From 6ae0c4ceee1b950df67bedc49f3dd5ed32b1a6e9 Mon Sep 17 00:00:00 2001
From: Kirby Chin <37311900+kabicin@users.noreply.github.com>
Date: Mon, 10 Aug 2026 16:13:31 -0400
Subject: [PATCH 1/6] Disable automatic config monitoring and HTTP_PORT
---
ga/latest/kernel/Dockerfile.ubi.ibmjava8 | 3 +-
ga/latest/kernel/Dockerfile.ubi.openjdk11 | 3 +-
ga/latest/kernel/Dockerfile.ubi.openjdk17 | 3 +-
ga/latest/kernel/Dockerfile.ubi.openjdk8 | 3 +-
.../kernel/Dockerfile.ubi10-minimal.ibmjava8 | 3 +-
.../kernel/Dockerfile.ubi10-minimal.openjdk11 | 3 +-
.../kernel/Dockerfile.ubi10-minimal.openjdk17 | 3 +-
.../kernel/Dockerfile.ubi10-minimal.openjdk21 | 3 +-
.../kernel/Dockerfile.ubi10-minimal.openjdk25 | 3 +-
.../kernel/Dockerfile.ubi10-minimal.openjdk8 | 3 +-
ga/latest/kernel/Dockerfile.ubuntu.ibmjava8 | 3 +-
ga/latest/kernel/Dockerfile.ubuntu.openjdk11 | 3 +-
ga/latest/kernel/Dockerfile.ubuntu.openjdk17 | 3 +-
.../configuration_snippets/config-mbean.xml | 6 +++
.../configuration_snippets/http-endpoint.xml | 2 +-
.../http-ssl-endpoint.xml | 2 +-
ga/latest/kernel/helpers/build/configure.sh | 16 +++++++
ga/latest/kernel/helpers/build/features.sh | 46 -------------------
18 files changed, 50 insertions(+), 61 deletions(-)
create mode 100644 ga/latest/kernel/helpers/build/configuration_snippets/config-mbean.xml
delete mode 100755 ga/latest/kernel/helpers/build/features.sh
diff --git a/ga/latest/kernel/Dockerfile.ubi.ibmjava8 b/ga/latest/kernel/Dockerfile.ubi.ibmjava8
index 8997224e5..6bade0711 100644
--- a/ga/latest/kernel/Dockerfile.ubi.ibmjava8
+++ b/ga/latest/kernel/Dockerfile.ubi.ibmjava8
@@ -174,11 +174,12 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
+ ENABLE_HTTP_PORT=false \
IBM_JAVA_OPTIONS="-Xshareclasses:name=liberty,readonly,nonfatal,cacheDir=/output/.classCache/ -Dosgi.checkConfiguration=false ${IBM_JAVA_OPTIONS}"
USER 1001
-EXPOSE 9080 9443
+EXPOSE 9443
ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubi.openjdk11 b/ga/latest/kernel/Dockerfile.ubi.openjdk11
index 23e3d4f98..e7b07a9db 100644
--- a/ga/latest/kernel/Dockerfile.ubi.openjdk11
+++ b/ga/latest/kernel/Dockerfile.ubi.openjdk11
@@ -176,11 +176,12 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
+ ENABLE_HTTP_PORT=false \
OPENJ9_JAVA_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Dosgi.checkConfiguration=false"
USER 1001
-EXPOSE 9080 9443
+EXPOSE 9443
ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubi.openjdk17 b/ga/latest/kernel/Dockerfile.ubi.openjdk17
index d0175b0e6..69e7e15d9 100644
--- a/ga/latest/kernel/Dockerfile.ubi.openjdk17
+++ b/ga/latest/kernel/Dockerfile.ubi.openjdk17
@@ -175,11 +175,12 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
+ ENABLE_HTTP_PORT=false \
OPENJ9_JAVA_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Dosgi.checkConfiguration=false"
USER 1001
-EXPOSE 9080 9443
+EXPOSE 9443
ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubi.openjdk8 b/ga/latest/kernel/Dockerfile.ubi.openjdk8
index ea065b4cc..b60753261 100644
--- a/ga/latest/kernel/Dockerfile.ubi.openjdk8
+++ b/ga/latest/kernel/Dockerfile.ubi.openjdk8
@@ -175,11 +175,12 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
+ ENABLE_HTTP_PORT=false \
OPENJ9_JAVA_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Dosgi.checkConfiguration=false"
USER 1001
-EXPOSE 9080 9443
+EXPOSE 9443
ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubi10-minimal.ibmjava8 b/ga/latest/kernel/Dockerfile.ubi10-minimal.ibmjava8
index d86da65b0..ad4e6d1b8 100644
--- a/ga/latest/kernel/Dockerfile.ubi10-minimal.ibmjava8
+++ b/ga/latest/kernel/Dockerfile.ubi10-minimal.ibmjava8
@@ -188,11 +188,12 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
+ ENABLE_HTTP_PORT=false \
IBM_JAVA_OPTIONS="-Xshareclasses:name=liberty,readonly,nonfatal,cacheDir=/output/.classCache/ -Dosgi.checkConfiguration=false ${IBM_JAVA_OPTIONS}"
USER 1001
-EXPOSE 9080 9443
+EXPOSE 9443
ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk11 b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk11
index cd88363bb..ec7c2b0ca 100644
