oracle8 --strip-components 1
 EOT
 
 # Install Ubuntu's OpenJDK 17 and fix broken symlinks:
 # some files in /usr/lib/jvm/ubuntu17 are symlinks to /etc/java-17-openjdk/, so we just copy all symlinks targets.
 RUN <<-EOT
 	set -eux
-	sudo apt-get install openjdk-17-jdk
-	sudo mv /usr/lib/jvm/java-17-openjdk-amd64 /usr/lib/jvm/ubuntu17
-	sudo cp -rf --remove-destination /etc/java-17-openjdk/* /usr/lib/jvm/ubuntu17/conf/
-	sudo cp -rf --remove-destination /etc/java-17-openjdk/* /usr/lib/jvm/ubuntu17/lib/
-	sudo cp -f --remove-destination /etc/java-17-openjdk/jvm-amd64.cfg /usr/lib/jvm/ubuntu17/lib/
+	apt-get update
path: Dockerfile
user: login: PerfectSlayer
body: Why are you running update again? (after update and clean on l. 26 / l. 31)
created_at: 2025-05-16T09:19:06Z
author_association: CONTRIBUTOR
diff_hunk: @@ -21,35 +21,52 @@ COPY --from=ibm-semeru-runtimes:open-17-jdk-jammy /opt/java/openjdk /usr/lib/jvm
 COPY --from=ghcr.io/graalvm/native-image-community:17-ol9 /usr/lib64/graalvm/graalvm-community-java17 /usr/lib/jvm/graalvm17
 COPY --from=ghcr.io/graalvm/native-image-community:21-ol9 /usr/lib64/graalvm/graalvm-community-java21 /usr/lib/jvm/graalvm21
 
-RUN sudo apt-get -y update && sudo apt-get -y install curl
+RUN <<-EOT
+	set -eux
+	apt-get update
+	apt-get install -y curl tar apt-transport-https ca-certificates gnupg locales
+	locale-gen en_US.UTF-8
+	groupadd --gid 1001 non-root-user
+	useradd --uid 1001 --gid 1001 -m non-root-user
+	apt-get clean
+	rm -rf /var/lib/apt/lists/*
+EOT
+
+ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
+
 # See: https://gist.github.com/wavezhang/ba8425f24a968ec9b2a8619d7c2d86a6
 RUN <<-EOT
 	set -eux
-	sudo mkdir -p /usr/lib/jvm/oracle8
-	curl -L --fail "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=246284_165374ff4ea84ef0bbd821706e29b123" | sudo tar -xvzf - -C /usr/lib/jvm/oracle8 --strip-components 1
+	mkdir -p /usr/lib/jvm/oracle8
+	curl -L --fail "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=252034_8a1589aa0fe24566b4337beee47c2d29" | tar -xvzf - -C /usr/lib/jvm/oracle8 --strip-components 1
 EOT
 
 # Install Ubuntu's OpenJDK 17 and fix broken symlinks:
 # some files in /usr/lib/jvm/ubuntu17 are symlinks to /etc/java-17-openjdk/, so we just copy all symlinks targets.
 RUN <<-EOT
 	set -eux
-	sudo apt-get install openjdk-17-jdk
-	sudo mv /usr/lib/jvm/java-17-openjdk-amd64 /usr/lib/jvm/ubuntu17
-	sudo cp -rf --remove-destination /etc/java-17-openjdk/* /usr/lib/jvm/ubuntu17/conf/
-	sudo cp -rf --remove-destination /etc/java-17-openjdk/* /usr/lib/jvm/ubuntu17/lib/
-	sudo cp -f --remove-destination /etc/java-17-openjdk/jvm-amd64.cfg /usr/lib/jvm/ubuntu17/lib/
+	apt-get update
+	apt-get install -y openjdk-17-jdk
path: Dockerfile
user: login: PerfectSlayer
body: @smola Do you remember why we added the `ubuntu17` variant in the first place in #56 ?
Is there some difference with Temurin / OpenJDK 17?
created_at: 2025-05-16T09:24:31Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1.6
 
