Disable HTTP_PORT and automatic config monitoring

.secrets.baseline

@@ -3,7 +3,7 @@
     "files": "^.secrets.baseline$",
     "lines": "fbf6a96d49214c0abc6a3bc5da6e48cd|REPLACE|PWD_TRUST|SECRET|keyStore|secret|rootpwd|dbpassword"
   },
-  "generated_at": "2026-07-30T15:45:14Z",
+  "generated_at": "2026-08-18T14:50:50Z",
   "plugins_used": [
     {
       "name": "AWSKeyDetector"
@@ -915,6 +915,66 @@
         "verified_result": null
       }
     ],
+    "ga/latest/kernel/Dockerfile.ubi10-micro.ibmjava8": [
+      {
+        "hashed_secret": "7083d74c46835f9b94206ff41e2e54ff946d6683",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 113,
+        "type": "Hex High Entropy String",
+        "verified_result": null
+      }
+    ],
+    "ga/latest/kernel/Dockerfile.ubi10-micro.openjdk11": [
+      {
+        "hashed_secret": "7083d74c46835f9b94206ff41e2e54ff946d6683",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 101,
+        "type": "Hex High Entropy String",
+        "verified_result": null
+      }
+    ],
+    "ga/latest/kernel/Dockerfile.ubi10-micro.openjdk17": [
+      {
+        "hashed_secret": "7083d74c46835f9b94206ff41e2e54ff946d6683",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 101,
+        "type": "Hex High Entropy String",
+        "verified_result": null
+      }
+    ],
+    "ga/latest/kernel/Dockerfile.ubi10-micro.openjdk21": [
+      {
+        "hashed_secret": "7083d74c46835f9b94206ff41e2e54ff946d6683",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 101,
+        "type": "Hex High Entropy String",
+        "verified_result": null
+      }
+    ],
+    "ga/latest/kernel/Dockerfile.ubi10-micro.openjdk25": [
+      {
+        "hashed_secret": "7083d74c46835f9b94206ff41e2e54ff946d6683",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 101,
+        "type": "Hex High Entropy String",
+        "verified_result": null
+      }
+    ],
+    "ga/latest/kernel/Dockerfile.ubi10-micro.openjdk8": [
+      {
+        "hashed_secret": "7083d74c46835f9b94206ff41e2e54ff946d6683",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 101,
+        "type": "Hex High Entropy String",
+        "verified_result": null
+      }
+    ],
     "ga/latest/kernel/Dockerfile.ubi10-minimal.ibmjava8": [
       {
         "hashed_secret": "7083d74c46835f9b94206ff41e2e54ff946d6683",

README.md

@@ -34,6 +34,9 @@ FROM icr.io/appcafe/websphere-liberty:kernel-java17-openj9-ubi
 # Default setting for the verbose option. Set it to true to debug the application container image build failures
 ARG VERBOSE=false
 
+# HTTP port (9080) is disabled by default and HTTPS (9443) remains enabled. Uncomment and set to true to re-enable plain HTTP.
+#ARG ENABLE_HTTP_PORT=true
+
 # Add Liberty server configuration including all necessary features
 COPY --chown=1001:0  server.xml /config/
 
@@ -77,6 +80,10 @@ This section describes the optional build variables that can be enabled via the
   *  XML Snippet Location: [hazelcast-sessioncache.xml](ga/latest/kernel/helpers/build/configuration_snippets/hazelcast-sessioncache.xml)
 * `SKIP_FEATURE_INSTALL`
   *  Description: Default setting is `false`. When set to `true`, Liberty features will not be installed using `installUtility` when `configure.sh` is run. This setting is not applicable when `features.sh` is run.
+* `SKIP_FEATURE_VALIDATE`
+  *  Description: Default setting is `false`. When set to `true`, `productInfo validate` will be skipped after feature installation in `features.sh`. Validation is recommended and should only be skipped when necessary.
+* `SKIP_UPDATE_TRIGGER_DISABLED`
+  *  Description: Default setting is `false`. When set to `true`, the `update-trigger-disabled.xml` snippet will not be copied into `configDropins/defaults`, re-enabling automatic configuration file monitoring. Disabling monitoring is recommended for production.
 * `TLS` (`SSL` is deprecated)
   *  Description: Enable Transport Security in Liberty by adding the `transportSecurity-1.0` feature (includes support for SSL).
   *  XML Snippet Location:  [keystore.xml](ga/latest/kernel/helpers/build/configuration_snippets/keystore.xml).
@@ -86,7 +93,9 @@ This section describes the optional build variables that can be enabled via the
   * Description: Automatically generates a secure random password for LTPA keys and exports it as the `ltpa_keys_password` environment variable. This prevents the LTPA service from failing with error `CWWKS4118E` when no LTPA keys password is configured.
   * Default: `"true"`.
   * Note: If `ltpa_keys_password` is already set, automatic generation is skipped. Set to `"false"` to disable.
-
+* `ENABLE_HTTP_PORT`
+  * Description: Controls whether the HTTP port (port 9080 by default) is enabled. By default, the HTTP port is disabled (`-1`) and HTTPS remains enabled as the expected transport. Set to `true` to re-enable the HTTP port.
+  * Default: `"false"`.
 
