Base Java (jre or jdk) image, has non-root application user and entrypoint.sh that pulls in secrets