 # Intermediate image used to prune cruft from JDKs and squash them all.
-FROM cimg/base:current-22.04 AS all-jdk
+FROM ubuntu:24.04 AS all-jdk
path: Dockerfile
user: login: PerfectSlayer
body: Should we use `ubuntu:latest` instead of a pinned version to decrease maintenance?
(`latest` would be the latest LTS, while `rolling` being the last Ubuntu available but better stick to LTS 😉 )
created_at: 2025-05-16T09:26:08Z
author_association: CONTRIBUTOR
diff_hunk: @@ -88,20 +99,14 @@ COPY autoforward.py /usr/local/bin/autoforward
 # - datadog-ci: Datadog CI tool
 RUN <<-EOT
 	set -eux
-	sudo apt-get update
-	sudo apt-get install --no-install-recommends apt-transport-https socat
-	sudo apt-get install --no-install-recommends vim less debian-goodies
-	sudo apt-get install --no-install-recommends autossh
-	sudo apt-get install ca-certificates-java
-	sudo apt install python3-pip
-	sudo apt-get -y clean
-	sudo rm -rf /var/lib/apt/lists/*
-	pip3 install awscli
-	pip3 install requests requests-unixsocket2
+	apt-get update
+	pip3 install --break-system-packages awscli requests requests-unixsocket2
path: Dockerfile
user: login: PerfectSlayer
body: Interesting! Wasn't aware of this param :) 
created_at: 2025-05-16T09:26:33Z
author_association: CONTRIBUTOR
diff_hunk: @@ -21,35 +21,52 @@ COPY --from=ibm-semeru-runtimes:open-17-jdk-jammy /opt/java/openjdk /usr/lib/jvm
 COPY --from=ghcr.io/graalvm/native-image-community:17-ol9 /usr/lib64/graalvm/graalvm-community-java17 /usr/lib/jvm/graalvm17
 COPY --from=ghcr.io/graalvm/native-image-community:21-ol9 /usr/lib64/graalvm/graalvm-community-java21 /usr/lib/jvm/graalvm21
 
-RUN sudo apt-get -y update && sudo apt-get -y install curl
+RUN <<-EOT
+	set -eux
+	apt-get update
+	apt-get install -y curl tar apt-transport-https ca-certificates gnupg locales
+	locale-gen en_US.UTF-8
+	groupadd --gid 1001 non-root-user
+	useradd --uid 1001 --gid 1001 -m non-root-user
+	apt-get clean
+	rm -rf /var/lib/apt/lists/*
+EOT
+
+ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
+
 # See: https://gist.github.com/wavezhang/ba8425f24a968ec9b2a8619d7c2d86a6
 RUN <<-EOT
 	set -eux
-	sudo mkdir -p /usr/lib/jvm/oracle8
-	curl -L --fail "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=246284_165374ff4ea84ef0bbd821706e29b123" | sudo tar -xvzf - -C /usr/lib/jvm/oracle8 --strip-components 1
+	mkdir -p /usr/lib/jvm/oracle8
+	curl -L --fail "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=252034_8a1589aa0fe24566b4337beee47c2d29" | tar -xvzf - -C /usr/lib/jvm/oracle8 --strip-components 1
path: Dockerfile
user: login: sarahchen6
body: Yeah thanks to @bric3 for pointing this out! Good idea - I can look into ways to automate this in a follow-up PR.
created_at: 2025-05-16T13:42:59Z
author_association: CONTRIBUTOR
diff_hunk: @@ -21,35 +21,52 @@ COPY --from=ibm-semeru-runtimes:open-17-jdk-jammy /opt/java/openjdk /usr/lib/jvm
 COPY --from=ghcr.io/graalvm/native-image-community:17-ol9 /usr/lib64/graalvm/graalvm-community-java17 /usr/lib/jvm/graalvm17
 COPY --from=ghcr.io/graalvm/native-image-community:21-ol9 /usr/lib64/graalvm/graalvm-community-java21 /usr/lib/jvm/graalvm21
 
-RUN sudo apt-get -y update && sudo apt-get -y install curl
+RUN <<-EOT
+	set -eux
+	apt-get update
+	apt-get install -y curl tar apt-transport-https ca-certificates gnupg locales
+	locale-gen en_US.UTF-8
+	groupadd --gid 1001 non-root-user
+	useradd --uid 1001 --gid 1001 -m non-root-user
+	apt-get clean
+	rm -rf /var/lib/apt/lists/*
+EOT
+
+ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
+
 # See: https://gist.github.com/wavezhang/ba8425f24a968ec9b2a8619d7c2d86a6
 RUN <<-EOT
 	set -eux
-	sudo mkdir -p /usr/lib/jvm/oracle8
-	curl -L --fail "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=246284_165374ff4ea84ef0bbd821706e29b123" | sudo tar -xvzf - -C /usr/lib/jvm/oracle8 --strip-components 1
+	mkdir -p /usr/lib/jvm/oracle8
+	curl -L --fail "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=252034_8a1589aa0fe24566b4337beee47c2d29" | tar -xvzf - -C /usr/lib/jvm/oracle8 --strip-components 1
 EOT
 