--- a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk11
+++ b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk11
@@ -175,11 +175,12 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
+ ENABLE_HTTP_PORT=false \
OPENJ9_JAVA_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Dosgi.checkConfiguration=false"
USER 1001
-EXPOSE 9080 9443
+EXPOSE 9443
ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk17 b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk17
index f8fbbc094..f6cc72740 100644
--- a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk17
+++ b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk17
@@ -175,11 +175,12 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
+ ENABLE_HTTP_PORT=false \
OPENJ9_JAVA_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Dosgi.checkConfiguration=false"
USER 1001
-EXPOSE 9080 9443
+EXPOSE 9443
ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk21 b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk21
index 5818627b9..75f592eac 100644
--- a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk21
+++ b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk21
@@ -175,11 +175,12 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
+ ENABLE_HTTP_PORT=false \
OPENJ9_JAVA_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Dosgi.checkConfiguration=false"
USER 1001
-EXPOSE 9080 9443
+EXPOSE 9443
ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk25 b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk25
index b5a71c379..3e6e26a52 100644
--- a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk25
+++ b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk25
@@ -175,11 +175,12 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
+ ENABLE_HTTP_PORT=false \
OPENJ9_JAVA_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Dosgi.checkConfiguration=false"
USER 1001
-EXPOSE 9080 9443
+EXPOSE 9443
ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk8 b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk8
index 9f6a02b36..3c8f551d8 100644
--- a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk8
+++ b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk8
@@ -175,11 +175,12 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
+ ENABLE_HTTP_PORT=false \
OPENJ9_JAVA_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Dosgi.checkConfiguration=false"
USER 1001
-EXPOSE 9080 9443
+EXPOSE 9443
ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubuntu.ibmjava8 b/ga/latest/kernel/Dockerfile.ubuntu.ibmjava8
index 0a87a63b7..8c64b3730 100644
--- a/ga/latest/kernel/Dockerfile.ubuntu.ibmjava8
+++ b/ga/latest/kernel/Dockerfile.ubuntu.ibmjava8
@@ -155,11 +155,12 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
+ ENABLE_HTTP_PORT=false \
IBM_JAVA_OPTIONS="-Xshareclasses:name=liberty,readonly,nonfatal,cacheDir=/output/.classCache/ -Dosgi.checkConfiguration=false ${IBM_JAVA_OPTIONS}"
USER 1001
-EXPOSE 9080 9443
+EXPOSE 9443
ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubuntu.openjdk11 b/ga/latest/kernel/Dockerfile.ubuntu.openjdk11
index cd6650ad4..b492763a0 100644
--- a/ga/latest/kernel/Dockerfile.ubuntu.openjdk11
+++ b/ga/latest/kernel/Dockerfile.ubuntu.openjdk11
@@ -150,11 +150,12 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
+ ENABLE_HTTP_PORT=false \
OPENJ9_JAVA_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Dosgi.checkConfiguration=false"
USER 1001
-EXPOSE 9080 9443
+EXPOSE 9443
ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubuntu.openjdk17 b/ga/latest/kernel/Dockerfile.ubuntu.openjdk17
index ba4a34857..629170c82 100644
--- a/ga/latest/kernel/Dockerfile.ubuntu.openjdk17
+++ b/ga/latest/kernel/Dockerfile.ubuntu.openjdk17
@@ -150,11 +150,12 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
+ ENABLE_HTTP_PORT=false \
OPENJ9_JAVA_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Dosgi.checkConfiguration=false"
USER 1001
-EXPOSE 9080 9443
+EXPOSE 9443
ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/helpers/build/configuration_snippets/config-mbean.xml b/ga/latest/kernel/helpers/build/configuration_snippets/config-mbean.xml
