From ab3f4a083fc3b5bb1fcbe87ae61e5aff3d5b97ea Mon Sep 17 00:00:00 2001
From: Hannah Robertson <1076701+hannahilea@users.noreply.github.com>
Date: Wed, 4 Mar 2026 17:08:22 +0000
Subject: [PATCH 01/17] Update el-9 shared and besd build

---
 el9-builds/besd/Dockerfile     | 113 +++++++++++++++++++--------------
 el9-builds/besd/entrypoint.sh  |  10 +--
 el9-builds/build-el9           |  97 +---------------------------
 el9-builds/build-hyrax-ngap.sh |   9 +--
 travis-build-recipe            |   8 +--
 5 files changed, 77 insertions(+), 160 deletions(-)

diff --git a/el9-builds/besd/Dockerfile b/el9-builds/besd/Dockerfile
index 30a61730..f558744b 100644
--- a/el9-builds/besd/Dockerfile
+++ b/el9-builds/besd/Dockerfile
@@ -14,7 +14,18 @@
 #
 # Set one or more individual labels
 #
-FROM rockylinux:9
+ARG BES_CORE_IMAGE_TAG
+FROM ${BES_CORE_IMAGE_TAG:-"rockylinux:8"}
+
+ARG BES_CORE_IMAGE_TAG
+RUN if [ -z "$BES_CORE_IMAGE_TAG" ]; then \
+        echo "Error: Non-empty BES_CORE_IMAGE_TAG must be specified. Exiting."; \
+        exit 1; \
+    fi
+
+# User defined and created in the `bes_core` image
+ENV BES_USER ${USER:-"bes_user"}
+
 ENV HR="###############################################################################################################"
 ENV HR2="-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --"
 ENV TARGET_OS="el9"
@@ -37,22 +48,23 @@ RUN echo "RELEASE_DATE: $RELEASE_DATE"
 
 ARG LIBDAP_VERSION
 ENV LIBDAP_VERSION=${LIBDAP_VERSION:-"snapshot-$TARGET_OS"}
-RUN echo "LIBDAP_VERSION: $LIBDAP_VERSION"
-
-ARG LIBDAP_RPM
-ENV LIBDAP_RPM=${LIBDAP_RPM:-"libdap-$LIBDAP_VERSION.$TARGET_OS.x86_64.rpm"}
-RUN echo "LIBDAP_RPM: $LIBDAP_RPM"
-COPY "$LIBDAP_RPM" "/$LIBDAP_RPM"
+RUN LIBDAP_VERSION_FOUND=$(cat libdap_VERSION); \
+    if [ "${LIBDAP_VERSION_FOUND}" == "${LIBDAP_VERSION:-missing}" ]; then \
+        echo "LIBDAP_VERSION: ${LIBDAP_VERSION}"; \
+    else \
+        echo "Error: Expected LIBDAP_VERSION `${LIBDAP_VERSION}`, found version `${LIBDAP_VERSION_FOUND}`. Exiting."; \
+        exit 1; \
+    fi
 
 ARG BES_VERSION
 ENV BES_VERSION=${BES_VERSION:-"snapshot-$TARGET_OS"}
-RUN echo "BES_VERSION: $BES_VERSION"
-
-ARG BES_RPM
-ENV BES_RPM=${BES_RPM:-"bes-$BES_VERSION.static.$TARGET_OS.x86_64.rpm"}
-RUN echo "BES_RPM: $BES_RPM"
-COPY "$BES_RPM" "/$BES_RPM"
-
+RUN BES_VERSION_FOUND=$(cat bes_VERSION); \
+    if [ "${BES_VERSION_FOUND}" == "${BES_VERSION:-missing}" ]; then \
+        echo "BES_VERSION: ${BES_VERSION}"; \
+    else \
+        echo "Error: Expected BES_VERSION \"${BES_VERSION}\", found version \"${BES_VERSION_FOUND}\". Exiting."; \
+        exit 1; \
+    fi
 
 LABEL vendor="OPeNDAP Incorporated"
 LABEL org.opendap.besdaemon.version="$BES_VERSION"
@@ -61,6 +73,7 @@ LABEL org.opendap.hyrax.version.is-production="false"
 LABEL org.opencontainers.image.authors="support@opendap.org"
 
 USER root
+WORKDIR /
 
 ######################################################################
 # Update the OS and create a handy executable shell scipt to simplify
@@ -71,38 +84,45 @@ RUN set -e \
     && dnf install -y $dnf_runtime_packages \
     && echo "#!/bin/bash" > /install-dev-tools \
     && echo "dnf install -y $dnf_developer_tools_packages" > /install-dev-tools \
-    && chmod 755 /install-dev-tools
+    && chmod 755 /install-dev-tools \
+    && dnf clean all
 
-################################################################
-# Install the libdap rpm
-#  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -
-RUN set -e \
-    && echo "$HR" >&2 \
-    && echo "# Installing the libdap rpm: $LIBDAP_RPM" >&2 \
-    && ls -l ./libdap* \
-    && dnf -y install ./libdap-*.rpm \
-    && echo "# The 'dnf install' command exited with status: $?" >&2 \
-    && rm -f "./$LIBDAP_RPM" \
-    && dnf clean all \
-    && echo "# libdap4 is installed." >&2 \
-    && echo "$HR" >&2
-
-################################################################
-# Install the the BES
-# besd, besdaemon, beslistener, besctl, besstandalone, bescmdline
-#  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -
-RUN set -e \
-    && echo "$HR" >&2 \
-    && echo "# Installing the BES rpm: $BES_RPM" >&2 \
-    && ls -l ./bes* \
-    && dnf -y install ./bes-*.rpm \
-    && echo "# The 'dnf install' command exited with status: $?" >&2 \
-    && rm -f "./$BES_RPM" \
-    && dnf clean all \
-    && echo "# besdaemon is here: $(which besdaemon)" >&2 \
-    && echo "#      besdaemon -v: '$(besdaemon -v)'" >&2 \
-    && echo "$HR" >&2
+######################################################################
 
+# Set up BES
+#
+# BES is already installed on the base image, but
+# we need to do some additional configuration (to match what was
+# previously handled by bes RPM installation)
+
+# Add besd service to start at boot
+RUN cp ${PREFIX}/etc/rc.d/init.d/besd /etc/rc.d/init.d/besd \
+    && chkconfig --add besd \
+    && ldconfig \
+    && chkconfig --list | grep besd \
+    && echo "whoami: "`whoami` \
+    && echo "besdaemon is here: "`which besdaemon`
+
+# Adapted from bes/spec.all_static.in in RPM creation.
+# The four *.pem substitutions may be unnecessary, as those *.pem files may be
+# vestigial substitutions for a build process past.
+RUN sed -i.dist \
+    -e 's:=.*/bes.log:=/var/log/bes/bes.log:' \
+    -e 's:=.*/lib/bes:='"$PREFIX"'/lib/bes:' \
+    -e 's:=.*/share/bes:='"$PREFIX"'/share/bes:' \
+    -e 's:=.*/share/hyrax:='"$PREFIX"'/share/hyrax:' \
+    -e 's:=/full/path/to/serverside/certificate/file.pem:=/etc/pki/bes/cacerts/file.pem:' \
+    -e 's:=/full/path/to/serverside/key/file.pem:=/etc/pki/bes/public/file.pem:' \
+    -e 's:=/full/path/to/clientside/certificate/file.pem:=/etc/pki/bes/cacerts/file.pem:' \
+    -e 's:=/full/path/to/clientside/key/file.pem:=/etc/pki/bes/public/file.pem:' \
+    -e 's:=user_name:='"$BES_USER"':' \
+    -e 's:=group_name:='"$BES_USER"':' \
+    $PREFIX/etc/bes/bes.conf \
+    && mkdir -p "/var/log/bes/" \
+    && touch "/var/log/bes/bes.log" \
+    && sudo chown -R $BES_USER:$BES_USER "/var/log/bes/"
+
+RUN echo "besdaemon is here: "`which besdaemon`
 