 ### Deprecated Build Variables
 
@@ -146,13 +155,13 @@ This feature can be controlled via the following variables:
   * Default: `"true"`.
 * `WARM_ENDPOINT_URL` (enviornment variable)
   * Description: The URL to access during SCC population if WARM_ENDPOINT is true.
-  * Default: `"localhost:9080/"`.
+  * Default: `"https://localhost:9443/"`.
 * `WARM_OPENAPI_ENDPOINT` (environment variable)
   * Description: (24.0.0.4+) If `"true"`, curl will be used to access the WARM_OPENAPI_ENDPOINT_URL (see below) during the population of the SCC. This will increase the amount of information in the SCC and improve first request time in subsequent starts of the image.
   * Default: `"true"`
 * `WARM_OPENAPI_ENDPOINT_URL` (enviornment variable)
   * Description: (24.0.0.4+) The URL to access during SCC population if WARM_OPENAPI_ENDPOINT is true.
-  * Default: `"localhost:9080/openapi"`
+  * Default: `"https://localhost:9443/openapi"`
 
 ## Logging
 

ga/latest/full/Dockerfile.ubi10-micro.ibmjava8

@@ -0,0 +1,51 @@
+# (C) Copyright IBM Corporation 2026.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ARG PARENT_IMAGE=icr.io/appcafe/websphere-liberty:kernel-java8-ibmjava-ubi-micro
+FROM $PARENT_IMAGE AS installBundle
+
+ARG VERBOSE=false
+ARG REPOSITORIES_PROPERTIES=""
+
+# If there is a local copy of the repository use that instead
+COPY resources/ /tmp/
+
+# Install the base bundle
+RUN set -eux; \
+  if [ ! -z "$REPOSITORIES_PROPERTIES" ]; then \
+    mkdir /opt/ibm/wlp/etc/; \
+    echo "$REPOSITORIES_PROPERTIES" > /opt/ibm/wlp/etc/repositories.properties; \
+    installUtility install --acceptLicense baseBundle; \
+    rm /opt/ibm/wlp/etc/repositories.properties; \
+  elif [ -f /tmp/wlpRepo.zip ]; then \
+    installUtility install --acceptLicense baseBundle --from=/tmp/wlpRepo.zip; \
+  else \
+    installUtility install --acceptLicense baseBundle; \
+  fi; \
+  rm -rf /output/workarea /output/logs; \
+  find /opt/ibm/wlp ! -perm -g=rw -print0 | xargs -r -0 chmod g+rw;
+
+ARG PARENT_IMAGE=icr.io/appcafe/websphere-liberty:kernel-java8-ibmjava-ubi-micro
+FROM $PARENT_IMAGE
+ARG VERBOSE=false
+
+# Copy the runtime
+COPY --from=installBundle --chown=1001:0 /opt/ibm/wlp /opt/ibm/wlp
+
+COPY --chown=1001:0 server.xml /config/
+
+# Create a new SCC layer
+RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
+    && rm -rf /output/messaging /output/resources/security /logs/* $WLP_OUTPUT_DIR/.classCache \
+    && find /opt/ibm/wlp/output ! -path "*.classCache*" ! -perm -g=rwx -print0 | xargs -0 -r chmod g+rwx