new file mode 100644
index 000000000..b97391b58
--- /dev/null
+++ b/ga/latest/kernel/helpers/build/configuration_snippets/config-mbean.xml
@@ -0,0 +1,6 @@
+
+
+
+
+
diff --git a/ga/latest/kernel/helpers/build/configuration_snippets/http-endpoint.xml b/ga/latest/kernel/helpers/build/configuration_snippets/http-endpoint.xml
index 5f6c60552..8244e386f 100644
--- a/ga/latest/kernel/helpers/build/configuration_snippets/http-endpoint.xml
+++ b/ga/latest/kernel/helpers/build/configuration_snippets/http-endpoint.xml
@@ -1,5 +1,5 @@
-
+
diff --git a/ga/latest/kernel/helpers/build/configuration_snippets/http-ssl-endpoint.xml b/ga/latest/kernel/helpers/build/configuration_snippets/http-ssl-endpoint.xml
index 2a2388a3c..b4554a8f6 100644
--- a/ga/latest/kernel/helpers/build/configuration_snippets/http-ssl-endpoint.xml
+++ b/ga/latest/kernel/helpers/build/configuration_snippets/http-ssl-endpoint.xml
@@ -2,5 +2,5 @@
-
+
diff --git a/ga/latest/kernel/helpers/build/configure.sh b/ga/latest/kernel/helpers/build/configure.sh
index a1ed20628..ed119fddb 100755
--- a/ga/latest/kernel/helpers/build/configure.sh
+++ b/ga/latest/kernel/helpers/build/configure.sh
@@ -36,6 +36,10 @@ function main() {
mkdir -p ${SNIPPETS_TARGET}
mkdir -p ${SNIPPETS_TARGET_DEFAULTS}
+ # Disable automatic configuration file monitoring (security hardening)
+ cp $SNIPPETS_SOURCE/config-mbean.xml $SNIPPETS_TARGET/config-mbean.xml
+ chmod g+rw $SNIPPETS_TARGET/config-mbean.xml
+
# Check for each Liberty value-add functionality
if [ "$FEATURES_INSTALLED" == "false" ]; then
# HTTP Endpoint
@@ -47,6 +51,18 @@ function main() {
fi
fi
+ # Re-enable plain HTTP port when explicitly requested (disabled by default for security)
+ if [ "$ENABLE_HTTP_PORT" == "true" ]; then
+ cat > $SNIPPETS_TARGET/enable-http-port.xml <<'EOF'
+
+
+
+
+
+EOF
+ chmod g+rw $SNIPPETS_TARGET/enable-http-port.xml
+ fi
+
# MicroProfile Health
if [ "$MP_HEALTH_CHECK" == "true" ]; then
cp $SNIPPETS_SOURCE/mp-health-check.xml $SNIPPETS_TARGET/mp-health-check.xml
diff --git a/ga/latest/kernel/helpers/build/features.sh b/ga/latest/kernel/helpers/build/features.sh
deleted file mode 100755
index 2773c5066..000000000
--- a/ga/latest/kernel/helpers/build/features.sh
+++ /dev/null
@@ -1,46 +0,0 @@
-#!/bin/bash
-# (C) Copyright IBM Corporation 2023, 2025.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-. /opt/ibm/helpers/build/internal/logger.sh
-
-set -Eeo pipefail
-
-##Define variables for XML snippets source and target paths
-SNIPPETS_SOURCE=/opt/ibm/helpers/build/configuration_snippets
-SNIPPETS_TARGET=/config/configDropins/overrides
-SNIPPETS_TARGET_DEFAULTS=/config/configDropins/defaults
-mkdir -p ${SNIPPETS_TARGET}
-mkdir -p ${SNIPPETS_TARGET_DEFAULTS}
-
-# Session Caching
-if [ -n "$INFINISPAN_SERVICE_NAME" ] || [ "${HZ_SESSION_CACHE}" == "client" ] || [ "${HZ_SESSION_CACHE}" == "embedded" ]; then
- cp ${SNIPPETS_SOURCE}/sessioncache-features.xml ${SNIPPETS_TARGET}/sessioncache-features.xml
- chmod g+rw $SNIPPETS_TARGET/sessioncache-features.xml
-fi
-
-# SSO
-if [[ -n "$SEC_SSO_PROVIDERS" ]]; then
- cp $SNIPPETS_SOURCE/sso-features.xml $SNIPPETS_TARGET_DEFAULTS
-fi
-
-# Key Store
-if [ "$SSL" == "true" ] || [ "$TLS" == "true" ]; then
- cp $SNIPPETS_SOURCE/tls.xml $SNIPPETS_TARGET/tls.xml
-fi
-
-# Install necessary features using featureUtility
-featureUtility installServerFeatures --acceptLicense defaultServer --noCache
-find /opt/ibm/wlp/lib /opt/ibm/wlp/bin ! -perm -g=rw -print0 | xargs -0 -r chmod g+rw
-
-echo "features.sh script has been run" > /logs/features.log
From 5b7753217ef712c402531badb8d5c6fb5ac3d559 Mon Sep 17 00:00:00 2001
From: Kirby Chin <37311900+kabicin@users.noreply.github.com>
Date: Mon, 10 Aug 2026 16:19:08 -0400
Subject: [PATCH 2/6] Add productInfo validate in features.sh
---
ga/latest/kernel/helpers/build/features.sh | 49 ++++++++++++++++++++++
1 file changed, 49 insertions(+)
create mode 100755 ga/latest/kernel/helpers/build/features.sh
diff --git a/ga/latest/kernel/helpers/build/features.sh b/ga/latest/kernel/helpers/build/features.sh
