Azul & Chainguard launch secure Java containers for enterprises

Azul and Chainguard have announced a strategic partnership aimed at delivering secure Java containers for enterprise workloads.

The partnership brings together Azul's commercial support and OpenJDK distributions with Chainguard's Linux distribution, software factory, and container images. As part of the collaboration, Chainguard will build Java container images from source, incorporating Azul's commercially supported build of OpenJDK, a component of the Azul Platform Core.

According to the companies, this joint solution is designed to enable enterprises to accelerate developer productivity, minimise routine engineering challenges, and strengthen software supply chain security for organisations running Java workloads in containerised environments.

Addressing software security complexity

Java is integral to the functioning of many enterprise applications, necessitating timely access to secure and updated builds. Azul provides fully supported OpenJDK builds, which can serve as direct replacements for Oracle Java, helping organisations maintain compliance and security while reducing costs. Chainguard Containers, meanwhile, assist in securing the operating system and application runtime environment for containers.

Many modern enterprises struggle with the complexity of securing their software stacks - from operating system layers to the Java runtime and development toolchain. Security and engineering teams face ongoing challenges such as frequent vulnerability disclosures, inconsistent patching, and the need to harden containers and virtual machines, all without hindering developer productivity.

The issue is particularly pronounced for Java workloads, which demand up-to-date patches, commercial support, and secure deployment environments. A study conducted by NetRise found that the average software container has 604 known vulnerabilities, with over 45% of those vulnerabilities being between two and ten years old. This underscores the ongoing risks faced by businesses relying on containerised applications.

Additionally, Azul's 2025 State of Java Survey & Report highlighted operational difficulties: 33% of respondents indicated that their DevOps teams spend more than half of their time managing false positives from Java-related vulnerabilities. Furthermore, 49% of firms are still encountering the effects of the Log4j vulnerability in production, three years after it originally came to light.

Combined offering to reduce risk and support faster deployment

The partnership seeks to tackle these issues by providing containers for Java versions 21 and beyond that have zero reported vulnerabilities, are built from Azul source code, and include support from Azul's commercial Java team. The companies state that this solution offers a secure foundation for Java applications, reducing risks and supporting quicker development cycles.

The Java container images, integrated by Azul and Chainguard, will be built from source and validated using the Java Compatibility Kit (JCK, TCK). Customers will thus have access to containers with minimal risk surface area and continued commercial support for their Java runtimes. Azul's security-only Critical Patch Updates allow customers to swiftly deploy new Java images, decreasing the operational burden of regular patching and testing for individual containers.

"Our customers need solutions that reduce risk and build trust at every layer of their modern software deployment stack. Today, we're bringing Chainguard's expertise in building minimal, zero-CVE images and Azul's expertise in Java together to create the most secure, commercial-grade containers for cloud-native workloads," said Dan Lorenc, Co-Founder and Chief Executive Officer at Chainguard.

The approach is aimed at giving enterprises the option of secure, reliable Java containers without having to compromise on the timeliness of updates or the quality of commercial support.

Scott Sellers, Co-Founder and Chief Executive Officer at Azul, shares:

"Choosing a hardened container shouldn't mean sacrificing timely security-only updates and commercial support services for your Java runtimes. Today, we're excited to offer enterprises best-in-breed hardened Java containers from Chainguard while leveraging world-class commercial support from Azul."

Joint customers consuming these new Java container images via Chainguard Containers will receive commercial support services through Azul Platform Core.

The companies expect the partnership to allow organisations to realign development resources and streamline the process of shipping secure, supported software across their Java workloads.