Use JDK 21 as default JDK instead of JDK 17

[MarkEWaite]

Use JDK 21 as default JDK instead of JDK 17

The Java 17 end of life warning message is now displayed to Jenkins users running the containers that do not specify a JDK version in their label. This changes from Java 17 to Java 21 for those containers that don't include the JDK version number in the label.

Weekly containers that will be built with Java 21 include:

• jenkins/jenkins
• jenkins/jenkins:alpine
• jenkins/jenkins:slim
• jenkins/jenkins:2.509
• jenkins/jenkins:2.509-alpine
• jenkins/jenkins:2.509-slim

LTS containers that will be built with Java 21 include:

• jenkins/jenkins:lts
• jenkins/jenkins:lts-slim
• jenkins/jenkins:lts-alpine
• jenkins/jenkins:2.504.2
• jenkins/jenkins:2.504.2-lts
• jenkins/jenkins:2.504.2-lts-slim
• jenkins/jenkins:2.504.2-lts-alpine

Testing done:

Tested the Linux container images and their labels. Did not test the Windows container images and their labels. Will rely on ci.jenkins.io to run the Windows tests.

Before the change (using images downloaded from hub.docker.com):

These images change in the "before" and "after" comparison:

$ for label in 2.479 2.479-alpine 2.479-slim; do 
    docker run -q jenkins/jenkins:$label java -version
done

openjdk version "17.0.12" 2024-07-16
OpenJDK Runtime Environment Temurin-17.0.12+7 (build 17.0.12+7)
OpenJDK 64-Bit Server VM Temurin-17.0.12+7 (build 17.0.12+7, mixed mode)

These images do not change in the "before" and "after" comparison:

$ for label in 2.479-alpine-jdk21 2.479-jdk21 2.479-rhel-ubi9-jdk21 2.479-slim-jdk21; do 
    docker run -q jenkins/jenkins:$label java -version
done

openjdk version "21.0.4" 2024-07-16 LTS
OpenJDK Runtime Environment Temurin-21.0.4+7 (build 21.0.4+7-LTS)
OpenJDK 64-Bit Server VM Temurin-21.0.4+7 (build 21.0.4+7-LTS, mixed mode)

These images do not change in the "before" and "after" comparison:

$ for label in 2.479-alpine-jdk17 2.479-jdk17 2.479-rhel-ubi9-jdk17 2.479-slim-jdk17; do 
    docker run -q jenkins/jenkins:$label java -version
done

openjdk version "17.0.12" 2024-07-16
OpenJDK Runtime Environment Temurin-17.0.12+7 (build 17.0.12+7)
OpenJDK 64-Bit Server VM Temurin-17.0.12+7 (build 17.0.12+7, mixed mode)

After the change (using locally built images):

These images change in the "before" and "after" comparison:

$ for label in 2.479 2.479-alpine 2.479-slim; do 
    docker run -q jenkins/jenkins:$label java -version
done

openjdk version "21.0.6" 2025-01-21 LTS
OpenJDK Runtime Environment Temurin-21.0.6+7 (build 21.0.6+7-LTS)
OpenJDK 64-Bit Server VM Temurin-21.0.6+7 (build 21.0.6+7-LTS, mixed mode)

These images do not change in the "before" and "after" comparison:

$ for label in 2.479-alpine-jdk21 2.479-jdk21 2.479-rhel-ubi9-jdk21 2.479-slim-jdk21; do 
    docker run -q jenkins/jenkins:$label java -version
done

openjdk version "21.0.6" 2025-01-21 LTS
OpenJDK Runtime Environment Temurin-21.0.6+7 (build 21.0.6+7-LTS)
OpenJDK 64-Bit Server VM Temurin-21.0.6+7 (build 21.0.6+7-LTS, mixed mode)

These images do not change in the "before" and "after" comparison:

$ for label in 2.479-alpine-jdk17 2.479-jdk17 2.479-rhel-ubi9-jdk17 2.479-slim-jdk17; do
    docker run -q jenkins/jenkins:$label java -version
done

openjdk version "17.0.14" 2025-01-21
OpenJDK Runtime Environment Temurin-17.0.14+7 (build 17.0.14+7)
OpenJDK 64-Bit Server VM Temurin-17.0.14+7 (build 17.0.14+7, mixed mode)

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests - that demonstrates feature works or fixes the issue

[MarkEWaite]

I am reasonably confident that the Linux changes are correct. I am absolutely not confident that the Windows changes are correct. Would love to have review from others to guide me on the Windows implementation.

[timja]

I think its right, looks like Windows wasn't setting which one was the default and it was just a race from what I'm reading?

[MarkEWaite]

It was just a race from what I'm reading?

That was my interpretation, but I'd really like a review from @lemeurherve or @lemeurherveCB or @dduportal in case I've misunderstood the build process for Windows container images.

[lemeurherveCB]

Too bad there isn't (yet?) the same mechanism as in docker-agent, that would have been easier: https://github.com/jenkinsci/docker-agent/blob/ce8fc915c8b6a3787f487377e62fa22262c92017/docker-bake.hcl#L51-L53

I need some time to review it, will try taking a look this week.

[MarkEWaite]

I think that we need this merged before the weekly release on Tuesday. @lemeurherveCB or @dduportal could you review and merge it on Tuesday before the weekly release is packaged?

[dduportal]

Thanks!

[lemeurherve]

@jenkinsci/dockerhub-admins I don't remember how we're updating the docker hub repo README, currently showing jdk17 as the latest image, we should update it:

[dduportal]

@jenkinsci/dockerhub-admins I don't remember how we're updating the docker hub repo README, currently showing jdk17 as the latest image, we should update it:

As far as I remember, it is only manual since DockerHub API stopped accepting API tokens (e.g. user/password are required).

We can't use a technical user since MFA is required for our safety. Might need to check if DockerHub API did fix this?

[timja]

Err I don't remember that happening, docker-agent repo seems to be working fine:
https://github.com/jenkinsci/docker-agent/actions/runs/18228626979/job/51906267725

I think we just never ported the GitHub action here as we were trialing it on docker agent first