new file mode 100755
index 000000000..8ae733278
--- /dev/null
+++ b/ga/latest/kernel/helpers/build/features.sh
@@ -0,0 +1,49 @@
+#!/bin/bash
+# (C) Copyright IBM Corporation 2023, 2025.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+. /opt/ibm/helpers/build/internal/logger.sh
+
+set -Eeo pipefail
+
+##Define variables for XML snippets source and target paths
+SNIPPETS_SOURCE=/opt/ibm/helpers/build/configuration_snippets
+SNIPPETS_TARGET=/config/configDropins/overrides
+SNIPPETS_TARGET_DEFAULTS=/config/configDropins/defaults
+mkdir -p ${SNIPPETS_TARGET}
+mkdir -p ${SNIPPETS_TARGET_DEFAULTS}
+
+# Session Caching
+if [ -n "$INFINISPAN_SERVICE_NAME" ] || [ "${HZ_SESSION_CACHE}" == "client" ] || [ "${HZ_SESSION_CACHE}" == "embedded" ]; then
+ cp ${SNIPPETS_SOURCE}/sessioncache-features.xml ${SNIPPETS_TARGET}/sessioncache-features.xml
+ chmod g+rw $SNIPPETS_TARGET/sessioncache-features.xml
+fi
+
+# SSO
+if [[ -n "$SEC_SSO_PROVIDERS" ]]; then
+ cp $SNIPPETS_SOURCE/sso-features.xml $SNIPPETS_TARGET_DEFAULTS
+fi
+
+# Key Store
+if [ "$SSL" == "true" ] || [ "$TLS" == "true" ]; then
+ cp $SNIPPETS_SOURCE/tls.xml $SNIPPETS_TARGET/tls.xml
+fi
+
+# Install necessary features using featureUtility
+featureUtility installServerFeatures --acceptLicense defaultServer --noCache
+find /opt/ibm/wlp/lib /opt/ibm/wlp/bin ! -perm -g=rw -print0 | xargs -0 -r chmod g+rw
+
+# Validate the Liberty installation integrity after feature installation
+/opt/ibm/wlp/bin/productInfo validate
+
+echo "features.sh script has been run" > /logs/features.log
From 7becfb81bcae469d7c80e9ba79cc999b14a26ac2 Mon Sep 17 00:00:00 2001
From: Kirby Chin <37311900+kabicin@users.noreply.github.com>
Date: Thu, 13 Aug 2026 14:38:26 -0400
Subject: [PATCH 3/6] Set httpPort="-1" by default
---
ga/latest/kernel/Dockerfile.ubi.ibmjava8 | 1 -
ga/latest/kernel/Dockerfile.ubi.openjdk11 | 1 -
ga/latest/kernel/Dockerfile.ubi.openjdk17 | 1 -
ga/latest/kernel/Dockerfile.ubi.openjdk8 | 1 -
.../kernel/Dockerfile.ubi10-minimal.ibmjava8 | 1 -
.../kernel/Dockerfile.ubi10-minimal.openjdk11 | 1 -
.../kernel/Dockerfile.ubi10-minimal.openjdk17 | 1 -
.../kernel/Dockerfile.ubi10-minimal.openjdk21 | 1 -
.../kernel/Dockerfile.ubi10-minimal.openjdk25 | 1 -
.../kernel/Dockerfile.ubi10-minimal.openjdk8 | 1 -
ga/latest/kernel/Dockerfile.ubuntu.ibmjava8 | 1 -
ga/latest/kernel/Dockerfile.ubuntu.openjdk11 | 1 -
ga/latest/kernel/Dockerfile.ubuntu.openjdk17 | 1 -
.../configuration_snippets/http-endpoint.xml | 2 +-
.../http-ssl-endpoint.xml | 2 +-
ga/latest/kernel/helpers/build/configure.sh | 31 ++++++++++---------
16 files changed, 19 insertions(+), 29 deletions(-)
diff --git a/ga/latest/kernel/Dockerfile.ubi.ibmjava8 b/ga/latest/kernel/Dockerfile.ubi.ibmjava8
index 6bade0711..a80f05870 100644
--- a/ga/latest/kernel/Dockerfile.ubi.ibmjava8
+++ b/ga/latest/kernel/Dockerfile.ubi.ibmjava8
@@ -174,7 +174,6 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
- ENABLE_HTTP_PORT=false \
IBM_JAVA_OPTIONS="-Xshareclasses:name=liberty,readonly,nonfatal,cacheDir=/output/.classCache/ -Dosgi.checkConfiguration=false ${IBM_JAVA_OPTIONS}"
USER 1001
diff --git a/ga/latest/kernel/Dockerfile.ubi.openjdk11 b/ga/latest/kernel/Dockerfile.ubi.openjdk11
index e7b07a9db..ceda338ac 100644
--- a/ga/latest/kernel/Dockerfile.ubi.openjdk11
+++ b/ga/latest/kernel/Dockerfile.ubi.openjdk11
@@ -176,7 +176,6 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
- ENABLE_HTTP_PORT=false \
OPENJ9_JAVA_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Dosgi.checkConfiguration=false"
USER 1001
diff --git a/ga/latest/kernel/Dockerfile.ubi.openjdk17 b/ga/latest/kernel/Dockerfile.ubi.openjdk17
index 69e7e15d9..f49e08e46 100644
--- a/ga/latest/kernel/Dockerfile.ubi.openjdk17
+++ b/ga/latest/kernel/Dockerfile.ubi.openjdk17
@@ -175,7 +175,6 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
- ENABLE_HTTP_PORT=false \
OPENJ9_JAVA_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Dosgi.checkConfiguration=false"
USER 1001
diff --git a/ga/latest/kernel/Dockerfile.ubi.openjdk8 b/ga/latest/kernel/Dockerfile.ubi.openjdk8
