Ping Identity Devops

Ping Identity DevOps Parent Images — pingbase and pingbase-java

Ping product Docker images do not build an operating system or Java runtime from scratch. Every product image starts from a Ping-provided parent image — pingidentity/pingbase (OS only) or pingidentity/pingbase-java (OS plus Java runtime) — published on Docker Hub. The product layer is added on top of the parent image, so product builds pull the parent automatically for the build process.

The JVM distribution bundled in pingbase-java is BellSoft Liberica. JDK tracks 17, 21, and 25 are built; 25 is the default for all shipping products (17 and 21 exist for custom and back-level builds).

Available tags

Image Tag Contents

pingidentity/pingbase

alpine3.24

Alpine 3.24 base OS. Multi-arch (amd64 + arm64).

pingidentity/pingbase

alpine

Rolling pointer to the newest supported Alpine major. Use only if you want OS major upgrades automatically.

pingidentity/pingbase

ubi9

Red Hat UBI 9 minimal base OS. Multi-arch (amd64 + arm64).

pingidentity/pingbase

ubi

Rolling pointer to the newest supported UBI major.

pingidentity/pingbase-java

alpine3.24-jdk17, alpine3.24-jdk21, alpine3.24-jdk25

Alpine 3.24 plus the Liberica JDK. Multi-arch (amd64 + arm64).

pingidentity/pingbase-java

ubi9-jdk17, ubi9-jdk21, ubi9-jdk25

UBI 9 plus the Liberica JDK. Multi-arch (amd64 + arm64).

pingidentity/pingbase-java

alpine3.24-jre17 … alpine3.24-jre25, ubi9-jre17 … ubi9-jre25

Same as the JDK variants, with the Liberica JRE (smaller runtime footprint).

Tag names are stable while the image content is rebuilt regularly (and on demand, for example for CVE fixes) to float with upstream patch updates. The OS in the tag is pinned to the OS major (alpine3.24, ubi9); moving to a newer OS major is a deliberate change, not an automatic update.

Update and pinning policy

These tags are mutable: a tag points at the latest build for that OS major and Java version, and the image it resolves to changes over time. This mirrors the floating-tag behavior of our product images (see release tags).

To pin a specific build, reference the image by its digest rather than its tag, for example pingbase-java@sha256:…​. The digest is the immutability primitive: it identifies exactly one image. If your deployment pipeline records image digests, a re-pull of a pinned image can never pick up unexpected content.

Signature verification

Parent images published to Docker Hub are signed with Cosign using the same KMS-backed key as our product images. Verify them with the published public key before promoting or deploying; for step-by-step instructions, see Image Signature Verification.

Runtime contract

Product images inherit the following from the parent images:

  • User: runs as 9031:0 (user ping, group root). Product images that need to install or modify content during the build switch to USER 0:0 for those steps and return to the default.

  • Init: tini runs as PID 1 (/sbin/tini on Alpine, /usr/local/bin/tini on UBI), forwarding signals and reaping zombies. Product images chain their startup through it.

  • Working directory: /. Product images set their own working directories explicitly.

  • Java home: JAVA_HOME points at the Liberica installation (/usr/lib/jvm/bellsoft-java<N>-lite…​); on Alpine a JAVA_HOME symlink at /opt/java is preserved by product images for compatibility.

The parent images intentionally stay minimal: they carry no product hooks, staging logic, or server-profile handling. That framework lives in each product image.

Using a parent image in your own builds

If you build custom images from our products, reference the parent image directly:

FROM pingidentity/pingbase-java:alpine3.24-jdk25

The tag to use mirrors the product build matrix: the OS flavor (alpine3.24 for Alpine, ubi9 for UBI) and the JDK track (jdk17, jdk21, jdk25) follow the product’s versions.json shim and jvm values. For building a product image with your own product bits, see Build a Docker Product Image Locally.

Copyright © 2026 Ping Identity Corporation