Hardened OpenJDK 17 on Ubuntu 24.04

Charges for this image cover the security hardening, optimization, and pre-integration work Hanwei performs on top of the upstream OpenJDK 17 and Ubuntu 24.04 LTS projects. OpenJDK 17 is installed during the image build and java and javac are on PATH at first boot, while the operating system underneath is configured to a fixed hardened and tuned baseline and validated on EC2 before publication. The base is Ubuntu 24.04 LTS, whose standard security maintenance runs to 2029.

What Hanwei Adds to Upstream OpenJDK 17

• Toolchain installed at build time: the full JDK is installed rather than the runtime alone, so java, javac, jar, jshell and the diagnostic tools jcmd, jstack and jmap are all present on PATH.
• Build dependencies preinstalled: gcc, pkg-config and the OpenSSL development headers are present, so native libraries reached through JNI and build plugins that compile native code work without further setup.
• Tuning baseline applied identically across the catalogue: the file descriptor limit goes from 1024 to 65536 and the memory-map ceiling from 65530 to 262144; the device receive backlog goes from 1000 to 16384 and the TCP SYN backlog from 128 to 8192, so bursts queue instead of being dropped; socket buffer maxima reach 16 MB for larger autotuned windows; connections keep their congestion window across idle periods; and the journal is capped at 500 MB. The profile raises ceilings only and does not alter protocol semantics or application behaviour.
• Applied hardening beyond the distribution default: SSH is limited to a vetted cipher, key exchange and MAC list, X11 forwarding is off, the login grace period is shortened and verbose authentication logging is on; auditd runs a base rule set for privileged command execution; the kernel drops ICMP redirects on IPv4 and IPv6, logs martian packets, filters reverse paths in loose mode, restricts dmesg and turns off sysrq.
• AWS operational integration: the SSM Agent is installed and enabled for Session Manager and Patch Manager without an inbound SSH rule; chrony points at the Amazon Time Sync Service; and the root filesystem extends at boot when the volume exceeds the image default.
• Patch level set at the build date: packages come from official upstream repositories at the newest level published when the image was built.
• Repeatable build and EC2 validation: each version comes from the same build process and is launched and exercised on EC2 before release.

Access and Security Posture

• AppArmor is active and auditd records activity against a base rule set.
• Sign in as 'ubuntu' with the key pair selected at launch, then use 'sudo su -' for a root shell. Session Manager is available as an alternative that needs no inbound port.
• Direct root login over SSH is disabled and password authentication is not accepted.
• No authorized keys and no SSH private keys are embedded in the image.

Operational Impact on EC2

• Launch-to-first-build time is reduced to a single boot cycle.
• Every instance starts from an identical configuration, removing drift between development, staging and production hosts.
• Network services need no per-host limit or backlog adjustment before handling load.
• Clock accuracy comes from the Amazon Time Sync Service, which matters for log correlation and request signing.
• Post-launch patching effort is lower because the package set is current at release.

Where This Image Fits

• JVM services on teams standardised on Ubuntu LTS rather than an RPM distribution.
• Build and CI hosts that compile Java projects with Maven or Gradle.
• Development instances for teams working on Java 17 codebases.
• Workloads that need Ubuntu package availability alongside a supported LTS JDK.

About OpenJDK 17 and Ubuntu 24.04 LTS

OpenJDK 17 is a long-term support release of the Java platform. It carries sealed classes, pattern matching for instanceof, records, switch expressions and the strongly encapsulated JDK internals introduced through JEP 403, plus the ZGC and Shenandoah collectors for latency-sensitive workloads. As an LTS release it receives security updates for a longer window than the interim releases, which is why it remains a common target for server applications and build pipelines.

Ubuntu 24.04 LTS is a long-term support release with standard security maintenance through 2029. It uses apt and systemd, enables AppArmor by default, and carries a large package archive with broad third-party support, which is why it is often the assumed target for tooling and vendor documentation. The login account is 'ubuntu' with sudo.