Merge pull request #37221 from cescoffier/base-image-for-21

Image updates (including Java 21 base image)
quarkusio · Nov 21, 2023 · bb0299d · bb0299d
2 parents d29c7ef + 177edd5
commit bb0299d
Show file tree

Hide file tree

Showing 30 changed files with 149 additions and 52 deletions.
diff --git a/...yment/src/main/java/io/quarkus/deployment/pkg/builditem/CompiledJavaVersionBuildItem.java b/...yment/src/main/java/io/quarkus/deployment/pkg/builditem/CompiledJavaVersionBuildItem.java
@@ -30,6 +30,8 @@ public interface JavaVersion {
 
         Status isJava17OrHigher();
 
+        Status isJava21OrHigher();
+
         Status isJava19OrHigher();
 
         enum Status {
@@ -58,6 +60,11 @@ public Status isJava17OrHigher() {
                 return Status.UNKNOWN;
             }
 
+            @Override
+            public Status isJava21OrHigher() {
+                return Status.UNKNOWN;
+            }
+
             @Override
             public Status isJava19OrHigher() {
                 return Status.UNKNOWN;
@@ -69,6 +76,7 @@ final class Known implements JavaVersion {
             private static final int JAVA_11_MAJOR = 55;
             private static final int JAVA_17_MAJOR = 61;
             private static final int JAVA_19_MAJOR = 63;
+            private static final int JAVA_21_MAJOR = 66;
 
             private final int determinedMajor;
 
@@ -96,6 +104,11 @@ public Status isJava19OrHigher() {
                 return higherOrEqualStatus(JAVA_19_MAJOR);
             }
 
+            @Override
+            public Status isJava21OrHigher() {
+                return higherOrEqualStatus(JAVA_21_MAJOR);
+            }
+
             private Status higherOrEqualStatus(int javaMajor) {
                 return determinedMajor >= javaMajor ? Status.TRUE : Status.FALSE;
             }

diff --git a/docs/src/main/asciidoc/building-native-image.adoc b/docs/src/main/asciidoc/building-native-image.adoc
@@ -532,7 +532,7 @@ The project generation has also provided a `Dockerfile.native` in the `src/main/
 
 [source,dockerfile]
 ----
-FROM registry.access.redhat.com/ubi8/ubi-minimal:8.8
+FROM registry.access.redhat.com/ubi8/ubi-minimal:8.9
 WORKDIR /work/
 RUN chown 1001 /work \
     && chmod "g+rwX" /work \

diff --git a/docs/src/main/asciidoc/container-image.adoc b/docs/src/main/asciidoc/container-image.adoc
@@ -47,7 +47,7 @@ For example, the presence of `src/main/jib/foo/bar` would result in  `/foo/bar`
 
 There are cases where the built container image may need to have Java debugging conditionally enabled at runtime.
 
-When the base image has not been changed (and therefore `ubi8/openjdk-11-runtime` or `ubi8/openjdk-17-runtime` is used), then the `quarkus.jib.jvm-arguments` configuration property can be used in order to
+When the base image has not been changed (and therefore `ubi8/openjdk-11-runtime`,  `ubi8/openjdk-17-runtime`, or `ubi8/openjdk-21-runtime` is used), then the `quarkus.jib.jvm-arguments` configuration property can be used in order to
 make the JVM listen on the debug port at startup.
 
 The exact configuration is:
@@ -63,7 +63,7 @@ Other base images might provide launch scripts that enable debugging when an env
 
 The `quarkus.jib.jvm-entrypoint` configuration property can be used to completely override the container entry point and can thus be used to either hard code the JVM debug configuration or point to a script that handles the details.
 
-For example, if the base images `ubi8/openjdk-11-runtime` or `ubi8/openjdk-17-runtime` are used to build the container, the entry point can be hard-coded on the application properties file.
+For example, if the base images `ubi8/openjdk-11-runtime`, `ubi8/openjdk-17-runtime` or  `ubi8/openjdk-21-runtime` are used to build the container, the entry point can be hard-coded on the application properties file.
 
