OpenJDK 21 Dev Kit

Why the cloudimg image

cloudimg takes the Java runtime from the operating system vendor's own supported repository rather than bundling a frozen copy, so the compiler and runtime in the image keep receiving security fixes automatically for the whole life of the machine. Nothing is version pinned or held back, because holding a package is the quiet way to stop security updates arriving. Every package was checksum verified against the digest the vendor publishes before it was accepted into the image, and the exact build that shipped is recorded on the machine so you can always tell what you started from. The Maven local repository and the Gradle cache live on a dedicated data volume you can size, snapshot and grow independently of the operating system disk, wired up in the global build tool configuration so it applies to every user and to a project's own build wrapper, not just to a login shell. Every upstream licence and legal notice for the toolchain and the build tools is harvested into the image in full, including the complete legal tree the runtime ships. The image runs no network service at all: the only listener on a fresh instance is SSH, there is no console to secure, and no default credential exists anywhere because there is nothing to log in to. Dependency caches ship empty, so nothing another project resolved comes with your machine. A single command compiles a real program, resolves a real dependency, runs a test suite, packages it and executes it, so you can confirm the machine works before you trust it with your own code. Every deployment ships fully patched, with a paired deploy guide and 24/7 cloudimg support.