index b60753261..27d1a9ff1 100644
--- a/ga/latest/kernel/Dockerfile.ubi.openjdk8
+++ b/ga/latest/kernel/Dockerfile.ubi.openjdk8
@@ -175,7 +175,6 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
- ENABLE_HTTP_PORT=false \
OPENJ9_JAVA_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Dosgi.checkConfiguration=false"
USER 1001
diff --git a/ga/latest/kernel/Dockerfile.ubi10-minimal.ibmjava8 b/ga/latest/kernel/Dockerfile.ubi10-minimal.ibmjava8
index ad4e6d1b8..1d66e75f6 100644
--- a/ga/latest/kernel/Dockerfile.ubi10-minimal.ibmjava8
+++ b/ga/latest/kernel/Dockerfile.ubi10-minimal.ibmjava8
@@ -188,7 +188,6 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
- ENABLE_HTTP_PORT=false \
IBM_JAVA_OPTIONS="-Xshareclasses:name=liberty,readonly,nonfatal,cacheDir=/output/.classCache/ -Dosgi.checkConfiguration=false ${IBM_JAVA_OPTIONS}"
USER 1001
diff --git a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk11 b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk11
index ec7c2b0ca..61cb34dbe 100644
--- a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk11
+++ b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk11
@@ -175,7 +175,6 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
- ENABLE_HTTP_PORT=false \
OPENJ9_JAVA_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Dosgi.checkConfiguration=false"
USER 1001
diff --git a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk17 b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk17
index f6cc72740..0f25914ee 100644
--- a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk17
+++ b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk17
@@ -175,7 +175,6 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
- ENABLE_HTTP_PORT=false \
OPENJ9_JAVA_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Dosgi.checkConfiguration=false"
USER 1001
diff --git a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk21 b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk21
index 75f592eac..75250af15 100644
--- a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk21
+++ b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk21
@@ -175,7 +175,6 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
- ENABLE_HTTP_PORT=false \
OPENJ9_JAVA_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Dosgi.checkConfiguration=false"
USER 1001
diff --git a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk25 b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk25
index 3e6e26a52..e650bf03f 100644
--- a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk25
+++ b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk25
@@ -175,7 +175,6 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
- ENABLE_HTTP_PORT=false \
OPENJ9_JAVA_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Dosgi.checkConfiguration=false"
USER 1001
diff --git a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk8 b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk8
index 3c8f551d8..821cf7fde 100644
--- a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk8
+++ b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk8
@@ -175,7 +175,6 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
- ENABLE_HTTP_PORT=false \
OPENJ9_JAVA_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Dosgi.checkConfiguration=false"
USER 1001
diff --git a/ga/latest/kernel/Dockerfile.ubuntu.ibmjava8 b/ga/latest/kernel/Dockerfile.ubuntu.ibmjava8
index 8c64b3730..4573f53f3 100644
--- a/ga/latest/kernel/Dockerfile.ubuntu.ibmjava8
+++ b/ga/latest/kernel/Dockerfile.ubuntu.ibmjava8
@@ -155,7 +155,6 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
- ENABLE_HTTP_PORT=false \
IBM_JAVA_OPTIONS="-Xshareclasses:name=liberty,readonly,nonfatal,cacheDir=/output/.classCache/ -Dosgi.checkConfiguration=false ${IBM_JAVA_OPTIONS}"
USER 1001
diff --git a/ga/latest/kernel/Dockerfile.ubuntu.openjdk11 b/ga/latest/kernel/Dockerfile.ubuntu.openjdk11
index b492763a0..b37267946 100644
--- a/ga/latest/kernel/Dockerfile.ubuntu.openjdk11
+++ b/ga/latest/kernel/Dockerfile.ubuntu.openjdk11