 COPY entrypoint.sh /entrypoint.sh
 RUN  chmod +x /entrypoint.sh
@@ -111,10 +131,5 @@ ENTRYPOINT ["/entrypoint.sh"]
 EXPOSE 10022
 EXPOSE 11002
 
-# can't use USER with entrypoint that needs root
-# use gosu or, as done, enable bes user write so the entrypoint doe snot need root
-RUN  chown -R bes /etc/bes
-USER root
-
 CMD ["-"]
 
diff --git a/el9-builds/besd/entrypoint.sh b/el9-builds/besd/entrypoint.sh
index 8dbc4289..50895a29 100755
--- a/el9-builds/besd/entrypoint.sh
+++ b/el9-builds/besd/entrypoint.sh
@@ -112,11 +112,11 @@ fi
 #
 if [ "$SERVER_HELP_EMAIL" != "not_set" ]; then
     loggy "Setting Admin Contact To: $SERVER_HELP_EMAIL"
-    sed -i "s/admin.email.address@your.domain.name/$SERVER_HELP_EMAIL/" /etc/bes/bes.conf
+    sed -i "s/admin.email.address@your.domain.name/$SERVER_HELP_EMAIL/" $PREFIX/etc/bes/bes.conf
 fi
 if [ "$FOLLOW_SYMLINKS" != "not_set" ]; then
     loggy "Setting BES FollowSymLinks to YES."
-    sed -i "s/^BES.Catalog.catalog.FollowSymLinks=No/BES.Catalog.catalog.FollowSymLinks=Yes/" /etc/bes/bes.conf
+    sed -i "s/^BES.Catalog.catalog.FollowSymLinks=No/BES.Catalog.catalog.FollowSymLinks=Yes/" $PREFIX/etc/bes/bes.conf
 fi
 
 #-------------------------------------------------------------------------------
@@ -128,16 +128,16 @@ bes_gid="$(id -g bes)"
 echo "bes_gid: $bes_gid"
 
 # Start the BES daemon process
-# /usr/bin/besdaemon -i /usr -c /etc/bes/bes.conf -r /var/run/bes.pid
+# $PREFIX/usr/bin/besdaemon -i $PREFIX/usr -c $PREFIX/etc/bes/bes.conf -r /var/run/bes.pid
 loggy "Calling 'besctl start'"
-/usr/bin/besctl start
+$PREFIX/usr/bin/besctl start
 status=$?
 if [ $status -ne 0 ]; then
     loggy "ERROR: Failed to start BES: $status"
     exit $status
 fi
 
-besd_pid="$(ps aux | grep /usr/bin/besdaemon | grep -v grep | awk '{print $2;}' - )"
+besd_pid="$(ps aux | grep $PREFIX/usr/bin/besdaemon | grep -v grep | awk '{print $2;}' - )"
 loggy "The besdaemon is UP! pid: $besd_pid"
 start_time=
 start_time="$(date  "+%s")"
diff --git a/el9-builds/build-el9 b/el9-builds/build-el9
index 70fd92b9..3615c89b 100755
--- a/el9-builds/build-el9
+++ b/el9-builds/build-el9
@@ -83,6 +83,7 @@ function read_build_recipe() {
     # export APR_VERSION
     export OS_SNAPSHOT_IMAGE_TAG
     export OS_BUILD_VERSION_TAG
+    export BES_CORE_IMAGE_TAG
     export TEST_DEPLOYMENT
 
 
@@ -96,6 +97,7 @@ function read_build_recipe() {
     #APR_VERSION="1.7.6-1"
     #APR_VERSION=${APR_VERSION:-$(echo "${build_recipe}" | grep apr | sed "s/apr-//g" | awk '{print $1;}')}
     TEST_DEPLOYMENT="${TEST_DEPLOYMENT:-"$(get_test_deployment_tag "$build_recipe_file")"}"
+    BES_CORE_IMAGE_TAG="opendap/bes_core:$BES_VERSION-$TARGET_OS"
 
     if test "$DOCKER_NAME" == "ngap"
     then
@@ -138,6 +140,7 @@ function show_version(){
     loggy "$prolog       TEST_DEPLOYMENT: $TEST_DEPLOYMENT"
     loggy "$prolog        LIBDAP_VERSION: $LIBDAP_VERSION"
     loggy "$prolog           BES_VERSION: $BES_VERSION"
+    loggy "$prolog    BES_CORE_IMAGE_TAG: $BES_CORE_IMAGE_TAG"
     loggy "$prolog          OLFS_VERSION: $OLFS_VERSION"
     loggy "$prolog         HYRAX_VERSION: $HYRAX_VERSION"
     loggy "$prolog           DOCKER_NAME: $DOCKER_NAME"
@@ -494,72 +497,6 @@ function s3_pull(){
     loggy "$prolog END"
 }
 
-################################################################################
-#
-# s3_get_besd_distro() - Get the rpm and war files need for a Hyrax installation
-#    from the identified S3 bucket.
-#    $1 - The AWS S3 bucket from which to pull the Hyrax components
-#    $2 - The directory into which to place the Hyrax components.
-#    $3 - The linux architecture (aka el7, el8, etc.)
-#    $4 - The libap version number ##.##.##-##
-#    $5 - The bes version number ##.##.##-##
-#    $6 - A debug flag, if present (i.e. not empty string) then the devel and
-#         debuginfo rpm files for libdap and bes will be retrieved as well.
-#
-function s3_get_besd_distro() {
-    local prolog="s3_get_besd_distro() -"
-    loggy "${HR2}"
-    loggy "$prolog BEGIN"
-    local s3_bucket="${1}"
-    loggy "$prolog          s3_bucket: ${s3_bucket}"
-    local target_dir="${2}"
-    loggy "$prolog         target_dir: ${target_dir}"
-    local larch="${3}"
-    loggy "$prolog linux_architecture: ${larch}"
-    local libdap_version="${4}"
-    loggy "$prolog     libdap_version: ${libdap_version}"
-    local bes_version="${5}"
-    loggy "$prolog        bes_version: ${bes_version}"
-    local debug="${6}"
-    loggy "$prolog              debug: ${debug}"
-
-    set -e
-
-    loggy "$prolog Cleaning up..."
-    rm -fv "${target_dir}/*.rpm"
-
-    loggy ""
-    s3_pull "${s3_bucket}" \
-            "libdap-${libdap_version}.${larch}.x86_64.rpm" \
-            "${target_dir}"
-
-    if test -n "${debug}"; then # Only get the debug libs when invoked in debug mode
-        s3_pull "${s3_bucket}" \
-                "libdap-devel-${libdap_version}.${larch}.x86_64.rpm" \
-                "${target_dir}"
-        s3_pull "${s3_bucket}" \
-                "libdap-debuginfo-${libdap_version}.${larch}.x86_64.rpm" \
-                "${target_dir}"
-    fi
-
-    s3_pull "${s3_bucket}" \
-            "bes-${bes_version}.static.${larch}.x86_64.rpm" \
-            "${target_dir}"
-
-    if test -n "${debug}"; then # Only get the debug libs when invoked in debug mode
-        s3_pull "${s3_bucket}" \
-                "bes-devel-${bes_version}.static.${larch}.x86_64.rpm" \
-                "${target_dir}"
-        s3_pull "${s3_bucket}" \
-                "bes-debuginfo-${bes_version}.static.${larch}.x86_64.rpm" \
-                "${target_dir}"
-    fi
-
-    set +e
-    loggy ""
-    return 0
-}
-
 ################################################################################
 #
 # s3_get_apache_apr_distro() - Get the rpm and war files need for a Hyrax installation
@@ -1034,13 +971,6 @@ function build_hyrax() {
         "${DOCKER_NAME}" \
         "${TOMCAT_VERSION}" 2>&1 | tee -a "${log_file}"
 
