Nexus IQ flagged Component-Unknown for libraries in alpine openjdk

Question

When I try to scan docker image with nexus IQ, it flagged Component-Unknown for libraries in openjdk alpine.

usr/lib/jvm/java-1.8-openjdk/jre/lib/charsets.jar
usr/lib/jvm/java-1.8-openjdk/jre/lib/cldrdata.jar
usr/lib/jvm/java-1.8-openjdk/jre/lib/dnsns.jar

My docker file is as follows

FROM alpine:3.14

RUN apk update \
    && apk upgrade \
    && apk add --no-cache openjdk8 dumb-init \
    && rm -rf \
         /usr/share/man/* \
         /usr/includes/* \
         /var/cache/apk/*

Is there other repo I should be getting from to get the proper libraries?

Answer 1

Finding the right package based on a file you know is missing on Alpine is pretty straightforward.

You just need to go to the page https://pkgs.alpinelinux.org/contents and fill in the file name.
Here, filling in the file name charsets.jar is pointing at the fact that you should install the package openjdk8-jre-lib.

Furthermore, mind that the --no-cache flag you are using is already doing update, upgrade and the rm on /var/cache/apk/*.

So, a trimmed working Dockerfile would be

FROM alpine:3.14

RUN apk add --no-cache \
         dumb-init \
         openjdk8 \
         openjdk8-jre-lib \
    && rm -rf \
         /usr/includes/* \
         /usr/share/man/* 

^{Also mind about the good practice "sort multi-line arguments", applied here.}