[hung-nguyen-hoang]

Jira: GRIF-1176

Changes:

• Move all Centos base images to Fedora base images and using the Fedora base images same as MSF Ruby bricks:
  gdc-java-11-jre-centos9:202607101511.b527cf7b --> gdc-java-11-jre:202609300803.5ae07065-f44
• Using new Fedora base image for both LCM brick olds image (JRuby 9.2) and LCM bricks new image (JRuby 9.4)

Testing

• Success build all Dockerfiles on local

Summary by CodeRabbit

• Chores
  • Updated the Java 11 runtime container image and its associated image metadata.
  • Adjusted the set of packages included in the container.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 312760ca-2470-4029-98e2-cf166f745145

📥 Commits

Reviewing files that changed from the base of the PR and between da0197c and abd7b91.

📒 Files selected for processing: 2

• Dockerfile
• DockerfileOldImage

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Both Dockerfiles now use the newer Java 11 JRE base image and update the parent_image label. Their package-install lists also change: one removes gzip, and the other adds gnupg and bzip2.

Changes: Java 11 JRE Image Updates

Layer / File(s)	Summary
Docker image configuration Dockerfile, DockerfileOldImage	Both Dockerfiles reference the newer Java 11 JRE base image and update the parent_image label. Dockerfile removes gzip from its package list. DockerfileOldImage adds gnupg and bzip2.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to abd7b

The PR reports successful local builds, and this review found no concrete regression. Proceed with the normal image-build checks for both Dockerfiles.

Security architecture risk: 🔵 Low · up to abd7b

The base-image migration affects both container variants. Explicit application identities and installer-verification commands remain unchanged, and no introduced security issue was established. Inherited permissions, trust settings, and deployment rollback behavior remain unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — A security-relevant change inherited from the new parent could affect both container variants because they select the same dependency. The available evidence does not establish deployed instance counts, tenant reach, credentials, or downstream service authority.

Trust Boundaries and Controls

• observed — The existing build flow imports RVM keys over HTTPS and executes get.rvm.io before verifying a separately downloaded installer signature. That ordering predates this PR; the comparison establishes no introduced change to this remote-code trust path.

Hardening Proposals

• proposed — Before promotion, compare the old and new parent-image security metadata, including inherited permissions and CA trust, and confirm that the previous built application image remains available for rollback. This would resolve migration uncertainty rather than remediate an established vulnerability.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: replacing CentOS base images with Fedora base images.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the image tag,
Then hops along the Dockerfile track.
One package leaves, two join the row,
The updated base is set to go.
The labels match; the build steps show.}

_{Comment @coderabbitai help to get the list of available commands.}