-    s3_get_besd_distro \
-        "${S3_BUILD_BUCKET}" \
-        "${DOCKER_NAME}" \
-        "$TARGET_OS" \
-        "${LIBDAP_VERSION}" \
-        "${BES_VERSION}" $debug 2>&1 | tee -a "${log_file}"
-
     s3_get_olfs_distro \
         "${S3_BUILD_BUCKET}" \
         "${DOCKER_NAME}" \
@@ -1095,13 +1025,6 @@ function build_ngap() {
         "${DOCKER_NAME}" \
         "${tomcat_version}" 2>&1 | tee -a "${log_file}"
 
-    s3_get_besd_distro \
-        "${S3_BUILD_BUCKET}" \
-        "${DOCKER_NAME}" \
-        "el8" \
-        "${LIBDAP_VERSION}" \
-        "${BES_VERSION}" 2>&1 | tee -a "${log_file}"
-
     get_ngap_olfs_distro \
         "${S3_BUILD_BUCKET}" \
         "${DOCKER_NAME}" \
@@ -1189,13 +1112,6 @@ function build_besd() {
     export DOCKER_NAME="besd"
     show_version 2>&1 | tee "${log_file}"
 
-    s3_get_besd_distro \
-        "${S3_BUILD_BUCKET}" \
-        "${DOCKER_NAME}" \
-        "$TARGET_OS" \
-        "${LIBDAP_VERSION}" \
-        "${BES_VERSION}" 2>&1 | tee -a "${log_file}"
-
     build_besd_docker 2>&1 | tee -a "${log_file}"
 #    cleanup_build_files "${DOCKER_NAME}" 2>&1 | tee -a "${log_file}"
 }
@@ -1331,13 +1247,6 @@ function travis_hyrax() {
 
     show_version
     get_tomcat_distro "${DOCKER_NAME}" "${TOMCAT_VERSION}"
-    s3_get_besd_distro \
-        "${S3_BUILD_BUCKET}" \
-        "${DOCKER_NAME}" \
-        "$TARGET_OS" \
-        "${LIBDAP_VERSION}" \
-        "${BES_VERSION}" \
-        "$ADD_DEBUG" 2>&1
     s3_get_olfs_distro \
         "${S3_BUILD_BUCKET}" \
         "${DOCKER_NAME}" \
diff --git a/el9-builds/build-hyrax-ngap.sh b/el9-builds/build-hyrax-ngap.sh
index 8d94e55d..6e4f5f42 100755
--- a/el9-builds/build-hyrax-ngap.sh
+++ b/el9-builds/build-hyrax-ngap.sh
@@ -45,15 +45,7 @@ loggy "APACHE_APR_VERSION: $APACHE_APR_VERSION"
 show_version
 #
 get_tomcat_distro "$DOCKER_NAME" "$TOMCAT_VERSION"
-#
 
-s3_get_besd_distro \
-    "$S3_BUILD_BUCKET" \
-    "$DOCKER_DIR" \
-    "$TARGET_OS" \
-    "$LIBDAP_VERSION" \
-    "$BES_VERSION" "$ADD_DEBUG_RPMS"
-#
 s3_get_apache_apr_distro \
     "$S3_BUILD_BUCKET" \
     "$DOCKER_DIR" \
@@ -81,6 +73,7 @@ docker build \
        --build-arg LIBDAP_VERSION \
        --build-arg BES_VERSION \
        --build-arg OLFS_VERSION \
+       --build-arg BES_CORE_IMAGE_TAG \
        --build-arg OPENSSL_VERSION \
        --tag "${OS_SNAPSHOT_IMAGE_TAG}" \
        --tag "${OS_BUILD_VERSION_TAG}" \
diff --git a/travis-build-recipe b/travis-build-recipe
index 953f60d9..6d2f3853 100644
--- a/travis-build-recipe
+++ b/travis-build-recipe
@@ -1,6 +1,6 @@
-TARGET_OS: el8
-TOMCAT_MAJOR_VERSION: 9
+TARGET_OS: el9
+TOMCAT_MAJOR_VERSION: 11
 libdap4-3.21.1-390 2026-03-04T03:14:01+0000
 bes-3.21.1-1093 2026-03-04T13:22:30+0000
-olfs-1.18.15-718 2026-03-04T13:35:59+0000
-hyrax-1.17.1-718 2026-03-04T13:35:59+0000
+olfs-1.18.15-719 2026-03-04T13:48:11+0000
+hyrax-1.17.1-719 2026-03-04T13:48:11+0000

From 321793a5a135721ec9e580bb1a9365bdc5081954 Mon Sep 17 00:00:00 2001
From: Hannah Robertson <1076701+hannahilea@users.noreply.github.com>
Date: Wed, 4 Mar 2026 17:20:41 +0000
Subject: [PATCH 02/17] update el9 hyrax

---
 el9-builds/besd/Dockerfile     |   1 +
 el9-builds/besd/entrypoint.sh  |   2 +-
 el9-builds/hyrax/Dockerfile    | 132 ++++++++++++++++++---------------
 el9-builds/hyrax/entrypoint.sh |  15 ++--
 4 files changed, 81 insertions(+), 69 deletions(-)

diff --git a/el9-builds/besd/Dockerfile b/el9-builds/besd/Dockerfile
index f558744b..4250762f 100644
--- a/el9-builds/besd/Dockerfile
+++ b/el9-builds/besd/Dockerfile
@@ -46,6 +46,7 @@ ARG RELEASE_DATE
 ENV RELEASE_DATE="${RELEASE_DATE:-$(date +%s)}"
 RUN echo "RELEASE_DATE: $RELEASE_DATE"
 
+# Fail if requested LIBDAP_VERSION or BES_VERSION do not match installations in base image
 ARG LIBDAP_VERSION
 ENV LIBDAP_VERSION=${LIBDAP_VERSION:-"snapshot-$TARGET_OS"}
 RUN LIBDAP_VERSION_FOUND=$(cat libdap_VERSION); \
diff --git a/el9-builds/besd/entrypoint.sh b/el9-builds/besd/entrypoint.sh
index 50895a29..4f2d36f6 100755
--- a/el9-builds/besd/entrypoint.sh
+++ b/el9-builds/besd/entrypoint.sh
@@ -128,7 +128,7 @@ bes_gid="$(id -g bes)"
 echo "bes_gid: $bes_gid"
 
