anchor.diff:      build-essential \
       curl \
       unzip
  -RUN apt-get update
  -RUN apt-get install -y ${BUILD_DEPS}
  +RUN apt-get update && apt-get install -y ${BUILD_DEPS}
   
   # Install Bazel
   ARG BAZEL_VER
   RUN curl -L -o bazel.sh https://github.com/bazelbuild/bazel/releases/download/${BAZEL_VER}/bazel-${BAZEL_VER}-installer-linux-x86_64.sh
  -RUN chmod +x bazel.sh && ./bazel.sh --user
  +RUN chmod +x bazel.sh && ./bazel.sh
   
   # Build-stage environment variables
  -ENV ONOS_ROOT=/src/onos
  +ENV ONOS_ROOT /src/onos
   ENV BUILD_NUMBER docker
   ENV JAVA_TOOL_OPTIONS=-Dfile.encoding=UTF8
  -
  -# Build ONOS. We extract the tar in the build environment to avoid having to put
  -# the tar in the runtime stage. This saves a lot of space.
  -# Note: we don't install a JDK but instead we rely on that provided by Bazel.
   
   # Copy in the sources
   COPY . ${ONOS_ROOT}
   WORKDIR ${ONOS_ROOT}
   
  +# Build ONOS using the JDK pre-installed in the base image, instead of the
  +# Bazel-provided remote one. By doing wo we make sure to build with the most
  +# updated JDK, including bug and security fixes, independently of the Bazel
  +# version.
   ARG JOBS
  -ENV BAZEL_BUILD_ARGS \
  +ARG JDK_VER
  +RUN bazel build onos \
       --jobs ${JOBS} \
  -    --verbose_failures
  -RUN ~/bin/bazel build onos ${BAZEL_BUILD_ARGS}
  +    --verbose_failures \
  +    --javabase=@bazel_tools//tools/jdk:absolute_javabase \
  +    --host_javabase=@bazel_tools//tools/jdk:absolute_javabase \
  +    --define=ABSOLUTE_JAVABASE=/usr/lib/jvm/zulu-${JDK_VER}-amd64
   
  -RUN mkdir /src/tar
  -RUN tar -xf bazel-bin/onos.tar.gz -C /src/tar --strip-components=1
  +# We extract the tar in the build environment to avoid having to put the tar in
  +# the runtime stage. This saves a lot of space.
  +RUN mkdir /output
  +RUN tar -xf bazel-bin/onos.tar.gz -C /output --strip-components=1
   
  -# Second stage is the runtime environment.
  -# We use Amazon Corretto official Docker image, bazed on Amazon Linux 2 (rhel/fedora like)
  -FROM amazoncorretto:${JDK_VER}
  -
  -MAINTAINER Ray Milkey <ray@opennetworking.org>
  -
  -# Change to /root directory
  -RUN     mkdir -p /root/onos
  -WORKDIR /root/onos
  -
  -# Install ONOS
  -COPY --from=builder /src/tar/ .
  -
  -# Configure ONOS to log to stdout
  -RUN sed -ibak '/log4j.rootLogger=/s/$/, stdout/' $(ls -d apache-karaf-*)/etc/org.ops4j.pax.logging.cfg
  +# Second and final stage is the runtime environment.
  +FROM azul/zulu-openjdk:${JDK_VER}
   
   LABEL org.label-schema.name="ONOS" \
         org.label-schema.description="SDN Controller" \
         org.label-schema.usage="http://wiki.onosproject.org" \
         org.label-schema.url="http://onosproject.org" \
         org.label-scheme.vendor="Open Networking Foundation" \
  -      org.label-schema.schema-version="1.0"
  +      org.label-schema.schema-version="1.0" \
  +      maintainer="onos-dev@onosproject.org"
  +
  +# Install ONOS in /root/onos
  +COPY --from=builder /output/ /root/onos/
  +WORKDIR /root/onos
  +
  +# Set JAVA_HOME (by default not exported by zulu images)
  +ARG JDK_VER
  +ENV JAVA_HOME /usr/lib/jvm/zulu-${JDK_VER}-amd64
   
   # Ports
   # 6653 - OpenFlow
  
positive.code: # 9876 - ONOS intra-cluster communication
  EXPOSE 6653 6640 8181 8101 9876
  
  # Get ready to run command
  ENTRYPOINT ["./bin/onos-service"]
  CMD ["server"]
  
negative.code: ARG JOBS=2
  
  # First stage is the build environment.
  # zulu-openjdk images are based on Ubuntu.
  FROM azul/zulu-openjdk:${JDK_VER} as builder
  
  ENV BUILD_DEPS \
      ca-certificates \
  