How to Containerize a Java Application Securely
Build a secure Java container with Docker, then generate an SBOM, attach attestations, and inspect vulnerabilities with Docker Scout.
Published in
JAVAPRO
02/2025 · 30 Years of Java, Part 2 · Pages 131–141
Containerizing a Java application is more than placing a JAR inside an image. The build should separate compilation from runtime, minimize what reaches the final image, avoid running as root, and preserve enough supply-chain evidence to understand what was shipped.
Published by JAVAPRO International, this practical guide follows a Spring Boot application from source code to a secured Docker image. It covers:
- Generating a multi-stage Java Dockerfile with
docker init - Using separate JDK build and JRE runtime stages
- Running the application as an unprivileged user
- Extracting an SPDX software bill of materials
- Publishing SBOM and provenance attestations with BuildKit
- Reviewing packages and vulnerabilities with Docker Scout
- Automating the image build and publication workflow in CI/CD
The article appears in JAVAPRO 02/2025: 30 Years of Java, Part 2, pages 131–141. Use the publication card above to read the canonical web article or preview its magazine edition.