Skip to content

Disable HTTP_PORT and automatic config monitoring #780

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kabicin wants to merge 10 commits into
base: vNext
Choose a base branch
from
Open

Disable HTTP_PORT and automatic config monitoring #780

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
6ae0c4c
Disable automatic config monitoring and HTTP_PORT
kabicin Aug 10, 2026
5b77532
Add productInfo validate in features.sh
kabicin Aug 10, 2026
7becfb8
Set httpPort="-1" by default
kabicin Aug 13, 2026
ba364be
Update configure.sh
kabicin Aug 13, 2026
ddd4ebe
Use port 9443 in populate_scc.sh
kabicin Aug 13, 2026
036242e
Update configure.sh
kabicin Aug 13, 2026
9599f7c
Remove HTTP_ENDPOINT from deprecated build variables
kabicin Aug 14, 2026
eadc096
Add ENABLE_HTTP_PORT
kabicin Aug 14, 2026
d06d2bb
Update configure.sh
kabicin Aug 14, 2026
e003e7e
Update README.md
kabicin Aug 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,9 @@ FROM icr.io/appcafe/websphere-liberty:kernel-java17-openj9-ubi
# Default setting for the verbose option. Set it to true to debug the application container image build failures
ARG VERBOSE=false

# HTTP port (9080) is disabled by default and HTTPS (9443) remains enabled. Uncomment and set to true to re-enable plain HTTP.
#ARG ENABLE_HTTP_PORT=true

# Add Liberty server configuration including all necessary features
COPY --chown=1001:0 server.xml /config/

Expand Down Expand Up @@ -86,7 +89,9 @@ This section describes the optional build variables that can be enabled via the
* Description: Automatically generates a secure random password for LTPA keys and exports it as the `ltpa_keys_password` environment variable. This prevents the LTPA service from failing with error `CWWKS4118E` when no LTPA keys password is configured.
* Default: `"true"`.
* Note: If `ltpa_keys_password` is already set, automatic generation is skipped. Set to `"false"` to disable.

* `ENABLE_HTTP_PORT`
* Description: Controls whether the HTTP port (port 9080 by default) is enabled. By default, the HTTP port is disabled (`-1`) and HTTPS remains enabled as the expected transport. Set to `true` to re-enable the HTTP port.
* Default: `"false"`.

### Deprecated Build Variables

Expand Down Expand Up @@ -146,13 +151,13 @@ This feature can be controlled via the following variables:
* Default: `"true"`.
* `WARM_ENDPOINT_URL` (enviornment variable)
* Description: The URL to access during SCC population if WARM_ENDPOINT is true.
* Default: `"localhost:9080/"`.
* Default: `"https://localhost:9443/"`.
* `WARM_OPENAPI_ENDPOINT` (environment variable)
* Description: (24.0.0.4+) If `"true"`, curl will be used to access the WARM_OPENAPI_ENDPOINT_URL (see below) during the population of the SCC. This will increase the amount of information in the SCC and improve first request time in subsequent starts of the image.
* Default: `"true"`
* `WARM_OPENAPI_ENDPOINT_URL` (enviornment variable)
* Description: (24.0.0.4+) The URL to access during SCC population if WARM_OPENAPI_ENDPOINT is true.
* Default: `"localhost:9080/openapi"`
* Default: `"https://localhost:9443/openapi"`

## Logging

Expand Down
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubi.ibmjava8
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,7 +178,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

@leochr leochr Aug 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The warm up as part of SCC generation relies on 9080. We should use HTTPS by default if the /openapi endpoint can still be invoked.

ci.docker/ga/latest/kernel/helpers/build/populate_scc.sh

Line 26 in 5b77532

WARM_ENDPOINT_URL=localhost:9080/


ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubi.openjdk11
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,7 +180,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubi.openjdk17
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubi.openjdk8
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubi10-minimal.ibmjava8
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,7 +192,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk11
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk17
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk21
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk25
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk8
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubuntu.ibmjava8
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubuntu.openjdk11
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,7 +154,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
2 changes: 1 addition & 1 deletion ga/latest/kernel/Dockerfile.ubuntu.openjdk17
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,7 +154,7 @@ ENV RANDFILE=/tmp/.rnd \

USER 1001

EXPOSE 9080 9443
EXPOSE 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
6 changes: 6 additions & 0 deletions ga/latest/kernel/helpers/build/configuration_snippets/config-mbean.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<server>
<!-- Disable automatic configuration file monitoring.
The server will not reload config after startup; a restart is required to apply changes. -->
<config updateTrigger="disabled" />
</server>
4 changes: 4 additions & 0 deletions ga/latest/kernel/helpers/build/configuration_snippets/http-endpoint-disabled.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
<?xml version="1.0" encoding="UTF-8"?>
<server>
<httpEndpoint id="defaultHttpEndpoint" host="*" httpPort="-1" />
</server>
9 changes: 9 additions & 0 deletions ga/latest/kernel/helpers/build/configure.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,15 @@ function main() {
mkdir -p ${SNIPPETS_TARGET}
mkdir -p ${SNIPPETS_TARGET_DEFAULTS}