 .Example application.properties
 [source,properties]
@@ -88,7 +88,7 @@ java \
   -jar quarkus-run.jar
 ----
 
-NOTE: `/home/jboss` is the WORKDIR for all quarkus binaries in the base images `ubi8/openjdk-11-runtime` and `ubi8/openjdk-17-runtime` (https://catalog.redhat.com/software/containers/ubi8/openjdk-17/618bdbf34ae3739687568813?container-tabs=dockerfile[Dockerfile for ubi8/openjdk-17-runtime, window="_blank"])
+NOTE: `/home/jboss` is the WORKDIR for all quarkus binaries in the base images `ubi8/openjdk-11-runtime`, `ubi8/openjdk-17-runtime` and `ubi8/openjdk-21-runtime` (https://catalog.redhat.com/software/containers/ubi8/openjdk-17/618bdbf34ae3739687568813?container-tabs=dockerfile[Dockerfile for ubi8/openjdk-17-runtime, window="_blank"])
 
 ==== Multi-module projects and layering
 

diff --git a/docs/src/main/asciidoc/quarkus-runtime-base-image.adoc b/docs/src/main/asciidoc/quarkus-runtime-base-image.adoc
@@ -39,7 +39,7 @@ In this case, you need to use a multi-stage `dockerfile` to copy the required li
 [source, dockerfile]
 ----
 # First stage - install the dependencies in an intermediate container
-FROM registry.access.redhat.com/ubi8/ubi-minimal:8.8 as BUILD
+FROM registry.access.redhat.com/ubi8/ubi-minimal:8.9 as BUILD
 RUN microdnf install freetype
 
 # Second stage - copy the dependencies
@@ -62,7 +62,7 @@ If you need to have access to the full AWT support, you need more than just `lib
 [source, dockerfile]
 ----
 # First stage - install the dependencies in an intermediate container
-FROM registry.access.redhat.com/ubi8/ubi-minimal:8.8 as BUILD
+FROM registry.access.redhat.com/ubi8/ubi-minimal:8.9 as BUILD
 RUN microdnf install freetype fontconfig
 
 # Second stage - copy the dependencies
@@ -112,7 +112,7 @@ To use this base image, use the following `Dockerfile`:
 
 [source, dockerfile]
 ----
-FROM registry.access.redhat.com/ubi8/ubi-minimal:8.8
+FROM registry.access.redhat.com/ubi8/ubi-minimal:8.9
 WORKDIR /work/
 RUN chown 1001 /work \
     && chmod "g+rwX" /work \

diff --git a/docs/src/main/asciidoc/virtual-threads.adoc b/docs/src/main/asciidoc/virtual-threads.adoc
@@ -349,10 +349,10 @@ To containerize your Quarkus application that use `@RunOnVirtualThread`, add the
 quarkus.container-image.build=true
 quarkus.container-image.group=<your-group-name>
 quarkus.container-image.name=<you-container-name>
-quarkus.jib.base-jvm-image=eclipse-temurin:21-ubi9-minimal <1>
+quarkus.jib.base-jvm-image=registry.access.redhat.com/ubi8/openjdk-21-runtime <1>
 quarkus.jib.platforms=linux/amd64,linux/arm64 <2>
 ----
-<1> Make sure you use a base image supporting virtual threads. Here we use an image providing Java 21.
+<1> Make sure you use a base image supporting virtual threads. Here we use an image providing Java 21. Quarkus picks an image providing Java 21+ automatically if you do not set one.
 <2> Select the target architecture. You can select more than one to build multi-archs images.
 