 # Start the BES daemon process
-# $PREFIX/usr/bin/besdaemon -i $PREFIX/usr -c $PREFIX/etc/bes/bes.conf -r /var/run/bes.pid
+# /usr/bin/besdaemon -i /usr -c $PREFIX/etc/bes/bes.conf -r /var/run/bes.pid
 loggy "Calling 'besctl start'"
 $PREFIX/usr/bin/besctl start
 status=$?
diff --git a/el9-builds/hyrax/Dockerfile b/el9-builds/hyrax/Dockerfile
index f01ab730..184ddfa1 100644
--- a/el9-builds/hyrax/Dockerfile
+++ b/el9-builds/hyrax/Dockerfile
@@ -13,7 +13,20 @@
 # it for debugging stuff.
 #
 # Set one or more individual labels
-FROM rockylinux:9
+ARG BES_CORE_IMAGE_TAG
+FROM ${BES_CORE_IMAGE_TAG:-rockylinux:8}
+
+ARG BES_CORE_IMAGE_TAG
+RUN if test -n "$BES_CORE_IMAGE_TAG"; then \
+        echo "BES_CORE_IMAGE_TAG appears to be set: '$BES_CORE_IMAGE_TAG'" ;\
+    else \
+        echo "Error: Non-empty BES_CORE_IMAGE_TAG must be specified. Exiting."; \
+        exit 1; \
+    fi
+
+# User defined and created in the `bes_core` image
+ENV BES_USER ${USER:-"bes_user"}
+
 ENV HR="###############################################################################################################"
 ENV HR2="-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --"
 ENV TARGET_OS="el9"
@@ -58,25 +71,26 @@ ARG HYRAX_VERSION
 ENV HYRAX_VERSION=${HYRAX_VERSION:-"snapshot-$TARGET_OS"}
 RUN echo "# HYRAX_VERSION: $HYRAX_VERSION"
 
+# Fail if requested LIBDAP_VERSION or BES_VERSION do not match installations in base image
 ARG LIBDAP_VERSION
 ENV LIBDAP_VERSION=${LIBDAP_VERSION:-"snapshot-$TARGET_OS"}
-RUN echo "# LIBDAP_VERSION: $LIBDAP_VERSION"
-
-ARG LIBDAP_RPM
-ENV LIBDAP_RPM=${LIBDAP_RPM:-"libdap-$LIBDAP_VERSION.$TARGET_OS.x86_64.rpm"}
-RUN echo "# LIBDAP_RPM: $LIBDAP_RPM"
-COPY "$LIBDAP_RPM" libdap-devel-* libdap-debuginfo-* /
-RUN ls -l /libdap-*  >&2
+RUN LIBDAP_VERSION_FOUND=$(cat libdap_VERSION); \
+    if [ "${LIBDAP_VERSION_FOUND}" == "${LIBDAP_VERSION:-missing}" ]; then \
+        echo "LIBDAP_VERSION: ${LIBDAP_VERSION}"; \
+    else \
+        echo "Error: Expected LIBDAP_VERSION `${LIBDAP_VERSION}`, found version `${LIBDAP_VERSION_FOUND}`. Exiting."; \
+        exit 1; \
+    fi
 
 ARG BES_VERSION
 ENV BES_VERSION=${BES_VERSION:-"snapshot-$TARGET_OS"}
-RUN echo "# BES_VERSION: $BES_VERSION"
-
-ARG BES_RPM
-ENV BES_RPM=${BES_RPM:-"bes-$BES_VERSION.static.$TARGET_OS.x86_64.rpm"}
-RUN echo "# BES_RPM: $BES_RPM"
-COPY "$BES_RPM" bes-devel-* bes-debuginfo-* /
-RUN ls -l /bes-* >&2
+RUN BES_VERSION_FOUND=$(cat bes_VERSION); \
+    if [ "${BES_VERSION_FOUND}" == "${BES_VERSION:-missing}" ]; then \
+        echo "BES_VERSION: ${BES_VERSION}"; \
+    else \
+        echo "Error: Expected BES_VERSION \"${BES_VERSION}\", found version \"${BES_VERSION_FOUND}\". Exiting."; \
+        exit 1; \
+    fi
 
 ARG OLFS_VERSION
 ENV OLFS_VERSION=${OLFS_VERSION:-"snapshot-$TARGET_OS"}
@@ -103,6 +117,7 @@ LABEL org.opendap.hyrax.version.is-production="false"
 LABEL org.opencontainers.image.authors="support@opendap.org"
 
 USER root
+WORKDIR /
 
 #
 # The --build-arg USE_NCWMS can be set to "true" in order to 
@@ -138,7 +153,7 @@ RUN set -e \
     && dnf update -y \
     && echo "#!/bin/bash" > /install-dev-tools \
     && echo "dnf install -y $dnf_developer_tools_packages" > /install-dev-tools \
-    && chmod 755 /install-dev-tools
+    && chmod 755 /install-dev-tools \
 
 ######################################################################
 # Rocky9 comes with built in curl-minimal. For our puposes we want
@@ -146,13 +161,13 @@ RUN set -e \
 # The '--allowerasing' parameter enables dnf to erase curl-minimal
 # and then install the full package.
 #
-RUN set -e \
+# RUN set -e \
     && echo "$HR" >&2 \
     && echo "# Installing cURL for developers (not minimal cURL)" >&2 \
     && dnf install -y curl curl-devel --allowerasing \
     && echo "# cURL version: $(curl --version)" >&2 \
-    && dnf clean all \
-    && echo "$HR" >&2
+    # && dnf clean all \
+    && echo "$HR" >&2 \
 
 ######################################################################
 # We want java ac ertain way ($java_version) and
@@ -164,7 +179,7 @@ RUN set -e \
 #       update-alternatives --list
 # - We're using the one we wanted:
 #       echo "# java version: $( java -version 2>&1 )"
-RUN set -e \
+# RUN set -e \
     && echo "$HR" >&2 \
     && echo "# It's Java Time Witches!" >&2 \
     && echo "# Installing $java_version" >&2 \
@@ -175,10 +190,10 @@ RUN set -e \
     && echo "# Enabled $java_version" >&2 \
     && echo "# java version: $( java -version 2>&1 )" \
     && update-alternatives --list \
-    && dnf clean all \
-    && echo "$HR" >&2
+    # && dnf clean all \
+    && echo "$HR" >&2 \
 
-RUN set -e \
+# RUN set -e \
     && dnf install -y $dnf_runtime_packages $dnf_regression_test_packages \
     && dnf clean all
 #
@@ -186,34 +201,38 @@ RUN set -e \
 #
 
