RUNTIMES // IHL-CTR-0006

Java

Java execution environments for packaged applications across the published version and provider targets.

CURRENT BUILD SOURCE ↗
LINUX / AMD64ENGINEERING PREVIEW
GET THE IMAGE // SECURE

PULL. PIN. VERIFY.

GHCR // ANONYMOUS PULL
docker pull --platform linux/amd64 \
  ghcr.io/foxtech-consulting/java@sha256:5a6eb0f2e2fd42fb34ae8779b5e86c0ea617b3b7e280bcd4c1f37599241f0b4b

Anonymous pull verified Oct 15, 2026, 2:23 PM EDT. Pin this digest in Compose or Kubernetes.

Version 21.0.12.1 · Java Secure · Open GHCR package ↗

BEFORE YOU RUN

MADE FOR YOUR WORKLOAD.

Requirements from the public source recipes. Review the exact selected image and configuration before use.

  1. Choose an exact Java version and provider target from the catalog.
  2. Add your application under /app; the base images start with java -version and run as UID/GID 1654:1654.
  3. Provider variant names identify build targets and do not confer FIPS qualification.
  4. The public snapshot includes runtime sources; the private Java qualification application is excluded.

Read the source recipe ↗ · Local build instructions ↗. Local builds remain unqualified.

KEEP THE CHAIN OF EVIDENCE

INSPECT WHAT YOU PULL.

The download check, publication signature, and source binding are separate records.

✓Anonymous bytes checked

Manifest, configuration, and every referenced layer.

↗Publication CI signature

Reported by original CI; obtain annotation values from its record.

—Legacy source binding

No signed GitHub source binding is recorded for this image.

The anonymous byte check did not repeat cryptographic signature verification or execute the runtime. Publication evidence ↗ may require GitLab access.

Complete signed annotation values are not included in this legacy record. Open the original publication record ↗ before constructing a verification command. A newer GitHub source snapshot cannot supply the missing image binding.

RECORDED FINDINGS

AT QUALIFICATION // NOT A LIVE SCAN

Finding counts are not included in this catalog record. Read the linked original evidence; unlisted counts do not mean zero findings.

These are engineering previews. Tier names and successful checks do not declare general availability, FIPS validation, or qualification of your deployment. Read the verification guide →

DATA SOURCE // GitHub public catalog ↗ · Snapshot 5f1fd3d6 · Retrieved Oct 16, 2026, 2:37 PM EDT.
Catalog inventory record updated Oct 16, 2026, 11:39 AM EDT. Individual image and blob checks retain their original timestamps. This website uses a pinned GitHub snapshot. These checks are recorded evidence, not new scans or downloads performed by this page.