 Then, build your container as you would do usually.

diff --git a/...va/io/quarkus/container/image/docker/deployment/RedHatOpenJDKRuntimeBaseProviderTest.java b/...va/io/quarkus/container/image/docker/deployment/RedHatOpenJDKRuntimeBaseProviderTest.java
@@ -16,7 +16,7 @@ void testImageWithJava11() {
         Path path = getPath("openjdk-11-runtime");
         var result = sut.determine(path);
         assertThat(result).hasValueSatisfying(v -> {
-            assertThat(v.getBaseImage()).isEqualTo("registry.access.redhat.com/ubi8/openjdk-11-runtime:1.17");
+            assertThat(v.getBaseImage()).isEqualTo("registry.access.redhat.com/ubi8/openjdk-11-runtime:1.18");
             assertThat(v.getJavaVersion()).isEqualTo(11);
         });
     }
@@ -26,11 +26,21 @@ void testImageWithJava17() {
         Path path = getPath("openjdk-17-runtime");
         var result = sut.determine(path);
         assertThat(result).hasValueSatisfying(v -> {
-            assertThat(v.getBaseImage()).isEqualTo("registry.access.redhat.com/ubi8/openjdk-17-runtime:1.17");
+            assertThat(v.getBaseImage()).isEqualTo("registry.access.redhat.com/ubi8/openjdk-17-runtime:1.18");
             assertThat(v.getJavaVersion()).isEqualTo(17);
         });
     }
 
+    @Test
+    void testImageWithJava21() {
+        Path path = getPath("openjdk-21-runtime");
+        var result = sut.determine(path);
+        assertThat(result).hasValueSatisfying(v -> {
+            assertThat(v.getBaseImage()).isEqualTo("registry.access.redhat.com/ubi8/openjdk-21-runtime:1.18");
+            assertThat(v.getJavaVersion()).isEqualTo(21);
+        });
+    }
+
     @Test
     void testUnhandled() {
         Path path = getPath("ubi-java11");

diff --git a/...rc/test/java/io/quarkus/container/image/docker/deployment/UbiMinimalBaseProviderTest.java b/...rc/test/java/io/quarkus/container/image/docker/deployment/UbiMinimalBaseProviderTest.java
@@ -16,7 +16,7 @@ void testImageWithJava11() {
         Path path = getPath("ubi-java11");
         var result = sut.determine(path);
         assertThat(result).hasValueSatisfying(v -> {
-            assertThat(v.getBaseImage()).isEqualTo("registry.access.redhat.com/ubi8/ubi-minimal:8.8");
+            assertThat(v.getBaseImage()).isEqualTo("registry.access.redhat.com/ubi8/ubi-minimal:8.9");
             assertThat(v.getJavaVersion()).isEqualTo(11);
         });
     }
@@ -26,11 +26,21 @@ void testImageWithJava17() {
         Path path = getPath("ubi-java17");
         var result = sut.determine(path);
         assertThat(result).hasValueSatisfying(v -> {
-            assertThat(v.getBaseImage()).isEqualTo("registry.access.redhat.com/ubi8/ubi-minimal");
+            assertThat(v.getBaseImage()).isEqualTo("registry.access.redhat.com/ubi8/ubi-minimal:8.9");
             assertThat(v.getJavaVersion()).isEqualTo(17);
         });
     }
 
+    @Test
+    void testImageWithJava21() {
+        Path path = getPath("ubi-java21");
+        var result = sut.determine(path);
+        assertThat(result).hasValueSatisfying(v -> {
+            assertThat(v.getBaseImage()).isEqualTo("registry.access.redhat.com/ubi8/ubi-minimal:8.9");
+            assertThat(v.getJavaVersion()).isEqualTo(21);
+        });
+    }
+
     @Test
     void testUnhandled() {
         Path path = getPath("openjdk-11-runtime");

diff --git a/...s/container-image/container-image-docker/deployment/src/test/resources/openjdk-11-runtime b/...s/container-image/container-image-docker/deployment/src/test/resources/openjdk-11-runtime
@@ -1,4 +1,4 @@
-FROM registry.access.redhat.com/ubi8/openjdk-11-runtime:1.17
+FROM registry.access.redhat.com/ubi8/openjdk-11-runtime:1.18
 