 ################################################################
-# Install the libdap rpm
-#  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -
-RUN set -e \
-    && echo "$HR" >&2 \
-    && echo "# Installing the libdap rpm: $LIBDAP_RPM" >&2 \
-    && ls -l ./libdap* \
-    && dnf -y install ./libdap-*.rpm \
-    && echo "# The 'dnf install' command exited with status: $?" >&2 \
-    && rm -f "./$LIBDAP_RPM" \
-    && dnf clean all \
-    && echo "# libdap4 is installed." >&2 \
-    && echo "$HR" >&2
-
-################################################################
-# Install the the BES
-# besd, besdaemon, beslistener, besctl, besstandalone, bescmdline
-#  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -
-RUN set -e \
-    && echo "$HR" >&2 \
-    && echo "# Installing the BES rpm: $BES_RPM" >&2 \
-    && ls -l ./bes* \
-    && dnf -y install ./bes-*.rpm \
-    && echo "# The 'dnf install' command exited with status: $?" >&2 \
-    && rm -f "./$BES_RPM" \
-    && dnf clean all \
-    && echo "# besdaemon is here: $(which besdaemon)" >&2 \
-    && echo "#      besdaemon -v: '$(besdaemon -v)'" >&2 \
-    && echo "$HR" >&2
+# Set up BES
+#
+# BES is already installed on the base image, but
+# we need to do some additional configuration (to match what was
+# previously handled by bes RPM installation)
+
+# Add besd service to start at boot
+RUN cp ${PREFIX}/etc/rc.d/init.d/besd /etc/rc.d/init.d/besd \
+    && chkconfig --add besd \
+    && ldconfig \
+    && chkconfig --list | grep besd \
+    && echo "whoami: "`whoami` \
+    && echo "besdaemon is here: "`which besdaemon`
+
+# Adapted from bes/spec.all_static.in in RPM creation.
+# The four *.pem substitutions may be unnecessary, as those *.pem files may be
+# vestigial substitutions for a build process past.
+RUN sed -i.dist \
+    -e 's:=.*/bes.log:=/var/log/bes/bes.log:' \
+    -e 's:=.*/lib/bes:='"$PREFIX"'/lib/bes:' \
+    -e 's:=.*/share/bes:='"$PREFIX"'/share/bes:' \
+    -e 's:=.*/share/hyrax:='"$PREFIX"'/share/hyrax:' \
+    -e 's:=/full/path/to/serverside/certificate/file.pem:=/etc/pki/bes/cacerts/file.pem:' \
+    -e 's:=/full/path/to/serverside/key/file.pem:=/etc/pki/bes/public/file.pem:' \
+    -e 's:=/full/path/to/clientside/certificate/file.pem:=/etc/pki/bes/cacerts/file.pem:' \
+    -e 's:=/full/path/to/clientside/key/file.pem:=/etc/pki/bes/public/file.pem:' \
+    -e 's:=user_name:='"$BES_USER"':' \
+    -e 's:=group_name:='"$BES_USER"':' \
+    $PREFIX/etc/bes/bes.conf \
+    && mkdir -p "/var/log/bes/" \
+    && touch "/var/log/bes/bes.log" \
+    && sudo chown -R $BES_USER:$BES_USER "/var/log/bes/"
 
 ################################################################
 # Install and Setup Tomcat
@@ -288,12 +307,6 @@ RUN set -e \
     && chown -R tomcat:tomcat "$CATALINA_HOME/webapps/$DEPLOYMENT_CONTEXT/WEB-INF/conf/logs" \
     && chmod 700 "$CATALINA_HOME/webapps/$DEPLOYMENT_CONTEXT/WEB-INF/conf/logs"
 
-################################################################
-# Clean up the Hyrax distribution binaries.
-#
-#
-################################################################
-
 ################################################################
 # retrieve and install the ncWMS web application
 #  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -
@@ -350,7 +363,7 @@ RUN set -e \
     && echo "# Retrieving, and building hyrax regression tests." \
     && echo "# h_r_t will be in: $TEST_INSTALL_DIR" \
     && mkdir -p "$TEST_INSTALL_DIR" \
-    && git clone -v https://github.com/opendap/hyrax_regression_tests "$TEST_INSTALL_DIR" \
+    && git clone --depth 1 -v https://github.com/opendap/hyrax_regression_tests "$TEST_INSTALL_DIR" \
     && cd "$TEST_INSTALL_DIR" \
     && autoreconf -vif \
     && ./configure
@@ -386,9 +399,6 @@ EXPOSE 8443
 EXPOSE 10022
 EXPOSE 11002
 
-# can't use USER with entrypoint that needs root
-# use gosu or, as done, enable bes user write so the entrypoint does not need root
-RUN chown -R bes /etc/bes
 USER root
 
 CMD ["-"]
diff --git a/el9-builds/hyrax/entrypoint.sh b/el9-builds/hyrax/entrypoint.sh
index 97d1a1f3..33f5df2c 100755
--- a/el9-builds/hyrax/entrypoint.sh
+++ b/el9-builds/hyrax/entrypoint.sh
@@ -139,11 +139,11 @@ fi
 #
 if test "$SERVER_HELP_EMAIL" != "not_set" ; then
     loggy "Setting Admin Contact To: $SERVER_HELP_EMAIL"
-    sed -i "s/admin.email.address@your.domain.name/$SERVER_HELP_EMAIL/" "/etc/bes/bes.conf"
+    sed -i "s/admin.email.address@your.domain.name/$SERVER_HELP_EMAIL/" "$PREFIX/etc/bes/bes.conf"
 fi
 if test "$FOLLOW_SYMLINKS" != "not_set" ; then
     loggy "Setting BES FollowSymLinks to YES."
-    sed -i "s/^BES.Catalog.catalog.FollowSymLinks=No/BES.Catalog.catalog.FollowSymLinks=Yes/" "/etc/bes/bes.conf"
+    sed -i "s/^BES.Catalog.catalog.FollowSymLinks=No/BES.Catalog.catalog.FollowSymLinks=Yes/" "$PREFIX/etc/bes/bes.conf"
 fi
 
 loggy "JAVA VERSION: $( java -version 2>&1 )"
@@ -170,22 +170,23 @@ loggy "PythonVersion (again): $( python3 --version 2>&1 )"
 #-------------------------------------------------------------------------------
 # We use 'echo' in the following because downstream code is expecting this
 # output to be a key value pair, so none of that loggy() stuff
-bes_uid="$(id -u bes)"
+bes_username=$BES_USER
+bes_uid=$(id -u ${bes_username})
 echo "bes_uid: $bes_uid"
-bes_gid="$(id -g bes)"
+bes_gid=$(id -g ${bes_username})
 echo "bes_gid: $bes_gid"
 
 #-------------------------------------------------------------------------------
 # Start the BES daemon process
-# /usr/bin/besdaemon -i /usr -c /etc/bes/bes.conf -r /var/run/bes.pid (old way)
+# $PREFIX/usr/bin/besdaemon -i /usr -c $PREFIX/etc/bes/bes.conf -r /var/run/bes.pid (old way)
 loggy "Launching besd..."
-/usr/bin/besctl start
+$PREFIX/bin/besctl starttart
 status=$?
 if test $status -ne 0 ; then
     loggy "ERROR: Failed to start BES: $status"
     exit $status
 fi
-besd_pid="$(ps aux | grep "/usr/bin/besdaemon" | grep -v grep | awk '{print $2;}' - )"
+besd_pid="$(ps aux | grep "$PREFIX/bin/besdaemon" | grep -v grep | awk '{print $2;}' - )"
 loggy "The besd is UP! [pid: $besd_pid]"
 
 #-------------------------------------------------------------------------------

From 3a1407063cc8aaa821d541871736a37a3fa908a8 Mon Sep 17 00:00:00 2001
From: Hannah Robertson <1076701+hannahilea@users.noreply.github.com>
Date: Wed, 4 Mar 2026 17:35:37 +0000
Subject: [PATCH 03/17] udpate el9 ngap