 # Install Ubuntu's OpenJDK 17 and fix broken symlinks:
 # some files in /usr/lib/jvm/ubuntu17 are symlinks to /etc/java-17-openjdk/, so we just copy all symlinks targets.
 RUN <<-EOT
 	set -eux
-	sudo apt-get install openjdk-17-jdk
-	sudo mv /usr/lib/jvm/java-17-openjdk-amd64 /usr/lib/jvm/ubuntu17
-	sudo cp -rf --remove-destination /etc/java-17-openjdk/* /usr/lib/jvm/ubuntu17/conf/
-	sudo cp -rf --remove-destination /etc/java-17-openjdk/* /usr/lib/jvm/ubuntu17/lib/
-	sudo cp -f --remove-destination /etc/java-17-openjdk/jvm-amd64.cfg /usr/lib/jvm/ubuntu17/lib/
+	apt-get update
path: Dockerfile
user: login: sarahchen6
body: Short answer is that I couldn't successfully install the following line without it 😅. I think it's because each `RUN` command creates a new layer, and I need to call `apt-get update` to refresh this layer's packages from the previous layer's installation.

created_at: 2025-05-16T13:53:24Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1.6
 
 # Intermediate image used to prune cruft from JDKs and squash them all.
-FROM cimg/base:current-22.04 AS all-jdk
+FROM ubuntu:24.04 AS all-jdk
path: Dockerfile
user: login: sarahchen6
body: Yes!
created_at: 2025-05-16T13:54:20Z
author_association: CONTRIBUTOR
diff_hunk: @@ -59,23 +65,30 @@ COPY --from=all-jdk /usr/lib/jvm/21 /usr/lib/jvm/21
 
 # Base image with minimunm requirenents to build the project.
 # Based on CircleCI Base Image with Ubuntu 22.04.3 LTS, present in most runners.
-FROM cimg/base:current-22.04 AS base
+FROM ubuntu:24.04 AS base
 
 # https://docs.github.com/en/packages/learn-github-packages/connecting-a-repository-to-a-package
 LABEL org.opencontainers.image.source=https://github.com/DataDog/dd-trace-java-docker-build
 
-# Replace Docker Compose and yq versions by latest and remove docker-switch from CircleCI Base Image for security purposes
+RUN apt-get update && \
+    apt-get install -y curl tar apt-transport-https ca-certificates gnupg \
+    socat less debian-goodies autossh ca-certificates-java python3-pip && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    mkdir -p /usr/local/lib/docker/cli-plugins /usr/local/bin
path: Dockerfile
user: login: bric3
body: Yeah I guess, or maybe dive into the `cimg` layer.

You can do so using `dive` or IntelliJ IDEA docker support.
created_at: 2025-05-16T15:24:00Z
author_association: CONTRIBUTOR
diff_hunk: @@ -21,35 +21,52 @@ COPY --from=ibm-semeru-runtimes:open-17-jdk-jammy /opt/java/openjdk /usr/lib/jvm
 COPY --from=ghcr.io/graalvm/native-image-community:17-ol9 /usr/lib64/graalvm/graalvm-community-java17 /usr/lib/jvm/graalvm17
 COPY --from=ghcr.io/graalvm/native-image-community:21-ol9 /usr/lib64/graalvm/graalvm-community-java21 /usr/lib/jvm/graalvm21
 
-RUN sudo apt-get -y update && sudo apt-get -y install curl
+RUN <<-EOT
+	set -eux
+	apt-get update
+	apt-get install -y curl tar apt-transport-https ca-certificates gnupg locales
+	locale-gen en_US.UTF-8
+	groupadd --gid 1001 non-root-user
+	useradd --uid 1001 --gid 1001 -m non-root-user
+	apt-get clean
+	rm -rf /var/lib/apt/lists/*
+EOT
+
+ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
+
 # See: https://gist.github.com/wavezhang/ba8425f24a968ec9b2a8619d7c2d86a6
 RUN <<-EOT
 	set -eux
-	sudo mkdir -p /usr/lib/jvm/oracle8
-	curl -L --fail "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=246284_165374ff4ea84ef0bbd821706e29b123" | sudo tar -xvzf - -C /usr/lib/jvm/oracle8 --strip-components 1
+	mkdir -p /usr/lib/jvm/oracle8
+	curl -L --fail "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=252034_8a1589aa0fe24566b4337beee47c2d29" | tar -xvzf - -C /usr/lib/jvm/oracle8 --strip-components 1
 EOT
 