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en'
 

diff --git a/...s/container-image/container-image-docker/deployment/src/test/resources/openjdk-17-runtime b/...s/container-image/container-image-docker/deployment/src/test/resources/openjdk-17-runtime
@@ -1,5 +1,5 @@
 # Use Java 17 base image
-FROM registry.access.redhat.com/ubi8/openjdk-17-runtime:1.17
+FROM registry.access.redhat.com/ubi8/openjdk-17-runtime:1.18
 
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en'
 

diff --git a/...s/container-image/container-image-docker/deployment/src/test/resources/openjdk-21-runtime b/...s/container-image/container-image-docker/deployment/src/test/resources/openjdk-21-runtime
@@ -0,0 +1,18 @@
+# Use Java 17 base image
+FROM registry.access.redhat.com/ubi8/openjdk-21-runtime:1.18
+
+ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en'
+
+# Append additional options to the java process, you can add -XshowSettings:vm to also display the heap size.
+ENV JAVA_OPTS_APPEND="-Dquarkus.http.host=0.0.0.0 -Djava.util.logging.manager=org.jboss.logmanager.LogManager"
+
+# We make four distinct layers so if there are application changes the library layers can be re-used
+COPY --chown=185 target/quarkus-app/lib/ /deployments/lib/
+COPY --chown=185 target/quarkus-app/*.jar /deployments/
+COPY --chown=185 target/quarkus-app/app/ /deployments/app/
+COPY --chown=185 target/quarkus-app/quarkus/ /deployments/quarkus/
+
+EXPOSE 8080
+USER 185
+
+ENTRYPOINT [ "java", "-jar", "/deployments/quarkus-run.jar" ]
diff --git a/extensions/container-image/container-image-docker/deployment/src/test/resources/ubi-java11 b/extensions/container-image/container-image-docker/deployment/src/test/resources/ubi-java11
@@ -1,4 +1,4 @@
-FROM registry.access.redhat.com/ubi8/ubi-minimal:8.8
+FROM registry.access.redhat.com/ubi8/ubi-minimal:8.9
 
 ARG JAVA_PACKAGE=java-11-openjdk-headless
 ARG RUN_JAVA_VERSION=1.3.8

diff --git a/extensions/container-image/container-image-docker/deployment/src/test/resources/ubi-java17 b/extensions/container-image/container-image-docker/deployment/src/test/resources/ubi-java17
@@ -1,4 +1,4 @@
-FROM registry.access.redhat.com/ubi8/ubi-minimal
+FROM registry.access.redhat.com/ubi8/ubi-minimal:8.9
 