@@ -150,7 +150,6 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
- ENABLE_HTTP_PORT=false \
OPENJ9_JAVA_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Dosgi.checkConfiguration=false"
USER 1001
diff --git a/ga/latest/kernel/Dockerfile.ubuntu.openjdk17 b/ga/latest/kernel/Dockerfile.ubuntu.openjdk17
index 629170c82..2bbbb7c4f 100644
--- a/ga/latest/kernel/Dockerfile.ubuntu.openjdk17
+++ b/ga/latest/kernel/Dockerfile.ubuntu.openjdk17
@@ -150,7 +150,6 @@ RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
- ENABLE_HTTP_PORT=false \
OPENJ9_JAVA_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Dosgi.checkConfiguration=false"
USER 1001
diff --git a/ga/latest/kernel/helpers/build/configuration_snippets/http-endpoint.xml b/ga/latest/kernel/helpers/build/configuration_snippets/http-endpoint.xml
index 8244e386f..5f6c60552 100644
--- a/ga/latest/kernel/helpers/build/configuration_snippets/http-endpoint.xml
+++ b/ga/latest/kernel/helpers/build/configuration_snippets/http-endpoint.xml
@@ -1,5 +1,5 @@
-
+
diff --git a/ga/latest/kernel/helpers/build/configuration_snippets/http-ssl-endpoint.xml b/ga/latest/kernel/helpers/build/configuration_snippets/http-ssl-endpoint.xml
index b4554a8f6..2a2388a3c 100644
--- a/ga/latest/kernel/helpers/build/configuration_snippets/http-ssl-endpoint.xml
+++ b/ga/latest/kernel/helpers/build/configuration_snippets/http-ssl-endpoint.xml
@@ -2,5 +2,5 @@
-
+
diff --git a/ga/latest/kernel/helpers/build/configure.sh b/ga/latest/kernel/helpers/build/configure.sh
index ed119fddb..87fb00aa7 100755
--- a/ga/latest/kernel/helpers/build/configure.sh
+++ b/ga/latest/kernel/helpers/build/configure.sh
@@ -41,27 +41,30 @@ function main() {
chmod g+rw $SNIPPETS_TARGET/config-mbean.xml
# Check for each Liberty value-add functionality
- if [ "$FEATURES_INSTALLED" == "false" ]; then
- # HTTP Endpoint
- if [ "$HTTP_ENDPOINT" == "true" ]; then
+
+ # Disable the default HTTP/HTTPS ports; user's server.xml can override.
+ # Must run unconditionally (regardless of FEATURES_INSTALLED) so Liberty's
+ # built-in httpPort="9080" default is always closed unless HTTP_ENDPOINT=true.
+ if [ "$HTTP_ENDPOINT" == "true" ]; then
+ if [ "$FEATURES_INSTALLED" == "false" ]; then
if [ "$SSL" == "true" ] || [ "$TLS" == "true" ]; then
cp $SNIPPETS_SOURCE/http-ssl-endpoint.xml $SNIPPETS_TARGET/http-ssl-endpoint.xml
else
cp $SNIPPETS_SOURCE/http-endpoint.xml $SNIPPETS_TARGET/http-endpoint.xml
fi
fi
-
- # Re-enable plain HTTP port when explicitly requested (disabled by default for security)
- if [ "$ENABLE_HTTP_PORT" == "true" ]; then
- cat > $SNIPPETS_TARGET/enable-http-port.xml <<'EOF'
-
-
-
-
-
-EOF
- chmod g+rw $SNIPPETS_TARGET/enable-http-port.xml
+ else
+ if [ "$SSL" == "true" ] || [ "$TLS" == "true" ]; then
+ sed 's/httpsPort="\${HTTPS_PORT}"/httpsPort="-1"/' $SNIPPETS_SOURCE/http-ssl-endpoint.xml \
+ | sed 's/httpPort="\${HTTP_PORT}"/httpPort="-1"/' \
+ > $SNIPPETS_TARGET/http-ssl-endpoint.xml
+ else
+ sed 's/httpPort="\${HTTP_PORT}"/httpPort="-1"/' $SNIPPETS_SOURCE/http-endpoint.xml \
+ > $SNIPPETS_TARGET/http-endpoint.xml
fi
+ fi
+
+ if [ "$FEATURES_INSTALLED" == "false" ]; then
# MicroProfile Health
if [ "$MP_HEALTH_CHECK" == "true" ]; then
From ba364be230ed825aa1e8bab3cc692849d9be8736 Mon Sep 17 00:00:00 2001
From: Kirby Chin <37311900+kabicin@users.noreply.github.com>
Date: Thu, 13 Aug 2026 14:44:26 -0400
Subject: [PATCH 4/6] Update configure.sh
---
ga/latest/kernel/helpers/build/configure.sh | 15 ++++++---------
1 file changed, 6 insertions(+), 9 deletions(-)
diff --git a/ga/latest/kernel/helpers/build/configure.sh b/ga/latest/kernel/helpers/build/configure.sh
index 87fb00aa7..8458d71f3 100755
--- a/ga/latest/kernel/helpers/build/configure.sh
+++ b/ga/latest/kernel/helpers/build/configure.sh
@@ -42,18 +42,15 @@ function main() {
# Check for each Liberty value-add functionality
- # Disable the default HTTP/HTTPS ports; user's server.xml can override.
- # Must run unconditionally (regardless of FEATURES_INSTALLED) so Liberty's
- # built-in httpPort="9080" default is always closed unless HTTP_ENDPOINT=true.
