teogisis/wolfpack-java repository overview

⁠wolfpack-java

Hardened, minimal Java container images built on Wolfi⁠ with apko⁠ — no distro, no shell, no JDK in production.

Rebuilt daily from Wolfi's rolling-release package repo, so security patches land automatically. Every build is scanned with Trivy⁠; results and an auto-generated SBOM are tracked on GitHub⁠.

⁠Tags

Two variants per Java version — 17, 21:

Each tag is overwritten with the newest build; there is no latest tag (pick a version explicitly).

⁠Usage

Since the production image has no shell or JDK, compile in a -dev builder stage and copy the built artifact into the hardened final image:

# ---- Builder: has JDK + maven + shell ----
FROM teogisis/wolfpack-java:21-dev AS builder
WORKDIR /app
COPY pom.xml .
COPY src ./src
RUN mvn -B package -DskipTests

# ---- Final: hardened, no JDK, no shell ----
FROM teogisis/wolfpack-java:21
WORKDIR /app
COPY --from=builder /app/target/app.jar app.jar
ENTRYPOINT ["/usr/bin/java", "-jar", "app.jar"]

Runs as a non-root user (uid/gid 65532) by default. JAVA_HOME is set in both variants.

⁠Also in this family

wolfpack-python⁠ · wolfpack-node⁠ · wolfpack-dotnet⁠

⁠Source

Build configs, CI pipeline, and up-to-date vulnerability scan results: github.com/Theo-Gkisis/wolfpack⁠