chore: upgrade base image to eclipse-temurin 8

[rsbh]

What changed

Swaps both Docker stages onto Eclipse Temurin 8.

stage	before	after
build	adoptopenjdk:8-jdk-openj9	eclipse-temurin:8-jdk
runtime	openjdk:8-jre	eclipse-temurin:8-jre

Also bumps version to 0.8.1, and drops two dependencies that no longer resolve (see below).

Unblocking the build

./gradlew build currently fails on main for reasons unrelated to this change:

Could not find org.jfrog.buildinfo:build-info-extractor:2.6.3
Required by: org.jfrog.buildinfo:build-info-extractor-gradle:4.4.7

Both artifacts were published to JCenter only. JCenter is shut down and the Gradle Plugin Portal no longer proxies it, so neither resolves from any configured repository — Maven Central returns 404 for both. Nothing uses them: no com.jfrog.artifactory plugin is applied, and nothing under src/ references org.jfrog. They are removed here.

This is a prerequisite for the image change rather than a drive-by: the Dockerfile's build stage runs ./gradlew build, so docker build fails the same way. Without it the new base image cannot be exercised at all. Every remaining dependency, including the other buildscript classpath entry, resolves from Maven Central.

Why

Both current images are deprecated. openjdk is officially deprecated by the docker-library maintainers (docker-library/openjdk#505), and adoptopenjdk is superseded by Temurin. Neither receives further updates, so the runtime has been frozen on 8u342 (July 2022) and accumulating unpatched CVEs.

The JVM can't see its container. Nodes run cgroup v2 (cgroup2fs), and the JDK in raystack/firehose:0.8.0 predates cgroup v2 support, which landed in 8u372 (JDK-8230305). So UseContainerSupport=true is a lie in practice — the JVM reads the host's 62GB and sets MaxHeapSize ≈ 14GB, while the cgroup says 536870912 (512Mi). MaxRAMPercentage=25 is applied to the wrong denominator.

The JVM in the current image reports:

SpecVersion   1.8
VmName        OpenJDK 64-Bit Server VM
VmVendor      Oracle Corporation
VmVersion     25.342-b07        →  OpenJDK 8u342

8u342 shipped July 2022, before the 8u372 backport, so the code honouring UseContainerSupport only understands cgroup v1 paths and silently falls back to host values. Knock-on effects on a 512Mi pod on a 62GB node:

• The JVM will grow past the cgroup limit and get OOMKilled instead of raising OutOfMemoryError
• UseParallelGC selected ergonomically — Java 8's default collector, chosen because the JVM believes it is on a server-class machine
• availableProcessors() returns host cores, so GC and JIT thread counts are sized for the node, not the pod

Kubernetes documents 8u372+ as the requirement for cgroup v2 awareness. Temurin 8-jre currently resolves to 8u502-b07, well past that line.

Why Temurin and why the floating tag. Temurin is the Adoptium successor recommended by both deprecated images. The floating 8-jre tag keeps JRE and OS CVE fixes arriving on each rebuild; pinning an exact build is how this Dockerfile drifted onto a frozen 8u342 in the first place, and this repo has no Dependabot or Renovate config to raise bumps.

Verification

CI (build.yml) runs ./gradlew build, which exercises the Gradle fix but not the Dockerfile — the image is built only by package.yml on release, then pushed straight to raystack/firehose:latest. I could not build the image locally either, so the base image swap itself is unexercised until a release cuts an image. Worth a manual docker build . before merge.

Adding a build-only Docker step to build.yml would close that gap permanently, and is worth doing in a follow-up; build.yml also still uses the deprecated actions/checkout@v2 and actions/setup-java@v1, and has no Gradle caching.

Behavioural notes for reviewers:

• The build stage moves from OpenJ9 to HotSpot. It only produces a jar, so this affects build-time JVM behaviour only.
• Temurin's JDK image installs curl, so the jolokia agent download in the build stage is unaffected.
• CMD is deliberately untouched. Note it passes -server, -Dlogback.configurationFile and -Xloggc after the main class, so the JVM treats them as program args and ignores them. Pre-existing; not addressed here.
• Once running on a cgroup-v2-aware JVM, -XX:MaxRAMPercentage becomes the right way to size the heap. Default ergonomics give roughly 25% of the limit, which may be conservative for large batch sizes.

✔️ Checklist

• A changelog describing the changes and affected packages. — commit messages
• Added or updated documentation — n/a, no user-facing config or protocol change
• Tests for new functionality and regression tests for bug fixes — n/a, base image and build-dependency change; see Verification above
• Screenshots attached (for UI changes) — n/a

🤖 Generated with Claude Code

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 82f5a900-69f5-4225-90e1-ade2d494202e

📥 Commits

Reviewing files that changed from the base of the PR and between 573bf56 and 14fb3dd.

📒 Files selected for processing (1)

• build.gradle

💤 Files with no reviewable changes (1)

• build.gradle

Included review availability: Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Docker build and runtime stages now use Eclipse Temurin 8 images. The build steps and runtime files remain unchanged. The project version increases from 0.8.0 to 0.8.1. The JFrog build-info plugin and implementation dependency are removed.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 14fb3

No actionable issue was found. The image build remains unverified, so run it as a normal release check before deployment.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely identifies the primary change: upgrading both Docker base images to Eclipse Temurin 8.
Description check	✅ Passed	The description directly explains the Docker image changes, version bump, removed dependencies, rationale, and verification status. It is related to the changeset.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}