---
 el8-builds/ngap/entrypoint.sh  |   3 +-
 el9-builds/hyrax/entrypoint.sh |   2 +-
 el9-builds/ngap/Dockerfile     | 144 ++++++++++++++++++---------------
 el9-builds/ngap/entrypoint.sh  |  29 ++++---
 4 files changed, 100 insertions(+), 78 deletions(-)

diff --git a/el8-builds/ngap/entrypoint.sh b/el8-builds/ngap/entrypoint.sh
index 68a2adcb..07c1340c 100755
--- a/el8-builds/ngap/entrypoint.sh
+++ b/el8-builds/ngap/entrypoint.sh
@@ -14,7 +14,8 @@ if [[ "$LOG_KEY_PREFIX" != *"-" ]]; then
 fi
 
 # Set in docker image.
-# BES_USER initially defined upstream in docker image base `bes_core` as $USER
+# BES_USER initially defined upstream in docker image base `bes_core` as $USER,
+# updated to $BES_USER in ngap/Dockerfile
 export PREFIX=${PREFIX:-"/root/install"}
 export BES_USER=${BES_USER:-"bes_user"}
 
diff --git a/el9-builds/hyrax/entrypoint.sh b/el9-builds/hyrax/entrypoint.sh
index 33f5df2c..0ccb1093 100755
--- a/el9-builds/hyrax/entrypoint.sh
+++ b/el9-builds/hyrax/entrypoint.sh
@@ -178,7 +178,7 @@ echo "bes_gid: $bes_gid"
 
 #-------------------------------------------------------------------------------
 # Start the BES daemon process
-# $PREFIX/usr/bin/besdaemon -i /usr -c $PREFIX/etc/bes/bes.conf -r /var/run/bes.pid (old way)
+# /usr/bin/besdaemon -i /usr -c $PREFIX/etc/bes/bes.conf -r /var/run/bes.pid (old way)
 loggy "Launching besd..."
 $PREFIX/bin/besctl starttart
 status=$?
diff --git a/el9-builds/ngap/Dockerfile b/el9-builds/ngap/Dockerfile
index 0db2b8cb..bd9a48b5 100644
--- a/el9-builds/ngap/Dockerfile
+++ b/el9-builds/ngap/Dockerfile
@@ -13,7 +13,18 @@
 # it for debugging stuff.
 #
 # Set one or more individual labels
-FROM rockylinux:9
+ARG BES_CORE_IMAGE_TAG
+FROM ${BES_CORE_IMAGE_TAG:-"rockylinux:8"}
+
+ARG BES_CORE_IMAGE_TAG
+RUN if [ -z "$BES_CORE_IMAGE_TAG" ]; then \
+        echo "Error: Non-empty BES_CORE_IMAGE_TAG must be specified. Exiting."; \
+        exit 1; \
+    fi
+
+# User defined and created in the `bes_core` image
+ENV BES_USER ${USER:-"bes_user"}
+
 LABEL org.opencontainers.image.authors="support@opendap.org"
 USER root
 ENV DEBUG_BUILD=""
@@ -81,25 +92,26 @@ ARG HYRAX_VERSION
 ENV HYRAX_VERSION=${HYRAX_VERSION:-"snapshot-$TARGET_OS"}
 RUN echo "# HYRAX_VERSION: ${HYRAX_VERSION}"
 
+# Fail if requested LIBDAP_VERSION or BES_VERSION do not match installations in base image
 ARG LIBDAP_VERSION
 ENV LIBDAP_VERSION="${LIBDAP_VERSION:-"snapshot"}"
-RUN echo "# LIBDAP_VERSION: $LIBDAP_VERSION"
-
-ARG LIBDAP_RPM
-ENV LIBDAP_RPM="${LIBDAP_RPM:-"libdap-$LIBDAP_VERSION.$TARGET_OS.x86_64.rpm"}"
-RUN echo "# LIBDAP_RPM: $LIBDAP_RPM"
-COPY ${LIBDAP_RPM} libdap-devel-* libdap-debuginfo-* /
-RUN ls -l /libdap-*  >&2
+RUN LIBDAP_VERSION_FOUND=$(cat libdap_VERSION); \
+    if [ "${LIBDAP_VERSION_FOUND}" == "${LIBDAP_VERSION:-missing}" ]; then \
+        echo "LIBDAP Version: ${LIBDAP_VERSION}"; \
+    else \
+        echo "Error: Expected LIBDAP_VERSION `${LIBDAP_VERSION}`, found version `${LIBDAP_VERSION_FOUND}`. Exiting."; \
+        exit 1; \
+    fi
 
 ARG BES_VERSION
 ENV BES_VERSION="${BES_VERSION:-"snapshot-$TARGET_OS"}"
-RUN echo "# BES_VERSION: $BES_VERSION"
-
-ARG BES_RPM
-ENV BES_RPM="${BES_RPM:-"bes-$BES_VERSION.static.$TARGET_OS.x86_64.rpm"}"
-RUN echo "# BES_RPM: $BES_RPM"
-COPY "$BES_RPM" bes-devel-* bes-debuginfo-* /
-RUN ls -l /bes-* >&2
+RUN BES_VERSION_FOUND=$(cat bes_VERSION); \
+    if [ "${BES_VERSION_FOUND}" == "${BES_VERSION:-missing}" ]; then \
+        echo "BES Version: ${BES_VERSION}"; \
+    else \
+        echo "Error: Expected BES_VERSION \"${BES_VERSION}\", found version \"${BES_VERSION_FOUND}\". Exiting."; \
+        exit 1; \
+    fi
 
 ARG OLFS_VERSION
 ENV OLFS_VERSION="${OLFS_VERSION:-"unknown"}"
@@ -138,6 +150,7 @@ LABEL org.opendap.hyrax.version.is-production="false"
 LABEL org.opencontainers.image.authors="support@opendap.org"
 
 USER root
+WORKDIR /
 
 ######################################################################
 # Update the OS and create a handy executable shell scipt to simplify
@@ -147,7 +160,7 @@ RUN set -e \
     && dnf update -y \
     && echo "#!/bin/bash" > /install-dev-tools \
     && echo "dnf install -y $dnf_developer_tools_packages" > /install-dev-tools \
-    && chmod 755 /install-dev-tools
+    && chmod 755 /install-dev-tools \
 
 
 ######################################################################
@@ -156,13 +169,13 @@ RUN set -e \
 # The '--allowerasing' parameter enables dnf to erase curl-minimal
 # and then install the full package.
 #
-RUN set -e \
+# RUN set -e \
     && echo "$HR" >&2 \
     && echo "# Installing cURL for developers (not minimal cURL)" >&2 \
     && dnf install -y curl curl-devel --allowerasing \
     && echo "# cURL version: $(curl --version)" >&2 \
     && dnf clean all \
-    && echo "$HR" >&2
+    && echo "$HR" >&2 \
 
 ######################################################################
 # We want java ac ertain way ($java_version) and
@@ -174,7 +187,7 @@ RUN set -e \
 #       update-alternatives --list
 # - We're using the one we wanted:
 #       echo "# java version: $( java -version 2>&1 )"
-RUN set -e \
+# RUN set -e \
     && echo "$HR" >&2 \
     && echo "# It's Java Time Witches!" >&2 \
     && echo "# Installing $java_version" >&2 \
@@ -185,8 +198,8 @@ RUN set -e \
     && echo "# Enabled $java_version" >&2 \
     && echo "# java version: $( java -version 2>&1 )" \
     && update-alternatives --list \
-    && dnf clean all \
-    && echo "$HR" >&2
+    # && dnf clean all \
+    && echo "$HR" >&2 \
 