 # Install Ubuntu's OpenJDK 17 and fix broken symlinks:
 # some files in /usr/lib/jvm/ubuntu17 are symlinks to /etc/java-17-openjdk/, so we just copy all symlinks targets.
 RUN <<-EOT
 	set -eux
-	sudo apt-get install openjdk-17-jdk
-	sudo mv /usr/lib/jvm/java-17-openjdk-amd64 /usr/lib/jvm/ubuntu17
-	sudo cp -rf --remove-destination /etc/java-17-openjdk/* /usr/lib/jvm/ubuntu17/conf/
-	sudo cp -rf --remove-destination /etc/java-17-openjdk/* /usr/lib/jvm/ubuntu17/lib/
-	sudo cp -f --remove-destination /etc/java-17-openjdk/jvm-amd64.cfg /usr/lib/jvm/ubuntu17/lib/
+	apt-get update
path: Dockerfile
user: login: bric3
body: Yes, and not cleaning the previous layer, will make this layer heavier, so every layer pull will carry the weight. 

In short updating and cleaning is the way. 	

I believe that `apt-get clean && rm -rf /var/lib/apt/lists/*` is missing in this RUN ;)
created_at: 2025-05-16T15:29:18Z
author_association: CONTRIBUTOR
diff_hunk: @@ -143,6 +175,9 @@ COPY --from=all-jdk /usr/lib/jvm/ubuntu17 /usr/lib/jvm/ubuntu17
 COPY --from=all-jdk /usr/lib/jvm/graalvm17 /usr/lib/jvm/graalvm17
 COPY --from=all-jdk /usr/lib/jvm/graalvm21 /usr/lib/jvm/graalvm21
 
+# Switch to non-root user during runtime for security
+USER non-root-user
path: Dockerfile
user: login: bric3
body: **suggestion:** Do we want a `workdir` in these images as well ?

E.g. the `non-root-user`'s home, that can be created via `--create-home` in the `useradd` above commands
created_at: 2025-05-16T15:35:14Z
author_association: CONTRIBUTOR
diff_hunk: @@ -58,24 +75,39 @@ COPY --from=all-jdk /usr/lib/jvm/17 /usr/lib/jvm/17
 COPY --from=all-jdk /usr/lib/jvm/21 /usr/lib/jvm/21
 
 # Base image with minimunm requirenents to build the project.
-# Based on CircleCI Base Image with Ubuntu 22.04.3 LTS, present in most runners.
-FROM cimg/base:current-22.04 AS base
+# Based on the latest Ubuntu LTS image.
+FROM ubuntu:latest AS base
 
 # https://docs.github.com/en/packages/learn-github-packages/connecting-a-repository-to-a-package
 LABEL org.opencontainers.image.source=https://github.com/DataDog/dd-trace-java-docker-build
 
-# Replace Docker Compose and yq versions by latest and remove docker-switch from CircleCI Base Image for security purposes
+RUN <<-EOT
+	set -eux
+	apt-get update
+	apt-get install -y curl tar apt-transport-https ca-certificates gnupg \
+	socat less debian-goodies autossh ca-certificates-java python3-pip locales
+	locale-gen en_US.UTF-8
+	groupadd --gid 1001 non-root-user
path: Dockerfile
user: login: bric3
body: **typo:** Shouldn't it be `non-root-group` ?
created_at: 2025-05-16T15:41:37Z
author_association: CONTRIBUTOR
diff_hunk: @@ -58,24 +75,39 @@ COPY --from=all-jdk /usr/lib/jvm/17 /usr/lib/jvm/17
 COPY --from=all-jdk /usr/lib/jvm/21 /usr/lib/jvm/21
 
 # Base image with minimunm requirenents to build the project.
-# Based on CircleCI Base Image with Ubuntu 22.04.3 LTS, present in most runners.
-FROM cimg/base:current-22.04 AS base
+# Based on the latest Ubuntu LTS image.
+FROM ubuntu:latest AS base
 
 # https://docs.github.com/en/packages/learn-github-packages/connecting-a-repository-to-a-package
 LABEL org.opencontainers.image.source=https://github.com/DataDog/dd-trace-java-docker-build
 
