SpringBoot native image to use builder-noble-java-tiny instead of builder-jammy-java-tiny

[patpatpat123]

Hello team,

just wanted to reach out regarding the base image of a native image.

It has been announced here https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-3.4-Release-Notes#paketo-tiny-builder-for-building-oci-images since 3.4.0, the default base image to build native image is paketobuildpacks/builder-jammy-java-tiny

Would it be possible to use paketobuildpacks/builder-noble-java-tiny instead?

Rationale and justification

1 - Vulnerability:
Our company has business licenses for many container scanning tools.
Here is the scan result for something built using the default, paketobuildpacks/builder-jammy-java-tiny.
(By something, I mean from the plain Hello World SpringBoot app, pet clinic, all the way to very complex springboot apps)

Preparing to submit image for scanning...
✔️	Image Uploaded for Scanning
Scan results ready! Gathering...
✔️	Vulnerability report received:
		 3 Critical
		 16 High
		 18 Medium
		 4 Low
		 1 Negligible
		 1 Unknown
✔️	License report
Global Content Checks. Policy is applied to all scans as part of Product Security Guidance

CVE-2022-1292 CVE-2022-2068 CVE-2024-5535

Here is the result for something built using paketobuildpacks/builder-noble-java-tiny.

Preparing to submit image for scanning...
✔️	Image Uploaded for Scanning
Scan results ready! Gathering...
✔️	Vulnerability report received:
		 1 Critical
		 2 High
		 2 Medium
		 6 Low
		 1 Negligible
		 2 Unknown
Global Content Checks. Policy is applied to all scans as part of Product Security Guidance

CVE-2024-5535

The latest version of ubuntu has less vulnerabilities.

2 - Noble over Jammy
It has been officially announced Jammy systems should upgrade to Noble.

With the above two justifications, could you please weight if it would make sense to use the most up to date base image instead of paketobuildpacks/builder-jammy-java-tiny?

Thank you

[philwebb]

I don't think we can upgrade in the 3.4.x line. We're considering our options for 3.5.x (see #42711)

[patpatpat123]

thank you