 ARG JAVA_PACKAGE=java-17-openjdk-headless
 ARG RUN_JAVA_VERSION=1.3.8

diff --git a/extensions/container-image/container-image-docker/deployment/src/test/resources/ubi-java21 b/extensions/container-image/container-image-docker/deployment/src/test/resources/ubi-java21
@@ -0,0 +1,31 @@
+FROM registry.access.redhat.com/ubi8/ubi-minimal:8.9
+
+ARG JAVA_PACKAGE=java-21-openjdk-headless
+ARG RUN_JAVA_VERSION=1.3.8
+ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en'
+# Install java and the run-java script
+# Also set up permissions for user `1001`
+RUN microdnf install curl ca-certificates ${JAVA_PACKAGE} \
+    && microdnf update \
+    && microdnf clean all \
+    && mkdir /deployments \
+    && chown 1001 /deployments \
+    && chmod "g+rwX" /deployments \
+    && chown 1001:root /deployments \
+    && curl https://repo1.maven.org/maven2/io/fabric8/run-java-sh/${RUN_JAVA_VERSION}/run-java-sh-${RUN_JAVA_VERSION}-sh.sh -o /deployments/run-java.sh \
+    && chown 1001 /deployments/run-java.sh \
+    && chmod 540 /deployments/run-java.sh \
+    && echo "securerandom.source=file:/dev/urandom" >> /etc/alternatives/jre/lib/security/java.security
+
+# Configure the JAVA_OPTIONS, you can add -XshowSettings:vm to also display the heap size.
+ENV JAVA_OPTIONS="-Dquarkus.http.host=0.0.0.0 -Djava.util.logging.manager=org.jboss.logmanager.LogManager"
+# We make four distinct layers so if there are application changes the library layers can be re-used
+COPY --chown=1001 target/quarkus-app/lib/ /deployments/lib/
+COPY --chown=1001 target/quarkus-app/*.jar /deployments/
+COPY --chown=1001 target/quarkus-app/app/ /deployments/app/
+COPY --chown=1001 target/quarkus-app/quarkus/ /deployments/quarkus/
+
+EXPOSE 8080
+USER 1001
+
+ENTRYPOINT [ "/deployments/run-java.sh" ]
diff --git a/...ment/src/main/java/io/quarkus/container/image/jib/deployment/ContainerImageJibConfig.java b/...ment/src/main/java/io/quarkus/container/image/jib/deployment/ContainerImageJibConfig.java
@@ -16,9 +16,12 @@ public class ContainerImageJibConfig {
     /**
      * The base image to be used when a container image is being produced for the jar build.
      *
-     * When the application is built against Java 17 or higher, {@code registry.access.redhat.com/ubi8/openjdk-17-runtime:1.17}
+     * When the application is built against Java 21 or higher, {@code registry.access.redhat.com/ubi8/openjdk-21-runtime:1.18}
      * is used as the default.
-     * Otherwise {@code registry.access.redhat.com/ubi8/openjdk-11-runtime:1.17} is used as the default.
+     * When the application is built against Java 17 or higher (but less than 21),
+     * {@code registry.access.redhat.com/ubi8/openjdk-17-runtime:1.18}
+     * is used as the default.
+     * Otherwise {@code registry.access.redhat.com/ubi8/openjdk-11-runtime:1.18} is used as the default.
      */
     @ConfigItem
     public Optional<String> baseJvmImage;

diff --git a/...-jib/deployment/src/main/java/io/quarkus/container/image/jib/deployment/JibProcessor.java b/...-jib/deployment/src/main/java/io/quarkus/container/image/jib/deployment/JibProcessor.java
@@ -92,8 +92,10 @@ public class JibProcessor {
     private static final IsClassPredicate IS_CLASS_PREDICATE = new IsClassPredicate();
     private static final String BINARY_NAME_IN_CONTAINER = "application";
 
-    private static final String JAVA_17_BASE_IMAGE = "registry.access.redhat.com/ubi8/openjdk-17-runtime:1.17";
-    private static final String JAVA_11_BASE_IMAGE = "registry.access.redhat.com/ubi8/openjdk-11-runtime:1.17";
+    private static final String JAVA_21_BASE_IMAGE = "registry.access.redhat.com/ubi8/openjdk-21-runtime:1.18";
+    private static final String JAVA_17_BASE_IMAGE = "registry.access.redhat.com/ubi8/openjdk-17-runtime:1.18";
+    private static final String JAVA_11_BASE_IMAGE = "registry.access.redhat.com/ubi8/openjdk-11-runtime:1.18";
+
     private static final String DEFAULT_BASE_IMAGE_USER = "185";
 
     private static final String OPENTELEMETRY_CONTEXT_CONTEXT_STORAGE_PROVIDER_SYS_PROP = "io.opentelemetry.context.contextStorageProvider";
@@ -134,6 +136,9 @@ private String determineBaseJvmImage(ContainerImageJibConfig jibConfig, Compiled
         }
 