+ # HTTP Endpoint
if [ "$HTTP_ENDPOINT" == "true" ]; then
- if [ "$FEATURES_INSTALLED" == "false" ]; then
- if [ "$SSL" == "true" ] || [ "$TLS" == "true" ]; then
- cp $SNIPPETS_SOURCE/http-ssl-endpoint.xml $SNIPPETS_TARGET/http-ssl-endpoint.xml
- else
- cp $SNIPPETS_SOURCE/http-endpoint.xml $SNIPPETS_TARGET/http-endpoint.xml
- fi
+ if [ "$SSL" == "true" ] || [ "$TLS" == "true" ]; then
+ cp $SNIPPETS_SOURCE/http-ssl-endpoint.xml $SNIPPETS_TARGET/http-ssl-endpoint.xml
+ else
+ cp $SNIPPETS_SOURCE/http-endpoint.xml $SNIPPETS_TARGET/http-endpoint.xml
fi
else
+ # Disable default HTTP/HTTPS ports
if [ "$SSL" == "true" ] || [ "$TLS" == "true" ]; then
sed 's/httpsPort="\${HTTPS_PORT}"/httpsPort="-1"/' $SNIPPETS_SOURCE/http-ssl-endpoint.xml \
| sed 's/httpPort="\${HTTP_PORT}"/httpPort="-1"/' \
From ddd4ebe68964d95c569d91bb6c3876ea23922cc2 Mon Sep 17 00:00:00 2001
From: Kirby Chin <37311900+kabicin@users.noreply.github.com>
Date: Thu, 13 Aug 2026 14:51:24 -0400
Subject: [PATCH 5/6] Use port 9443 in populate_scc.sh
---
README.md | 6 +++---
ga/latest/kernel/helpers/build/configure.sh | 5 ++---
ga/latest/kernel/helpers/build/populate_scc.sh | 12 ++++++------
3 files changed, 11 insertions(+), 12 deletions(-)
diff --git a/README.md b/README.md
index 1009617d8..af31a4965 100644
--- a/README.md
+++ b/README.md
@@ -93,7 +93,7 @@ This section describes the optional build variables that can be enabled via the
The following container image build variables are now **deprecated** and will be **removed** in a future release. You should **stop** using them:
* `HTTP_ENDPOINT`
- * Description: Add configuration properties for an HTTP endpoint.
+ * Description: Add configuration properties for an HTTP endpoint. By default, the HTTP port is disabled (`-1`) and HTTPS remains enabled as the expected transport. Set `HTTP_ENDPOINT=true` to re-enable plain HTTP (port 9080 by default).
* XML Snippet Location: [http-ssl-endpoint.xml](ga/latest/kernel/helpers/build/configuration_snippets/http-ssl-endpoint.xml) when SSL is enabled. Otherwise [http-endpoint.xml](ga/latest/kernel/helpers/build/configuration_snippets/http-endpoint.xml)
* `MP_HEALTH_CHECK`
* Description: Check the health of the environment using Liberty feature `mpHealth-1.0` (implements [MicroProfile Health](https://microprofile.io/project/eclipse/microprofile-health)).
@@ -146,13 +146,13 @@ This feature can be controlled via the following variables:
* Default: `"true"`.
* `WARM_ENDPOINT_URL` (enviornment variable)
* Description: The URL to access during SCC population if WARM_ENDPOINT is true.
- * Default: `"localhost:9080/"`.
+ * Default: `"https://localhost:9443/"`.
* `WARM_OPENAPI_ENDPOINT` (environment variable)
* Description: (24.0.0.4+) If `"true"`, curl will be used to access the WARM_OPENAPI_ENDPOINT_URL (see below) during the population of the SCC. This will increase the amount of information in the SCC and improve first request time in subsequent starts of the image.
* Default: `"true"`
* `WARM_OPENAPI_ENDPOINT_URL` (enviornment variable)
* Description: (24.0.0.4+) The URL to access during SCC population if WARM_OPENAPI_ENDPOINT is true.
- * Default: `"localhost:9080/openapi"`
+ * Default: `"https://localhost:9443/openapi"`
## Logging
diff --git a/ga/latest/kernel/helpers/build/configure.sh b/ga/latest/kernel/helpers/build/configure.sh
index 8458d71f3..060aa68ab 100755
--- a/ga/latest/kernel/helpers/build/configure.sh
+++ b/ga/latest/kernel/helpers/build/configure.sh
@@ -50,10 +50,9 @@ function main() {
cp $SNIPPETS_SOURCE/http-endpoint.xml $SNIPPETS_TARGET/http-endpoint.xml
fi
else
- # Disable default HTTP/HTTPS ports
+ # Disable default HTTP port, HTTPS remains enabled
if [ "$SSL" == "true" ] || [ "$TLS" == "true" ]; then
- sed 's/httpsPort="\${HTTPS_PORT}"/httpsPort="-1"/' $SNIPPETS_SOURCE/http-ssl-endpoint.xml \
- | sed 's/httpPort="\${HTTP_PORT}"/httpPort="-1"/' \
+ sed 's/httpPort="\${HTTP_PORT}"/httpPort="-1"/' $SNIPPETS_SOURCE/http-ssl-endpoint.xml \
> $SNIPPETS_TARGET/http-ssl-endpoint.xml
else
sed 's/httpPort="\${HTTP_PORT}"/httpPort="-1"/' $SNIPPETS_SOURCE/http-endpoint.xml \
diff --git a/ga/latest/kernel/helpers/build/populate_scc.sh b/ga/latest/kernel/helpers/build/populate_scc.sh
index 0013505ae..97eb54efa 100755
--- a/ga/latest/kernel/helpers/build/populate_scc.sh
+++ b/ga/latest/kernel/helpers/build/populate_scc.sh
@@ -23,9 +23,9 @@ SCC_SIZE="80m" # Default size of the SCC layer.
