Removal of jmods from JDK development images

Hello, 

TL;DR: We’re making our non-FIPS JDK development images smaller and more secure by removing jmods. You likely won’t notice a difference—unless you use jlink, in which case you’ll need to switch to our new jmods tags. Read on for more details.

What is changing?

To provide you with images that are smaller and more secure, Chainguard will be removing jmods from the standard tags of our non-FIPS JDK container images on September 15th, 2025.

This change will be made for all JDK distributions provided by Chainguard, including our container images for OpenJDK, OpenJDK CRaC, Corretto JDK, Liberica JDK, and Adoptium JDK. We will be introducing specialized jmods tags for our non-FIPS JDK images that still include them for customers that require them.

Starting today (August 15th, 2025), Chainguard now provides specialized jmods tags that customers currently using jlink may migrate to.

Our FIPS images have never included jmods as jlink can not be used to produce FIPS compliant application images so they will remain unchanged. Similarly, all of your custom images will remain unchanged.

Why is Chainguard making this change?

In many of our non-FIPS JDK images, jmods take up nearly half the total size. Removing them lets us deliver lighter, faster-to-pull images—helping you save bandwidth, speed up deployments, and reduce your container footprint.

Previously, most JDK variants only included jmods in the -dev images bundled with a package manager (APK). With this change, you can now choose jmod-enabled images with or without a package manager, using our new *-jmods and *-jmods-dev tags.

How will this affect me?

If you don’t use jlink: You’ll simply see smaller, faster images where jmods used to be included—no changes to your workflow required.

 

If you do use jlink: Just switch to our new *-jmods or *-jmods-dev tags, which will continue to include everything you need in a secure, minimal image.

What do I need to do?

• If your workflow depends on jlink, switch from *-dev to the new jmods tags.

• Use the *-preview-dev tags (available today) to test your workflows without jmods before the changes go live on September 15th. For example, if you’re currently using cgr.dev/customer.com/jdk:openjdk-21-dev, you’d move to cgr.dev/customer.com/jdk:openjdk-21-preview-dev to test upcoming changes.

• After September 15th, the preview images will stop receiving updates. If you discover you need jmods, migrate to *-jmods-dev. Otherwise, continue using *-dev as usual. Migrating to the jmods tag is as easy as replacing references to cgr.dev/customer.com/jdk:openjdk-21-dev with cgr.dev/customer.com/jdk:openjdk-21-jmods-dev.

FAQs

Need help or have questions?

We're here for you. Just drop us a line at support.chainguard.dev and we’ll be happy to help.

Chainguard Team