Applying iFixes via volume mount

[dougbreaux]

Can we mount ifixes into our running containers rather than building new images? That would be much easier for us to manage. If so, can we get a similar README for that, please?

[dougbreaux]

(In reference to https://github.com/OpenLiberty/ci.docker/blob/main/releases/applying-ifixes/README.md )

[dougbreaux]

At first, I thought that maybe the new OverrideLibrary was relevant, but now I'm thinking not?

https://openliberty.io/blog/2025/10/07/25.0.0.10.html#overrideLibrary

Any response on this?

[dougbreaux]

Poke. Surely we're not the only Liberty users who need this?

[dougbreaux]

Anyone, please? Every security patch that comes out, we face the choice of whether to rebuild & test & deploy all our images or wait until the next organic release.

[leochr]

@dougbreaux Sorry, missed this one. Trying to patch the core runtime binaries at deployment/runtime would be considered a container anti-pattern. Besides, simply mounting the iFix JAR file into a container volume does not automatically install or apply it. The JAR must be executed using the java -jar command. You could technically do that using an init container of a Pod or even in the container startup. But that'll be executed each time the Pod/container starts, leading to slower startup and affecting the performance. Hence, we advise against that approach. Instead, we recommend using the process documented here to apply iFixes at build time: https://github.com/OpenLiberty/ci.docker/blob/main/releases/applying-ifixes/README.md

[dougbreaux]

Bah, ok. I was really hoping for a volume mount option, when applying at runtime is the fastest way to make emergency changes.

Barring that, it would at least be nice if there were steps to remotely pull the ifix rather than having to have first downloaded it a local location.

[dougbreaux]

This just seems prohibitively difficult today. What am I missing here?

[dougbreaux]

CoPilot also suggested I ask about the Operator potentially supporting "pod-level Liberty patch injection or runtime overlay management"

[dougbreaux]

And revisiting whether there's not any way to have a Dockerfile reference remote ifixes to build into the image, rather than having to manually pre-download them?

[dougbreaux]

For instance

ADD --chown=1001:0 https://ifixes.ibm.com/liberty/$LIBERTY_VERSION-wlp-archive-IFP12345.jar/*.jar /fixes/
ADD --chown=1001:0 https://ifixes.ibm.com/liberty/$LIBERTY_VERSION-wlp-archive-IFP67890.jar/*.jar /fixes/
RUN configure.sh