What the developer wrote
Authored by Fabrice Drouin
Use noble docker images instead of alpine (#3286)
It fixes compatibility issues with alpine (which uses musl and not glibc), and is easier to maintain.
Note that this makes the image about 190 Mb bigger.
What changed, and why it matters
This commit changes the Docker base image from Alpine Linux to Ubuntu Noble. The stated reason is to fix compatibility problems because Alpine uses a different C library (musl) than the one the Java build expects (glibc). It is a routine build/maintenance change, not a security patch. The image becomes larger, but there is no direct evidence in the commit of a vulnerability being fixed.
Treat as a normal dependency/base-image maintenance commit. Review the new Ubuntu-based image for updated package versions and follow usual image-scanning practices, but no immediate security response is indicated by the commit itself.
Security signals we found
Base image swap from Alpine (musl libc) to Ubuntu Noble (glibc)
Package manager changed from apk to apt-get
Commit message cites compatibility and maintenance, not security
Evidence from the diff
The Dockerfile is updated to use eclipse-temurin:21-jdk-noble and eclipse-temurin:21-jre-noble instead of the Alpine variants. Package installation switches from apk to apt-get. The commit message frames this as a compatibility and maintainability improvement, not a security fix. No CVE, advisory, or researcher attribution is present in the commit or supplied references.
Changed components
DockerfileDocker build/publish pipelineInspect captured patch +3 / −3
diff --git a/Dockerfile b/Dockerfile
index 06e173b..dbc3916 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM eclipse-temurin:21-jdk-alpine as BUILD
+FROM eclipse-temurin:21-jdk-noble as BUILD
# Let's fetch eclair dependencies, so that Docker can cache them
# This way we won't have to fetch dependencies again if only the source code changes
@@ -23,11 +23,11 @@ COPY . .
RUN ./mvnw package -pl eclair-node -am -DskipTests -Dgit.commit.id=notag -Dgit.commit.id.abbrev=notag -o
# It might be good idea to run the tests here, so that the docker build fail if the code is bugged
-FROM eclipse-temurin:21-jre-alpine
+FROM eclipse-temurin:21-jre-noble
WORKDIR /app
# install jq for eclair-cli
-RUN apk add bash jq curl unzip
+RUN apt-get update && apt-get install bash jq curl unzip
# copy and install eclair-cli executable
COPY --from=BUILD /usr/src/eclair-core/eclair-cli .
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.