---
title: "Production operations, security, and observability"
chapter: "17"
---

# Production operations, security, and observability

Dynamic modularity needs disciplined operations.

## Health model

Report separately:

- process/JVM liveness;
- framework state and unresolved bundles;
- DS unsatisfied components;
- required service availability;
- configuration validity;
- business readiness;
- external dependency health.

A bundle count alone is not health. A deliberately inactive optional bundle is
not a failure.

## Metrics and logs

Measure service bind/unbind events, component activation failures, resolver
errors, bundle state changes, configuration updates, HTTP routes, feature
install duration, thread pools, heap/GC, and user outcomes. Control cardinality:
bundle symbolic name is useful; service ID per request is usually not.

## Support snapshot

Capture framework/runtime version, Java build, installed features, bundle
states, unresolved diagnostics, wirings, DS states, sanitized configuration,
recent logs, threads, memory summary, artifact digests, and timestamps.
Redact secrets and personal data.

## Security boundaries

Modern Java no longer relies on Security Manager as a general sandbox. OSGi
metadata gives class-space encapsulation, not hostile-code isolation. Use
process/container boundaries for untrusted code.

Protect provisioning repositories, signatures, remote shell, JMX, Web Console,
HTTP management, configuration, bundle cache, logs, and dumps. Patch the JDK
and every independently versioned OSGi component.

## Safe update

1. resolve and integration-test the closure;
2. confirm API baselines and config migration;
3. stage with the real state shape;
4. quiesce work if live update is unsafe;
5. install/update, refresh only required wirings;
6. verify components and business probes;
7. roll back with compatible data/config.

## Feynman check

Dynamic update is a capability, not a requirement. Explain when a controlled
process restart is safer than refreshing bundles in place.