         var javaVersion = compiledJavaVersion.getJavaVersion();
+        if (javaVersion.isJava21OrHigher() == CompiledJavaVersionBuildItem.JavaVersion.Status.TRUE) {
+            return JAVA_21_BASE_IMAGE;
+        }
         if (javaVersion.isJava17OrHigher() == CompiledJavaVersionBuildItem.JavaVersion.Status.TRUE) {
             return JAVA_17_BASE_IMAGE;
         }

diff --git a/...n/java/io/quarkus/container/image/openshift/deployment/ContainerImageOpenshiftConfig.java b/...n/java/io/quarkus/container/image/openshift/deployment/ContainerImageOpenshiftConfig.java
@@ -15,8 +15,10 @@
 @ConfigRoot(name = "openshift", phase = ConfigPhase.BUILD_TIME)
 public class ContainerImageOpenshiftConfig {
 
-    public static final String DEFAULT_BASE_JVM_JDK11_IMAGE = "registry.access.redhat.com/ubi8/openjdk-11:1.17";
-    public static final String DEFAULT_BASE_JVM_JDK17_IMAGE = "registry.access.redhat.com/ubi8/openjdk-17:1.17";
+    public static final String DEFAULT_BASE_JVM_JDK11_IMAGE = "registry.access.redhat.com/ubi8/openjdk-11:1.18";
+    public static final String DEFAULT_BASE_JVM_JDK17_IMAGE = "registry.access.redhat.com/ubi8/openjdk-17:1.18";
+    public static final String DEFAULT_BASE_JVM_JDK21_IMAGE = "registry.access.redhat.com/ubi8/openjdk-21:1.18";
+
     public static final String DEFAULT_BASE_NATIVE_IMAGE = "quay.io/quarkus/ubi-quarkus-native-binary-s2i:2.0";
     public static final String DEFAULT_NATIVE_TARGET_FILENAME = "application";
 
@@ -29,11 +31,12 @@ public class ContainerImageOpenshiftConfig {
     public static final String FALLBACK_NATIVE_BINARY_DIRECTORY = "/home/quarkus/";
 
     public static String getDefaultJvmImage(CompiledJavaVersionBuildItem.JavaVersion version) {
-        switch (version.isJava17OrHigher()) {
-            case TRUE:
-                return DEFAULT_BASE_JVM_JDK17_IMAGE;
-            default:
-                return DEFAULT_BASE_JVM_JDK11_IMAGE;
+        if (version.isJava21OrHigher() == CompiledJavaVersionBuildItem.JavaVersion.Status.TRUE) {
+            return DEFAULT_BASE_JVM_JDK21_IMAGE;
+        } else if (version.isJava17OrHigher() == CompiledJavaVersionBuildItem.JavaVersion.Status.TRUE) {
+            return DEFAULT_BASE_JVM_JDK17_IMAGE;
+        } else {
+            return DEFAULT_BASE_JVM_JDK11_IMAGE;
         }
     }
 
@@ -48,9 +51,11 @@ public static String getDefaultJvmImage(CompiledJavaVersionBuildItem.JavaVersion
      * The value of this property is used to create an ImageStream for the builder image used in the Openshift build.
      * When it references images already available in the internal Openshift registry, the corresponding streams are used
      * instead.
-     * When the application is built against Java 17 or higher, {@code registry.access.redhat.com/ubi8/openjdk-17:1.17}
+     * When the application is built against Java 21 or higher, {@code registry.access.redhat.com/ubi8/openjdk-21:1.18}
+     * is used as the default.
+     * When the application is built against Java [17, 20], {@code registry.access.redhat.com/ubi8/openjdk-17:1.18}
      * is used as the default.
-     * Otherwise {@code registry.access.redhat.com/ubi8/openjdk-11:1.17} is used as the default.
+     * Otherwise {@code registry.access.redhat.com/ubi8/openjdk-11:1.18} is used as the default.
      */
     @ConfigItem
     public Optional<String> baseJvmImage;