ITERATIONS=2 # Number of iterations to run to populate it.
TRIM_SCC=yes # Trim the SCC to eliminate any wasted space.
WARM_ENDPOINT=true
-WARM_ENDPOINT_URL=localhost:9080/
+WARM_ENDPOINT_URL=https://localhost:9443/
WARM_OPENAPI_ENDPOINT=true
-WARM_OPENAPI_ENDPOINT_URL=localhost:9080/openapi
+WARM_OPENAPI_ENDPOINT_URL=https://localhost:9443/openapi
# If this directory exists and has at least ug=rwx permissions, assume the base image includes an SCC called 'openj9_system_scc' and build on it.
# If not, build on our own SCC.
@@ -128,11 +128,11 @@ then
if [ ${WARM_ENDPOINT} == true ]
then
- curl --silent --output /dev/null --show-error --fail --max-time 5 ${WARM_ENDPOINT_URL} 2>&1 || echo "${WARM_ENDPOINT_URL} call failed, continuing"
+ curl --silent --output /dev/null --show-error --fail --max-time 5 --insecure ${WARM_ENDPOINT_URL} 2>&1 || echo "${WARM_ENDPOINT_URL} call failed, continuing"
fi
if [ ${WARM_OPENAPI_ENDPOINT} == true ]
then
- curl --silent --output /dev/null --show-error --fail --max-time 5 ${WARM_OPENAPI_ENDPOINT_URL} 2>&1 || echo "${WARM_OPENAPI_ENDPOINT_URL} call failed, continuing"
+ curl --silent --output /dev/null --show-error --fail --max-time 5 --insecure ${WARM_OPENAPI_ENDPOINT_URL} 2>&1 || echo "${WARM_OPENAPI_ENDPOINT_URL} call failed, continuing"
fi
/opt/ibm/wlp/bin/server stop
@@ -163,11 +163,11 @@ do
if [ ${WARM_ENDPOINT} == true ]
then
- curl --silent --output /dev/null --show-error --fail --max-time 5 ${WARM_ENDPOINT_URL} 2>&1 || echo "${WARM_ENDPOINT_URL} call failed, continuing"
+ curl --silent --output /dev/null --show-error --fail --max-time 5 --insecure ${WARM_ENDPOINT_URL} 2>&1 || echo "${WARM_ENDPOINT_URL} call failed, continuing"
fi
if [ ${WARM_OPENAPI_ENDPOINT} == true ]
then
- curl --silent --output /dev/null --show-error --fail --max-time 5 ${WARM_OPENAPI_ENDPOINT_URL} 2>&1 || echo "${WARM_OPENAPI_ENDPOINT_URL} call failed, continuing"
+ curl --silent --output /dev/null --show-error --fail --max-time 5 --insecure ${WARM_OPENAPI_ENDPOINT_URL} 2>&1 || echo "${WARM_OPENAPI_ENDPOINT_URL} call failed, continuing"
fi
/opt/ibm/wlp/bin/server stop
From 036242eae38d74bbd201796adaa4303c09db1cc2 Mon Sep 17 00:00:00 2001
From: Kirby Chin <37311900+kabicin@users.noreply.github.com>
Date: Thu, 13 Aug 2026 15:09:48 -0400
Subject: [PATCH 6/6] Update configure.sh
---
ga/latest/kernel/helpers/build/configure.sh | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/ga/latest/kernel/helpers/build/configure.sh b/ga/latest/kernel/helpers/build/configure.sh
index 060aa68ab..fa3d6461a 100755
--- a/ga/latest/kernel/helpers/build/configure.sh
+++ b/ga/latest/kernel/helpers/build/configure.sh
@@ -40,8 +40,6 @@ function main() {
cp $SNIPPETS_SOURCE/config-mbean.xml $SNIPPETS_TARGET/config-mbean.xml
chmod g+rw $SNIPPETS_TARGET/config-mbean.xml
- # Check for each Liberty value-add functionality
-
# HTTP Endpoint
if [ "$HTTP_ENDPOINT" == "true" ]; then
if [ "$SSL" == "true" ] || [ "$TLS" == "true" ]; then
@@ -60,6 +58,7 @@ function main() {
fi
fi
+ # Check for each Liberty value-add functionality
if [ "$FEATURES_INSTALLED" == "false" ]; then
# MicroProfile Health