I have packaged 4.2.8 as a debian package https://steinar.bang.priv.no/2018/01/23/installing-apache-karaf-on-debian/comment-page-1/#comment-15187
I have only tested this with openjdk 11 on debian 10.3 "buster" on amd64, but I use it there in production. Note1! I needed to sign with a different key because of an aptly bug, so anyone already using my APT repository will need to add an extra GPG key. I have updated the apt-key command example in the blog post to reflect this.