ga/latest/full/Dockerfile.ubi10-micro.openjdk11

@@ -0,0 +1,51 @@
+# (C) Copyright IBM Corporation 2026.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ARG PARENT_IMAGE=icr.io/appcafe/websphere-liberty:kernel-java11-openj9-ubi-micro
+FROM $PARENT_IMAGE AS installBundle
+
+ARG VERBOSE=false
+ARG REPOSITORIES_PROPERTIES=""
+
+# If there is a local copy of the repository use that instead
+COPY resources/ /tmp/
+
+# Install the base bundle
+RUN set -eux; \
+  if [ ! -z "$REPOSITORIES_PROPERTIES" ]; then \
+    mkdir /opt/ibm/wlp/etc/; \
+    echo "$REPOSITORIES_PROPERTIES" > /opt/ibm/wlp/etc/repositories.properties; \
+    installUtility install --acceptLicense baseBundle; \
+    rm /opt/ibm/wlp/etc/repositories.properties; \
+  elif [ -f /tmp/wlpRepo.zip ]; then \
+    installUtility install --acceptLicense baseBundle --from=/tmp/wlpRepo.zip; \
+  else \
+    installUtility install --acceptLicense baseBundle; \
+  fi; \
+  rm -rf /output/workarea /output/logs; \
+  find /opt/ibm/wlp ! -perm -g=rw -print0 | xargs -r -0 chmod g+rw;
+
+ARG PARENT_IMAGE=icr.io/appcafe/websphere-liberty:kernel-java11-openj9-ubi-micro
+FROM $PARENT_IMAGE
+ARG VERBOSE=false
+
+# Copy the runtime
+COPY --from=installBundle --chown=1001:0 /opt/ibm/wlp /opt/ibm/wlp
+
+COPY --chown=1001:0 server.xml /config/
+
+# Create a new SCC layer
+RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
+    && rm -rf /output/messaging /output/resources/security /logs/* $WLP_OUTPUT_DIR/.classCache \
+    && find /opt/ibm/wlp/output ! -perm -g=rwx -print0 | xargs -0 -r chmod g+rwx

ga/latest/full/Dockerfile.ubi10-micro.openjdk17

@@ -0,0 +1,51 @@
+# (C) Copyright IBM Corporation 2026.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ARG PARENT_IMAGE=icr.io/appcafe/websphere-liberty:kernel-java17-openj9-ubi-micro
+FROM $PARENT_IMAGE AS installBundle
+
+ARG VERBOSE=false
+ARG REPOSITORIES_PROPERTIES=""
+
+# If there is a local copy of the repository use that instead
+COPY resources/ /tmp/
+
+# Install the base bundle
+RUN set -eux; \
+  if [ ! -z "$REPOSITORIES_PROPERTIES" ]; then \
+    mkdir /opt/ibm/wlp/etc/; \
+    echo "$REPOSITORIES_PROPERTIES" > /opt/ibm/wlp/etc/repositories.properties; \
+    installUtility install --acceptLicense baseBundle; \
+    rm /opt/ibm/wlp/etc/repositories.properties; \
+  elif [ -f /tmp/wlpRepo.zip ]; then \
+    installUtility install --acceptLicense baseBundle --from=/tmp/wlpRepo.zip; \
+  else \
+    installUtility install --acceptLicense baseBundle; \
+  fi; \
+  rm -rf /output/workarea /output/logs; \
+  find /opt/ibm/wlp ! -perm -g=rw -print0 | xargs -r -0 chmod g+rw;
+
+ARG PARENT_IMAGE=icr.io/appcafe/websphere-liberty:kernel-java17-openj9-ubi-micro
+FROM $PARENT_IMAGE
+ARG VERBOSE=false
+
+# Copy the runtime
+COPY --from=installBundle --chown=1001:0 /opt/ibm/wlp /opt/ibm/wlp
+
+COPY --chown=1001:0 server.xml /config/
+
+# Create a new SCC layer
+RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
+    && rm -rf /output/messaging /output/resources/security /logs/* $WLP_OUTPUT_DIR/.classCache \
+    && find /opt/ibm/wlp/output ! -perm -g=rwx -print0 | xargs -0 -r chmod g+rwx

