WebSphere Liberty 26.0.0.9 introduces official support for Liberty container images based on Red Hat Universal Base Image (UBI) Micro—the smallest and most minimal UBI variant available. This release gives WebSphere customers a new option for building highly secure, lightweight, and production-ready containerized Java applications.
UBI Micro is purposely designed without a package manager (such as microdnf) or any package manager dependencies. By eliminating these components from the runtime image, UBI Micro significantly reduces the attack surface, lowers Common Vulnerabilities and Exposures (CVE) exposure, and supports container-hardening best practices demanded by enterprise security teams.
Why UBI Micro?
Security remains a top priority for organizations deploying Java applications in containers. Every package included in a container image increases the software footprint that must be maintained, patched, and scanned for vulnerabilities. Traditional base images include standard utilities and package managers that are convenient during setup but introduce unnecessary risk in production.
UBI Micro addresses this challenge by providing a minimal runtime foundation containing only what is needed to run applications. With WebSphere Liberty 26.0.0.9, customers can leverage these security benefits while continuing to use proven Liberty container image tooling and familiar application build workflows.
Minimized Attack Surface
Excluding package managers and unnecessary utilities removes potential exploit vectors from the runtime container.
Familiar Build Workflow
UBI Micro-based Liberty images integrate seamlessly into existing Liberty container image build processes.
Smaller Image Footprint
A lightweight base layer speeds up image pull times and deployment pipelines across Kubernetes and Red Hat OpenShift clusters.
Enhanced Security Defaults in UBI Micro-based Liberty Images
UBI Micro-based Liberty container images introduce additional security-focused defaults that are enabled out-of-the-box. These settings are intended to further reduce the attack surface of running containers and promote secure-by-default deployments.
Note: These behaviors are enabled by default only for UBI Micro-based Liberty container images. The same settings are not enabled by default for existing UBI Minimal or UBI Standard-based Liberty images to avoid breaking users, although users can configure those images to opt in to the same behavior.
HTTP Port Disabled by Default
UBI Micro-based Liberty images disable the HTTP endpoint by default, encouraging the use of secure communication channels and reducing unnecessary network exposure.
Configuration Update Monitoring Disabled by Default
For additional runtime security, UBI Micro-based Liberty images disable update trigger for server configuration files. Configuration updates will not be applied while the server is running, ensuring that server configuration changes are applied in a controlled and predictable manner.
For configuration options available at container image build time and at runtime, see Build Variables.
Building Application Images with UBI Micro
Liberty container images are designed as reusable base images for building application-specific container images. When creating an application image, you typically start with a Liberty runtime image, copy your application configuration and artifacts into the image, and then run the provided build-time helper scripts such as features.sh and configure.sh to install the required Liberty features and optimize the runtime environment.
UBI Micro-based Liberty images integrate into exactly the same workflow, making adoption straightforward for existing WebSphere Liberty customers:
FROM icr.io/appcafe/websphere-liberty:kernel-java25-openj9-ubi-micro
COPY --chown=1001:0 server.xml /config/
RUN features.sh
COPY --chown=1001:0 target/my-app.war /config/apps/
RUN configure.sh
Refer to the official guide on Creating Application Container Images for additional deployment patterns and build optimization strategies.
Installing OS Packages Without a Package Manager
One of the defining characteristics of UBI Micro is the deliberate absence of microdnf or any other package manager. While this reduces the image footprint and attack surface, some applications require additional operating system packages that cannot simply be installed with a microdnf install command during the image build.
Solution: Liberty container images include a dedicated helper utility, package-helper.sh, designed specifically for this scenario. It enables OS packages to be resolved and staged in an intermediate build layer and then cleanly copied into a subsequent or final stage—without leaving any package manager behind.
For complete command-line options and further examples, see the Package Helper Documentation on GitHub.
Getting Started
WebSphere customers looking to maximize container security and minimize image footprint can begin evaluating the new UBI Micro-based Liberty container images available with WebSphere Liberty 26.0.0.9 today. Existing Liberty container application build processes can continue using standard Liberty image tooling while immediately benefiting from the security-focused foundation provided by UBI Micro.
The addition of UBI Micro support represents a significant step forward for building hardened, minimal, and compliant cloud-native enterprise Java applications on WebSphere Liberty.
Refer to the official Liberty Container Images Documentation for WebSphere Liberty container image variants and configurations and full list of the new UBI Micro based Liberty container image tags.