 ######################################################################
 # This Dockerfile brings in the Tomcat Native APR by using the one
@@ -196,7 +209,7 @@ RUN set -e \
 # We also enable the CodeReady Builder repo so we can get the
 # libtirpc-devel package.
 #
-RUN set -e \
+# RUN set -e \
     && echo "$HR" >&2 \
     # The CRB (CodeReady Builder) repository has to be enabled to get the libtirpc-devel package.
     && echo "# Installing 'dnf-plugins-core', enabling CRB (CodeReady Builder) repository and installing 'Development Tools'" >&2 \
@@ -208,16 +221,16 @@ RUN set -e \
 ######################################################################
 # Install our runtime and build time packages.
 #
-RUN set -e \
+# RUN set -e \
     && echo "$HR2" >&2 \
     && echo "# Installing NGAP package lists..." >&2 \
     && dnf install -y $dnf_runtime_packages $dnf_build_the_things_packages \
-    && dnf clean all \
-    && echo "$HR" >&2
+    # && dnf clean all \
+    && echo "$HR" >&2 \
 
 ######################################################################
 # The follow is a sanity check so that we can see what we got.
-RUN set -e \
+# RUN set -e \
     && echo "$HR" >&2  \
     && if test -n "$DEBUG_BUILD"; then \
     echo "# Sanity checking installed packages..." >&2 \
@@ -242,46 +255,14 @@ RUN set -e \
     && dnf -y info libuuid >&2 \
     && echo "# libuuid-devel info:" >&2 \
     && dnf -y info libuuid-devel >&2 \
-    && dnf clean all; \
+    # && dnf clean all; \
     else echo "# Skipping Sanity Checks." >&2 ; fi \
-    && echo "$HR" >&2
-
-
-################################################################
-# Install the libdap rpm
-#  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -
-RUN set -e \
     && echo "$HR" >&2 \
-    && echo "# Installing the libdap rpm: $LIBDAP_RPM" >&2 \
-    && ls -l ./libdap* \
-    && dnf -y install ./libdap-*.rpm \
-    && echo "# The 'dnf install' command exited with status: $?" >&2 \
-    && rm -f "./$LIBDAP_RPM" \
-    && dnf clean all \
-    && echo "# libdap4 is installed." >&2 \
-    && echo "$HR" >&2
-
-################################################################
-# Install the the BES
-# besd, besdaemon, beslistener, besctl, besstandalone, bescmdline
-#  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -
-RUN set -e \
-    && echo "$HR" >&2 \
-    && echo "# Installing the BES rpm: $BES_RPM" >&2 \
-    && ls -l ./bes* \
-    && dnf -y install ./bes-*.rpm \
-    && echo "# The 'dnf install' command exited with status: $?" >&2 \
-    && rm -f "./$BES_RPM" \
-    && dnf clean all \
-    && echo "# besdaemon is here: $(which besdaemon)" >&2 \
-    && echo "#      besdaemon -v: '$(besdaemon -v)'" >&2 \
-    && echo "$HR" >&2
-
 
 ################################################################
 # Install the Apache-Portable-Runtime (Apache APR)
 #  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -
-RUN set -e \
+# RUN set -e \
     && echo "$HR" >&2 \
     && echo "Installing the Apache APR rpm: $APACHE_APR_RPM" >&2 \
     && ls -l ./apr*  >&2\
@@ -292,6 +273,41 @@ RUN set -e \
     && dnf clean all \
     && echo "Apache APR is installed." >&2 \
     && echo "$HR" >&2
+
+################################################################
+# Set up BES
+#
+# BES is already installed on the base image, but
+# we need to do some additional configuration (to match what was
+# previously handled by bes RPM installation)
+
+# Add besd service to start at boot
+RUN cp ${PREFIX}/etc/rc.d/init.d/besd /etc/rc.d/init.d/besd \
+    && chkconfig --add besd \
+    && ldconfig \
+    && chkconfig --list | grep besd \
+    && echo "whoami: "`whoami` \
+    && echo "besdaemon is here: "`which besdaemon`
+
+# Adapted from bes/spec.all_static.in in RPM creation.
+# The four *.pem substitutions may be unnecessary, as those *.pem files may be
+# vestigial substitutions for a build process past.
+RUN sed -i.dist \
+    -e 's:=.*/bes.log:=/var/log/bes/bes.log:' \
+    -e 's:=.*/lib/bes:='"$PREFIX"'/lib/bes:' \
+    -e 's:=.*/share/bes:='"$PREFIX"'/share/bes:' \
+    -e 's:=.*/share/hyrax:='"$PREFIX"'/share/hyrax:' \
+    -e 's:=/full/path/to/serverside/certificate/file.pem:=/etc/pki/bes/cacerts/file.pem:' \
+    -e 's:=/full/path/to/serverside/key/file.pem:=/etc/pki/bes/public/file.pem:' \
+    -e 's:=/full/path/to/clientside/certificate/file.pem:=/etc/pki/bes/cacerts/file.pem:' \
+    -e 's:=/full/path/to/clientside/key/file.pem:=/etc/pki/bes/public/file.pem:' \
+    -e 's:=user_name:='"$BES_USER"':' \
+    -e 's:=group_name:='"$BES_USER"':' \
+    $PREFIX/etc/bes/bes.conf \
+    && mkdir -p "/var/log/bes/" \
+    && touch "/var/log/bes/bes.log" \
+    && sudo chown -R $BES_USER:$BES_USER "/var/log/bes/"
+
 ################################################################
 # Install and Setup Tomcat
 #
@@ -451,7 +467,7 @@ RUN set -e \
     && echo "Retrieving, and building hyrax regression tests." >&2 \
     && echo "h_r_t will be in: $TEST_INSTALL_DIR" >&2 \
     && mkdir -p "$TEST_INSTALL_DIR" \
-    && git clone -v "https://github.com/opendap/hyrax_regression_tests" "$TEST_INSTALL_DIR" \
+    && git clone --depth 1 -v "https://github.com/opendap/hyrax_regression_tests" "$TEST_INSTALL_DIR" \
     && cd "$TEST_INSTALL_DIR" \
     && git status >&2 \
     && autoreconf -vif >&2 \
@@ -478,10 +494,4 @@ EXPOSE 8443
 EXPOSE 10022
 EXPOSE 11002
 
-# can't use USER with entrypoint that needs root
-# use gosu or, as done, enable bes user write so the entrypoint does not need root
-RUN  set -e && chown -R bes /etc/bes
-USER root
-
 CMD ["-"]
-
diff --git a/el9-builds/ngap/entrypoint.sh b/el9-builds/ngap/entrypoint.sh
index 407f33e3..40e4c3d0 100755
--- a/el9-builds/ngap/entrypoint.sh
+++ b/el9-builds/ngap/entrypoint.sh
@@ -12,6 +12,13 @@ export LOG_KEY_PREFIX="${LOG_KEY_PREFIX:-"hyrax-"}"
 if [[ "$LOG_KEY_PREFIX" != *"-" ]]; then
     LOG_KEY_PREFIX="$LOG_KEY_PREFIX-"
 fi
+
+# Set in docker image.
+# BES_USER initially defined upstream in docker image base `bes_core` as $USER,
+# updated to $BES_USER in ngap/Dockerfile
+export PREFIX=${PREFIX:-"/root/install"}
+export BES_USER=${BES_USER:-"bes_user"}
+
 ##########################################################################
 #
 # Functions
@@ -208,10 +215,12 @@ export NGAP_CERTIFICATE_KEY_FILE="/usr/share/tomcat/conf/NGAP-CA-certificate.key
 startup_log "NGAP_CERTIFICATE_KEY_FILE: $NGAP_CERTIFICATE_KEY_FILE"
 