ga/latest/full/Dockerfile.ubi10-micro.openjdk21

@@ -0,0 +1,51 @@
+# (C) Copyright IBM Corporation 2026.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ARG PARENT_IMAGE=icr.io/appcafe/websphere-liberty:kernel-java21-openj9-ubi-micro
+FROM $PARENT_IMAGE AS installBundle
+
+ARG VERBOSE=false
+ARG REPOSITORIES_PROPERTIES=""
+
+# If there is a local copy of the repository use that instead
+COPY resources/ /tmp/
+
+# Install the base bundle
+RUN set -eux; \
+  if [ ! -z "$REPOSITORIES_PROPERTIES" ]; then \
+    mkdir /opt/ibm/wlp/etc/; \
+    echo "$REPOSITORIES_PROPERTIES" > /opt/ibm/wlp/etc/repositories.properties; \
+    installUtility install --acceptLicense baseBundle; \
+    rm /opt/ibm/wlp/etc/repositories.properties; \
+  elif [ -f /tmp/wlpRepo.zip ]; then \
+    installUtility install --acceptLicense baseBundle --from=/tmp/wlpRepo.zip; \
+  else \
+    installUtility install --acceptLicense baseBundle; \
+  fi; \
+  rm -rf /output/workarea /output/logs; \
+  find /opt/ibm/wlp ! -perm -g=rw -print0 | xargs -r -0 chmod g+rw;
+
+ARG PARENT_IMAGE=icr.io/appcafe/websphere-liberty:kernel-java21-openj9-ubi-micro
+FROM $PARENT_IMAGE
+ARG VERBOSE=false
+
+# Copy the runtime
+COPY --from=installBundle --chown=1001:0 /opt/ibm/wlp /opt/ibm/wlp
+
+COPY --chown=1001:0 server.xml /config/
+
+# Create a new SCC layer
+RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
+    && rm -rf /output/messaging /output/resources/security /logs/* $WLP_OUTPUT_DIR/.classCache \
+    && find /opt/ibm/wlp/output ! -perm -g=rwx -print0 | xargs -0 -r chmod g+rwx

ga/latest/full/Dockerfile.ubi10-micro.openjdk25

@@ -0,0 +1,51 @@
+# (C) Copyright IBM Corporation 2026.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ARG PARENT_IMAGE=icr.io/appcafe/websphere-liberty:kernel-java25-openj9-ubi-micro
+FROM $PARENT_IMAGE AS installBundle
+
+ARG VERBOSE=false
+ARG REPOSITORIES_PROPERTIES=""
+
+# If there is a local copy of the repository use that instead
+COPY resources/ /tmp/
+
+# Install the base bundle
+RUN set -eux; \
+  if [ ! -z "$REPOSITORIES_PROPERTIES" ]; then \
+    mkdir /opt/ibm/wlp/etc/; \
+    echo "$REPOSITORIES_PROPERTIES" > /opt/ibm/wlp/etc/repositories.properties; \
+    installUtility install --acceptLicense baseBundle; \
+    rm /opt/ibm/wlp/etc/repositories.properties; \
+  elif [ -f /tmp/wlpRepo.zip ]; then \
+    installUtility install --acceptLicense baseBundle --from=/tmp/wlpRepo.zip; \
+  else \
+    installUtility install --acceptLicense baseBundle; \
+  fi; \
+  rm -rf /output/workarea /output/logs; \
+  find /opt/ibm/wlp ! -perm -g=rw -print0 | xargs -r -0 chmod g+rw;
+
+ARG PARENT_IMAGE=icr.io/appcafe/websphere-liberty:kernel-java25-openj9-ubi-micro
+FROM $PARENT_IMAGE
+ARG VERBOSE=false
+
+# Copy the runtime
+COPY --from=installBundle --chown=1001:0 /opt/ibm/wlp /opt/ibm/wlp
+
+COPY --chown=1001:0 server.xml /config/
+
+# Create a new SCC layer
+RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
+    && rm -rf /output/messaging /output/resources/security /logs/* $WLP_OUTPUT_DIR/.classCache \
+    && find /opt/ibm/wlp/output ! -perm -g=rwx -print0 | xargs -0 -r chmod g+rwx