Skip to content

Disable HTTP_PORT and automatic config monitoring #780

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
kabicin wants to merge 6 commits into
base: vNext
Choose a base branch
from
Draft

Disable HTTP_PORT and automatic config monitoring #780

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
6ae0c4c
Disable automatic config monitoring and HTTP_PORT
kabicin Aug 10, 2026
5b77532
Add productInfo validate in features.sh
kabicin Aug 10, 2026
7becfb8
Set httpPort="-1" by default
kabicin Aug 13, 2026
ba364be
Update configure.sh
kabicin Aug 13, 2026
ddd4ebe
Use port 9443 in populate_scc.sh
kabicin Aug 13, 2026
036242e
Update configure.sh
kabicin Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ This section describes the optional build variables that can be enabled via the
The following container image build variables are now **deprecated** and will be **removed** in a future release. You should **stop** using them:

* `HTTP_ENDPOINT`
* Description: Add configuration properties for an HTTP endpoint.
* Description: Add configuration properties for an HTTP endpoint. By default, the HTTP port is disabled (`-1`) and HTTPS remains enabled as the expected transport. Set `HTTP_ENDPOINT=true` to re-enable plain HTTP (port 9080 by default).
* XML Snippet Location: [http-ssl-endpoint.xml](ga/latest/kernel/helpers/build/configuration_snippets/http-ssl-endpoint.xml) when SSL is enabled. Otherwise [http-endpoint.xml](ga/latest/kernel/helpers/build/configuration_snippets/http-endpoint.xml)
* `MP_HEALTH_CHECK`
* Description: Check the health of the environment using Liberty feature `mpHealth-1.0` (implements [MicroProfile Health](https://microprofile.io/project/eclipse/microprofile-health)).
Expand Down Expand Up @@ -146,13 +146,13 @@ This feature can be controlled via the following variables:
* Default: `"true"`.
* `WARM_ENDPOINT_URL` (enviornment variable)
* Description: The URL to access during SCC population if WARM_ENDPOINT is true.
* Default: `"localhost:9080/"`.
* Default: `"https://localhost:9443/"`.
* `WARM_OPENAPI_ENDPOINT` (environment variable)
* Description: (24.0.0.4+) If `"true"`, curl will be used to access the WARM_OPENAPI_ENDPOINT_URL (see below) during the population of the SCC. This will increase the amount of information in the SCC and improve first request time in subsequent starts of the image.
* Default: `"true"`
* `WARM_OPENAPI_ENDPOINT_URL` (enviornment variable)
* Description: (24.0.0.4+) The URL to access during SCC population if WARM_OPENAPI_ENDPOINT is true.
* Default: `"localhost:9080/openapi"`
* Default: `"https://localhost:9443/openapi"`

## Logging

Expand Down
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubi.ibmjava8
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,7 +178,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

@leochr leochr Aug 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The warm up as part of SCC generation relies on 9080. We should use HTTPS by default if the /openapi endpoint can still be invoked.

ci.docker/ga/latest/kernel/helpers/build/populate_scc.sh

Line 26 in 5b77532

WARM_ENDPOINT_URL=localhost:9080/


ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubi.openjdk11
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,7 +180,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubi.openjdk17
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubi.openjdk8
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubi10-minimal.ibmjava8
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,7 +192,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk11
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk17
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk21
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk25
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk8
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubuntu.ibmjava8
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubuntu.openjdk11
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,7 +154,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubuntu.openjdk17
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,7 +154,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
6 changes: 6 additions & 0 deletions ga/latest/kernel/helpers/build/configuration_snippets/config-mbean.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<server>
<!-- Disable automatic configuration file monitoring.
The server will not reload config after startup; a restart is required to apply changes. -->
<config updateTrigger="disabled" />
</server>
30 changes: 22 additions & 8 deletions ga/latest/kernel/helpers/build/configure.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,16 +36,30 @@ function main() {
mkdir -p ${SNIPPETS_TARGET}
mkdir -p ${SNIPPETS_TARGET_DEFAULTS}

# Disable automatic configuration file monitoring (security hardening)
cp $SNIPPETS_SOURCE/config-mbean.xml $SNIPPETS_TARGET/config-mbean.xml
chmod g+rw $SNIPPETS_TARGET/config-mbean.xml

# HTTP Endpoint
if [ "$HTTP_ENDPOINT" == "true" ]; then
if [ "$SSL" == "true" ] || [ "$TLS" == "true" ]; then
cp $SNIPPETS_SOURCE/http-ssl-endpoint.xml $SNIPPETS_TARGET/http-ssl-endpoint.xml
else
cp $SNIPPETS_SOURCE/http-endpoint.xml $SNIPPETS_TARGET/http-endpoint.xml
fi
else
# Disable default HTTP port, HTTPS remains enabled
if [ "$SSL" == "true" ] || [ "$TLS" == "true" ]; then
sed 's/httpPort="\${HTTP_PORT}"/httpPort="-1"/' $SNIPPETS_SOURCE/http-ssl-endpoint.xml \
> $SNIPPETS_TARGET/http-ssl-endpoint.xml
else
sed 's/httpPort="\${HTTP_PORT}"/httpPort="-1"/' $SNIPPETS_SOURCE/http-endpoint.xml \
> $SNIPPETS_TARGET/http-endpoint.xml
fi
fi

