[tonygermano]

Stacked on #13, which is stacked on #12. Review and merge those first. This PR only adds the last two commits.

Summary

Adds images for OIE 4.7.0 and moves the latest tags to it. Also moves the 4.6.0 images to the current Java 21 base image.

Version	Base image before	Base image after
4.7.0	(new)	eclipse-temurin 21.0.12.1_1-{jre,jdk}-{resolute,alpine}
4.6.0	eclipse-temurin 21.0.11_10-…	eclipse-temurin 21.0.12.1_1-…
4.5.2	eclipse-temurin 17.0.20.1_1-…	unchanged (already current)

4.7.0 uses Java 21 to match the 4.7.0 installers, which now bundle Temurin 21. Java 17 is still the minimum supported version.

Commits

1. Update the 4.6.0 base images to eclipse-temurin 21.0.12.1_1. Changes releases.yaml and re-renders dockerfiles/4.6.0/.
2. Add 4.7.0 images and make them latest.
   • Adds the 4.7.0 entry to releases.yaml, sets latest: 4.7.0 and renders dockerfiles/4.7.0/.
   • Re-rendering dockerfiles/4.6.0/compose.yaml removes its latest* tags.
   • The README lists the 4.7.0 tags and points the floating tags at 4.7.0.
   • The build workflow needs no change, because Conversion of templated dockerfiles from BrightCodeCompany repo #12 builds the matrix from releases.yaml.

The 4.7.0 tarball layout matches 4.6.0. It has the same oie/ root and the files the Dockerfile removes. The template needed no changes.

Testing

• The render script leaves the working tree unchanged, which is what the render check from Conversion of CI tooling from BrightCodeCompany repo #13 tests.
• docker compose config on dockerfiles/4.7.0/compose.yaml shows the expected tags:
  • 4.7.0-alpine and 4.7.0-ubuntu are on the JRE images only.
  • latest, latest-<distro> and latest-<distro>-<jvm> point at 4.7.0.
• I built ubuntu-jre and alpine-jre locally for linux/amd64.
  • In both, engine is 1000:1000 with no supplementary groups.
  • The server logs "Open Integration Engine 4.7.0 … server successfully started" on Temurin 21.0.12.1.
• I did not test the JDK variants or arm64 locally. The build workflow builds both.

Notes for later

• 4.7.0 changes the bundled Microsoft SQL Server driver from 8.4.1 to 10.2.4, and 10.2 encrypts connections by default. SQL Server users with untrusted certificates may need encrypt=false or trustServerCertif icate=true. That's an engine change, so I didn't add it to this README, but it may be worth a Known Limitations note.
• The 4.7.0 tarball now includes configure-from-env, from the engine repo's new in-repo Docker build. We should decide separately whether entrypoint.sh should use it or stay separate.

🤖 Generated with Claude Code

[mikeklemens]

Here's what I ran against this PR. I built dockerfiles/4.7.0/Dockerfile locally at 11692bc on 2026-10-28, targets alpine-jre and ubuntu-jre, natively on arm64 (macOS, Docker Desktop). I haven't tested amd64 or the JDK variants.

Image basics (both targets)

• Temurin 21.0.12.1, running as engine (uid 1000). unzip and bash are present.
• Both base images publish arm64, so the build was native, not emulated.
• /opt/engine is owned by engine. custom-extensions/ is owned by root. That didn't affect me because I install extensions into extensions/, but anyone writing into custom-extensions/ as engine at runtime would hit it.
• entrypoint.sh is byte-identical to the 4.6.0 one.

Behavior (on alpine-jre)

• Boots clean on embedded Derby and with a PostgreSQL sidecar.
• 4.7.0 no longer sets up admin/admin by default. Passing _MP_SERVER_INITIALADMINPASSWORD=admin through the entrypoint works. That might deserve a README line, since anyone with scripts that assume admin/admin will see "starts fine, can't log in."
• Passing: DOCTYPE handling in a batch File Reader and the strict HL7 v2 parser, the preprocessor no-return passthrough (engine#351 behaves as intended), servlet error responses, JS in on Java maps, code template contexts, the Web Service Sender, and container env handling.

Two things worth knowing

1. The Web Service Listener fails on this image. Every SOAP call returns HTTP 500 with the SAAJ meta-factory error. That's [BUG] Web Service Listener fails every SOAP request on Java 19+ (Unable to create SAAJ meta-factory) engine#509, already fixed by Fix Web Service Listener SOAP requests failing on JDK 19+ engine#508, but the fix landed after v4.7.0. Since these images default to Java 21, anyone using a WS Listener on 4.7.0-* will hit it until the next engine release. It might be worth noting the VMOPTIONS workaround from #509 somewhere.
2. The oieserver launcher changed in 4.7.0 (oieserver.vmoptions gained the "Add custom options above this comment." marker):
   • On 4.6.0, a final .vmoptions line with no trailing newline was silently dropped. On 4.7.0 it isn't. 👍
   • VMOPTIONS=-Xmx2g still gets overridden by the base include's -Xmx256m ([BUG] Docker VMOPTIONS environment variable Java options get overridden #5), so that's still open on 4.7.0.

Not tested: amd64, the JDK variants, --db backends other than PostgreSQL, SQL Server TLS defaults, and installing extensions at startup.

Happy to re-run any of this on the final published tags.

[mgaffigan]

I'll abstain. I still preferentially support publishing from the engine repo - but do not think that should block an official image being published.