Production operations, security, and observability

Dynamic modularity needs disciplined operations.

Health model

Report separately:

• process/JVM liveness;
• framework state and unresolved bundles;
• DS unsatisfied components;
• required service availability;
• configuration validity;
• business readiness;
• external dependency health.

A bundle count alone is not health. A deliberately inactive optional bundle is not a failure.

Metrics and logs

Measure service bind/unbind events, component activation failures, resolver errors, bundle state changes, configuration updates, HTTP routes, feature install duration, thread pools, heap/GC, and user outcomes. Control cardinality: bundle symbolic name is useful; service ID per request is usually not.

Support snapshot

Capture framework/runtime version, Java build, installed features, bundle states, unresolved diagnostics, wirings, DS states, sanitized configuration, recent logs, threads, memory summary, artifact digests, and timestamps. Redact secrets and personal data.

Security boundaries

Modern Java no longer relies on Security Manager as a general sandbox. OSGi metadata gives class-space encapsulation, not hostile-code isolation. Use process/container boundaries for untrusted code.

Protect provisioning repositories, signatures, remote shell, JMX, Web Console, HTTP management, configuration, bundle cache, logs, and dumps. Patch the JDK and every independently versioned OSGi component.

Safe update

1. resolve and integration-test the closure;
2. confirm API baselines and config migration;
3. stage with the real state shape;
4. quiesce work if live update is unsafe;
5. install/update, refresh only required wirings;
6. verify components and business probes;
7. roll back with compatible data/config.

Feynman check

Dynamic update is a capability, not a requirement. Explain when a controlled process restart is safer than refreshing bundles in place.