# Check for each Liberty value-add functionality
if [ "$FEATURES_INSTALLED" == "false" ]; then
# HTTP Endpoint
if [ "$HTTP_ENDPOINT" == "true" ]; then
if [ "$SSL" == "true" ] || [ "$TLS" == "true" ]; then
cp $SNIPPETS_SOURCE/http-ssl-endpoint.xml $SNIPPETS_TARGET/http-ssl-endpoint.xml
else
cp $SNIPPETS_SOURCE/http-endpoint.xml $SNIPPETS_TARGET/http-endpoint.xml
fi
fi

# MicroProfile Health
if [ "$MP_HEALTH_CHECK" == "true" ]; then
Expand Down
3 changes: 3 additions & 0 deletions ga/latest/kernel/helpers/build/features.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,4 +43,7 @@ fi
featureUtility installServerFeatures --acceptLicense defaultServer --noCache
find /opt/ibm/wlp/lib /opt/ibm/wlp/bin ! -perm -g=rw -print0 | xargs -0 -r chmod g+rw

# Validate the Liberty installation integrity after feature installation
/opt/ibm/wlp/bin/productInfo validate

echo "features.sh script has been run" > /logs/features.log
12 changes: 6 additions & 6 deletions ga/latest/kernel/helpers/build/populate_scc.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,9 +23,9 @@ SCC_SIZE="80m" # Default size of the SCC layer.
ITERATIONS=2 # Number of iterations to run to populate it.
TRIM_SCC=yes # Trim the SCC to eliminate any wasted space.
WARM_ENDPOINT=true
WARM_ENDPOINT_URL=localhost:9080/
WARM_ENDPOINT_URL=https://localhost:9443/
WARM_OPENAPI_ENDPOINT=true
WARM_OPENAPI_ENDPOINT_URL=localhost:9080/openapi
WARM_OPENAPI_ENDPOINT_URL=https://localhost:9443/openapi

# If this directory exists and has at least ug=rwx permissions, assume the base image includes an SCC called 'openj9_system_scc' and build on it.
# If not, build on our own SCC.
Expand Down Expand Up @@ -128,11 +128,11 @@ then

if [ ${WARM_ENDPOINT} == true ]
then
curl --silent --output /dev/null --show-error --fail --max-time 5 ${WARM_ENDPOINT_URL} 2>&1 || echo "${WARM_ENDPOINT_URL} call failed, continuing"
curl --silent --output /dev/null --show-error --fail --max-time 5 --insecure ${WARM_ENDPOINT_URL} 2>&1 || echo "${WARM_ENDPOINT_URL} call failed, continuing"
fi
if [ ${WARM_OPENAPI_ENDPOINT} == true ]
then
curl --silent --output /dev/null --show-error --fail --max-time 5 ${WARM_OPENAPI_ENDPOINT_URL} 2>&1 || echo "${WARM_OPENAPI_ENDPOINT_URL} call failed, continuing"
curl --silent --output /dev/null --show-error --fail --max-time 5 --insecure ${WARM_OPENAPI_ENDPOINT_URL} 2>&1 || echo "${WARM_OPENAPI_ENDPOINT_URL} call failed, continuing"
fi

/opt/ibm/wlp/bin/server stop
Expand Down Expand Up @@ -163,11 +163,11 @@ do

if [ ${WARM_ENDPOINT} == true ]
then
curl --silent --output /dev/null --show-error --fail --max-time 5 ${WARM_ENDPOINT_URL} 2>&1 || echo "${WARM_ENDPOINT_URL} call failed, continuing"
curl --silent --output /dev/null --show-error --fail --max-time 5 --insecure ${WARM_ENDPOINT_URL} 2>&1 || echo "${WARM_ENDPOINT_URL} call failed, continuing"
fi
if [ ${WARM_OPENAPI_ENDPOINT} == true ]
then
curl --silent --output /dev/null --show-error --fail --max-time 5 ${WARM_OPENAPI_ENDPOINT_URL} 2>&1 || echo "${WARM_OPENAPI_ENDPOINT_URL} call failed, continuing"
curl --silent --output /dev/null --show-error --fail --max-time 5 --insecure ${WARM_OPENAPI_ENDPOINT_URL} 2>&1 || echo "${WARM_OPENAPI_ENDPOINT_URL} call failed, continuing"
fi

/opt/ibm/wlp/bin/server stop
Expand Down