# Disable automatic configuration file monitoring (security hardening)
cp $SNIPPETS_SOURCE/config-mbean.xml $SNIPPETS_TARGET/config-mbean.xml
chmod g+rw $SNIPPETS_TARGET/config-mbean.xml

# HTTP port is disabled by default. Set ENABLE_HTTP_PORT=true to re-enable port 9080.
if [ "$ENABLE_HTTP_PORT" != "true" ]; then
cp $SNIPPETS_SOURCE/http-endpoint-disabled.xml $SNIPPETS_TARGET/http-endpoint.xml
fi

# Check for each Liberty value-add functionality
if [ "$FEATURES_INSTALLED" == "false" ]; then
# HTTP Endpoint
Expand Down
3 changes: 3 additions & 0 deletions ga/latest/kernel/helpers/build/features.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,4 +43,7 @@ fi
featureUtility installServerFeatures --acceptLicense defaultServer --noCache
find /opt/ibm/wlp/lib /opt/ibm/wlp/bin ! -perm -g=rw -print0 | xargs -0 -r chmod g+rw

# Validate the Liberty installation integrity after feature installation
/opt/ibm/wlp/bin/productInfo validate

echo "features.sh script has been run" > /logs/features.log
12 changes: 6 additions & 6 deletions ga/latest/kernel/helpers/build/populate_scc.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,9 +23,9 @@ SCC_SIZE="80m" # Default size of the SCC layer.
ITERATIONS=2 # Number of iterations to run to populate it.
TRIM_SCC=yes # Trim the SCC to eliminate any wasted space.
WARM_ENDPOINT=true
WARM_ENDPOINT_URL=localhost:9080/
WARM_ENDPOINT_URL=https://localhost:9443/
WARM_OPENAPI_ENDPOINT=true
WARM_OPENAPI_ENDPOINT_URL=localhost:9080/openapi
WARM_OPENAPI_ENDPOINT_URL=https://localhost:9443/openapi

# If this directory exists and has at least ug=rwx permissions, assume the base image includes an SCC called 'openj9_system_scc' and build on it.
# If not, build on our own SCC.
Expand Down Expand Up @@ -128,11 +128,11 @@ then

if [ ${WARM_ENDPOINT} == true ]
then
curl --silent --output /dev/null --show-error --fail --max-time 5 ${WARM_ENDPOINT_URL} 2>&1 || echo "${WARM_ENDPOINT_URL} call failed, continuing"
curl --silent --output /dev/null --show-error --fail --max-time 5 --insecure ${WARM_ENDPOINT_URL} 2>&1 || echo "${WARM_ENDPOINT_URL} call failed, continuing"
fi
if [ ${WARM_OPENAPI_ENDPOINT} == true ]
then
curl --silent --output /dev/null --show-error --fail --max-time 5 ${WARM_OPENAPI_ENDPOINT_URL} 2>&1 || echo "${WARM_OPENAPI_ENDPOINT_URL} call failed, continuing"
curl --silent --output /dev/null --show-error --fail --max-time 5 --insecure ${WARM_OPENAPI_ENDPOINT_URL} 2>&1 || echo "${WARM_OPENAPI_ENDPOINT_URL} call failed, continuing"
fi

/opt/ibm/wlp/bin/server stop
Expand Down Expand Up @@ -163,11 +163,11 @@ do

if [ ${WARM_ENDPOINT} == true ]
then
curl --silent --output /dev/null --show-error --fail --max-time 5 ${WARM_ENDPOINT_URL} 2>&1 || echo "${WARM_ENDPOINT_URL} call failed, continuing"
curl --silent --output /dev/null --show-error --fail --max-time 5 --insecure ${WARM_ENDPOINT_URL} 2>&1 || echo "${WARM_ENDPOINT_URL} call failed, continuing"
fi
if [ ${WARM_OPENAPI_ENDPOINT} == true ]
then
curl --silent --output /dev/null --show-error --fail --max-time 5 ${WARM_OPENAPI_ENDPOINT_URL} 2>&1 || echo "${WARM_OPENAPI_ENDPOINT_URL} call failed, continuing"
curl --silent --output /dev/null --show-error --fail --max-time 5 --insecure ${WARM_OPENAPI_ENDPOINT_URL} 2>&1 || echo "${WARM_OPENAPI_ENDPOINT_URL} call failed, continuing"
fi

/opt/ibm/wlp/bin/server stop
Expand Down