diff --git a/...t/deployment/src/main/java/io/quarkus/container/image/openshift/deployment/S2iConfig.java b/...t/deployment/src/main/java/io/quarkus/container/image/openshift/deployment/S2iConfig.java
@@ -41,9 +41,9 @@ public static String getDefaultJvmImage(CompiledJavaVersionBuildItem.JavaVersion
     /**
      * The base image to be used when a container image is being produced for the jar build.
      *
-     * When the application is built against Java 17 or higher, {@code registry.access.redhat.com/ubi8/openjdk-17:1.17}
+     * When the application is built against Java 17 or higher, {@code registry.access.redhat.com/ubi8/openjdk-17:1.18}
      * is used as the default.
-     * Otherwise {@code registry.access.redhat.com/ubi8/openjdk-11:1.17} is used as the default.
+     * Otherwise {@code registry.access.redhat.com/ubi8/openjdk-11:1.18} is used as the default.
      */
     @ConfigItem
     public Optional<String> baseJvmImage;

diff --git a/...ment/src/main/java/io/quarkus/container/image/s2i/deployment/ContainerImageS2iConfig.java b/...ment/src/main/java/io/quarkus/container/image/s2i/deployment/ContainerImageS2iConfig.java
@@ -15,15 +15,17 @@ public class ContainerImageS2iConfig {
 
     public static final String DEFAULT_BASE_JVM_JDK11_IMAGE = "registry.access.redhat.com/ubi8/openjdk-11";
     public static final String DEFAULT_BASE_JVM_JDK17_IMAGE = "registry.access.redhat.com/ubi8/openjdk-17";
+    public static final String DEFAULT_BASE_JVM_JDK21_IMAGE = "registry.access.redhat.com/ubi8/openjdk-21";
     public static final String DEFAULT_BASE_NATIVE_IMAGE = "quay.io/quarkus/ubi-quarkus-native-binary-s2i:2.0";
     public static final String DEFAULT_NATIVE_TARGET_FILENAME = "application";
 
     public static String getDefaultJvmImage(CompiledJavaVersionBuildItem.JavaVersion version) {
-        switch (version.isJava17OrHigher()) {
-            case TRUE:
-                return DEFAULT_BASE_JVM_JDK17_IMAGE;
-            default:
-                return DEFAULT_BASE_JVM_JDK11_IMAGE;
+        if (version.isJava21OrHigher() == CompiledJavaVersionBuildItem.JavaVersion.Status.TRUE) {
+            return DEFAULT_BASE_JVM_JDK21_IMAGE;
+        } else if (version.isJava17OrHigher() == CompiledJavaVersionBuildItem.JavaVersion.Status.TRUE) {
+            return DEFAULT_BASE_JVM_JDK17_IMAGE;
+        } else {
+            return DEFAULT_BASE_JVM_JDK11_IMAGE;
         }
     }
 

diff --git a/...main/resources/codestarts/quarkus/tooling/dockerfiles/base/Dockerfile-layout.include.qute b/...main/resources/codestarts/quarkus/tooling/dockerfiles/base/Dockerfile-layout.include.qute
@@ -77,7 +77,7 @@
 #   accessed directly. (example: "foo.example.com,bar.example.com")
 #
 ###
-FROM registry.access.redhat.com/ubi8/openjdk-{java.version}:1.17
+FROM registry.access.redhat.com/ubi8/openjdk-{java.version}:1.18
 
 ENV LANGUAGE='en_US:en'
 

diff --git a/...s/base-codestarts/src/main/resources/codestarts/quarkus/tooling/dockerfiles/codestart.yml b/...s/base-codestarts/src/main/resources/codestarts/quarkus/tooling/dockerfiles/codestart.yml
@@ -5,6 +5,6 @@ language:
     data:
       dockerfile:
         native:
-          from: registry.access.redhat.com/ubi8/ubi-minimal:8.8
+          from: registry.access.redhat.com/ubi8/ubi-minimal:8.9
         native-micro:
           from: quay.io/quarkus/quarkus-micro-image:2.0