ColdFusion Docker Containers Hanging During Security Updates

When a ColdFusion Docker container hangs during or after a security update, the cause is almost never “the update” itself — it’s one of a handful of container-specific problems the update exposes. The big ones: (1) cfpm (the package manager) needs network access during the build/startup to download modules, so behind a proxy or with no egress it hangs waiting on a download that never completes; (2) the OSGi/Felix bundle cache conflict (the same July-2025 issue that broke ) gets baked into an image layer and the container stalls loading conflicting bundles; (3) ColdFusion's startup time exceeds the orchestrator's health-probe timeout, so Kubernetes/Docker kills the "unhealthy" container mid-startup in a restart loop that looks like a hang; and (4) JVM heap settings exceed the container's memory limit, causing the JVM to stall or get OOM-killed before logging even initializes (which is why the logs look empty). The correct fix for containers is fundamentally different from patching a server in place: you don't update a running container — you build a new, immutable image on a specific patched version tag, test it, and redeploy. This guide covers every failure mode and the complete fix.
Read More