If you use OpenJDK you can end up with an unknown version of Java - specifically whatever Debian or Canonical happened to pull from the source tree and ship, which in some cases have been automated top-of-tree pulls before. See for example: github.com/docker-library/openjdk/commit/00a9c5...