-# Replace Docker Compose and yq versions by latest and remove docker-switch from CircleCI Base Image for security purposes
+RUN <<-EOT
+	set -eux
+	apt-get update
+	apt-get install -y curl tar apt-transport-https ca-certificates gnupg \
+	socat less debian-goodies autossh ca-certificates-java python3-pip locales
+	locale-gen en_US.UTF-8
+	groupadd --gid 1001 non-root-user
+	useradd --uid 1001 --gid 1001 -m non-root-user
path: Dockerfile
user: login: bric3
body: **nitpick:** the gid can be the group name I think
created_at: 2025-05-16T15:44:55Z
author_association: CONTRIBUTOR
diff_hunk: @@ -58,24 +75,39 @@ COPY --from=all-jdk /usr/lib/jvm/17 /usr/lib/jvm/17
 COPY --from=all-jdk /usr/lib/jvm/21 /usr/lib/jvm/21
 
 # Base image with minimunm requirenents to build the project.
-# Based on CircleCI Base Image with Ubuntu 22.04.3 LTS, present in most runners.
-FROM cimg/base:current-22.04 AS base
+# Based on the latest Ubuntu LTS image.
+FROM ubuntu:latest AS base
 
 # https://docs.github.com/en/packages/learn-github-packages/connecting-a-repository-to-a-package
 LABEL org.opencontainers.image.source=https://github.com/DataDog/dd-trace-java-docker-build
 
-# Replace Docker Compose and yq versions by latest and remove docker-switch from CircleCI Base Image for security purposes
+RUN <<-EOT
+	set -eux
+	apt-get update
+	apt-get install -y curl tar apt-transport-https ca-certificates gnupg \
+	socat less debian-goodies autossh ca-certificates-java python3-pip locales
path: Dockerfile
user: login: bric3
body: **note:** Re on the need for `jq`, `git` I think, and if they come as dependencies, I believe they deserve to be explicitly asked to `apt-get`. The github cli `gh` is definitely used in the pipelines, but I'm not sure where iot is installed.

I also wonder if `docker` needs to be installed as well, I believe the build is using test-containers which can make use of it. And just raising this I realise I have no idea how do work _docker in docker_.
created_at: 2025-05-16T16:03:09Z
author_association: CONTRIBUTOR
diff_hunk: @@ -143,6 +175,9 @@ COPY --from=all-jdk /usr/lib/jvm/ubuntu17 /usr/lib/jvm/ubuntu17
 COPY --from=all-jdk /usr/lib/jvm/graalvm17 /usr/lib/jvm/graalvm17
 COPY --from=all-jdk /usr/lib/jvm/graalvm21 /usr/lib/jvm/graalvm21
 
+# Switch to non-root user during runtime for security
+USER non-root-user
path: Dockerfile
user: login: sarahchen6
body: Yes! `-m` has the same functionality as `--create-home` ([ref](https://linux.die.net/man/8/useradd)). I did not set `WORKDIR` to this created directory though, so let me do that.
created_at: 2025-05-16T18:08:46Z
author_association: CONTRIBUTOR

PR comments:
user: login: sarahchen6
created_at: 2025-05-14T22:26:29Z
body: > Since this is like a major change shall we label this differently? That said this could affect other part of the build pipelines.
 
@bric3 What do you mean by labelling differently? From [this PR](https://github.com/DataDog/dd-trace-java-docker-build/pull/72), it seems like the intention is to label each image by when it was last pulled, so year/month seems to make sense 🤔
author_association: CONTRIBUTOR
user: login: sarahchen6
created_at: 2025-05-15T00:51:44Z
body: > Circle CI image appear to use the circleci user, this requires commands to be run as sudo. Should we reproduce this behavior?

@bric3 Good point! Looking into this, it seems like it is good security practice for the Dockerfile to _run_ as a non-root user ([one ref](https://www.docker.com/blog/understanding-the-docker-user-instruction/)). However, we can still install everything at the root without using the `sudo` command and just switch to a non-root user during runtime at the end.
author_association: CONTRIBUTOR
user: login: PerfectSlayer
created_at: 2025-05-16T12:34:59Z
body: You might want to revisit the cron time too: 
https://github.com/DataDog/dd-trace-java-docker-build/blob/master/.github/workflows/ci.yml#L10-L12
author_association: CONTRIBUTOR
user: login: sarahchen6
created_at: 2025-05-19T13:36:37Z
body: Testing the image build with `dd-trace-java` PR: https://github.com/DataDog/dd-trace-java/pull/8841
author_association: CONTRIBUTOR
user: login: bric3
created_at: 2025-05-22T14:55:25Z
body: 🎉 
author_association: CONTRIBUTOR