 ################################################################################
+# NETRC_FILE is at the top level /etc/bes instead of $PREFIX/etc/...
+# because that's where bamboo expects it to be
 export NETRC_FILE="/etc/bes/ngap_netrc"
 startup_log "NETRC_FILE: $NETRC_FILE"
 
-export BES_SITE_CONF_FILE="/etc/bes/site.conf"
+export BES_SITE_CONF_FILE="$PREFIX/etc/bes/site.conf"
 startup_log "BES_SITE_CONF_FILE: $BES_SITE_CONF_FILE"
 
 export BES_LOG_FILE="/var/log/bes/bes.log"
@@ -232,11 +241,12 @@ startup_log "FOLLOW_SYMLINKS: $FOLLOW_SYMLINKS"
 #
 if test -n "$HOST" && test -n "$USERNAME" && test -n "$PASSWORD"; then
   startup_log "Updating netrc file: $NETRC_FILE"
+  mkdir -p "$(dirname "${NETRC_FILE}")"
   # machine is a domain name or an ip address, not a URL.
   echo "machine $HOST" | sed -e "s_https:__g" -e "s_http:__g" -e "s+/++g" >> "$NETRC_FILE"
   echo "    login $USERNAME" >> "$NETRC_FILE"
   echo "    password $PASSWORD" >> "$NETRC_FILE"
-  chown bes:bes "$NETRC_FILE"
+  chown $BES_USER:$BES_USER "$NETRC_FILE"
   chmod 400 "$NETRC_FILE"
   startup_log "$(ls -l "$NETRC_FILE")"
   # startup_log "$( cat "$NETRC_FILE" )"
@@ -469,28 +479,29 @@ fi
 #
 if test "$SERVER_HELP_EMAIL" != "not_set"; then
   startup_log "Setting Admin Contact To: $SERVER_HELP_EMAIL"
-  sed -i "s/admin.email.address@your.domain.name/$SERVER_HELP_EMAIL/" /etc/bes/bes.conf
+  sed -i "s/admin.email.address@your.domain.name/$SERVER_HELP_EMAIL/" $PREFIX/etc/bes/bes.conf
 fi
 if test "$FOLLOW_SYMLINKS" != "not_set"; then
   startup_log "Setting BES FollowSymLinks to YES."
-  sed -i "s/^BES.Catalog.catalog.FollowSymLinks=No/BES.Catalog.catalog.FollowSymLinks=Yes/" /etc/bes/bes.conf
+  sed -i "s/^BES.Catalog.catalog.FollowSymLinks=No/BES.Catalog.catalog.FollowSymLinks=Yes/"  $PREFIX/etc/bes/bes.conf
 fi
 ################################################################################
 
 #-------------------------------------------------------------------------------
 # Start the BES daemon process
-# /usr/bin/besdaemon -i /usr -c /etc/bes/bes.conf -r /var/run/bes.pid
-bes_uid="$(id -u bes)"
-bes_gid="$(id -g bes)"
+# /usr/bin/besdaemon -i /usr -c $PREFIX/etc/bes/bes.conf -r /var/run/bes.pid
+bes_username=$BES_USER
+bes_uid=$(id -u ${bes_username})
+bes_gid=$(id -g ${bes_username})
 startup_log "Launching besd [uid: $bes_uid gid: $bes_gid]"
-/usr/bin/besctl start > ./besctl.log  2>&1 # dropped debug control -d "/dev/null,timing"  - ndp 10/12/2023
+$PREFIX/bin/besctl start > ./besctl.log  2>&1 # dropped debug control -d "/dev/null,timing"  - ndp 10/12/2023
 status=$?
 startup_log "$(cat ./besctl.log)"
 if test $status -ne 0; then
   error_log "ERROR: Failed to start BES: $status"
   #exit $status
 fi
-besd_pid="$(ps aux | grep /usr/bin/besdaemon | grep -v grep | awk '{print $2;}' -)"
+besd_pid="$(ps aux | grep $PREFIX/bin/besdaemon | grep -v grep | awk '{print $2;}' -)"
 startup_log "The besd is UP! [pid: $besd_pid]"
 
 #-------------------------------------------------------------------------------

From 9b2b015a55fa3dd4d7edf1636c59c26b0da770c5 Mon Sep 17 00:00:00 2001
From: Hannah Robertson <1076701+hannahilea@users.noreply.github.com>
Date: Wed, 4 Mar 2026 17:46:02 +0000
Subject: [PATCH 04/17] clean up

---
 el9-builds/hyrax/entrypoint.sh | 6 +++---
 el9-builds/ngap/Dockerfile     | 2 +-
 el9-builds/ngap/entrypoint.sh  | 6 +++---
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/el9-builds/hyrax/entrypoint.sh b/el9-builds/hyrax/entrypoint.sh
index 0ccb1093..f391d22b 100755
--- a/el9-builds/hyrax/entrypoint.sh
+++ b/el9-builds/hyrax/entrypoint.sh
@@ -170,10 +170,10 @@ loggy "PythonVersion (again): $( python3 --version 2>&1 )"
 #-------------------------------------------------------------------------------
 # We use 'echo' in the following because downstream code is expecting this
 # output to be a key value pair, so none of that loggy() stuff
-bes_username=$BES_USER
-bes_uid=$(id -u ${bes_username})
+bes_username="$BES_USER"
+bes_uid="$(id -u ${bes_username})"
 echo "bes_uid: $bes_uid"
-bes_gid=$(id -g ${bes_username})
+bes_gid="$(id -g ${bes_username})"
 echo "bes_gid: $bes_gid"
 
 #-------------------------------------------------------------------------------
diff --git a/el9-builds/ngap/Dockerfile b/el9-builds/ngap/Dockerfile
index bd9a48b5..3b6b1471 100644
--- a/el9-builds/ngap/Dockerfile
+++ b/el9-builds/ngap/Dockerfile
@@ -174,7 +174,7 @@ RUN set -e \
     && echo "# Installing cURL for developers (not minimal cURL)" >&2 \
     && dnf install -y curl curl-devel --allowerasing \
     && echo "# cURL version: $(curl --version)" >&2 \
-    && dnf clean all \
+    # && dnf clean all \
     && echo "$HR" >&2 \
 
 ######################################################################
diff --git a/el9-builds/ngap/entrypoint.sh b/el9-builds/ngap/entrypoint.sh
index 40e4c3d0..f936c9c6 100755
--- a/el9-builds/ngap/entrypoint.sh
+++ b/el9-builds/ngap/entrypoint.sh
@@ -490,9 +490,9 @@ fi
 #-------------------------------------------------------------------------------
 # Start the BES daemon process
 # /usr/bin/besdaemon -i /usr -c $PREFIX/etc/bes/bes.conf -r /var/run/bes.pid
-bes_username=$BES_USER
-bes_uid=$(id -u ${bes_username})
-bes_gid=$(id -g ${bes_username})
+bes_username="$BES_USER"
+bes_uid="$(id -u ${bes_username})"
+bes_gid="$(id -g ${bes_username})"
 startup_log "Launching besd [uid: $bes_uid gid: $bes_gid]"
 $PREFIX/bin/besctl start > ./besctl.log  2>&1 # dropped debug control -d "/dev/null,timing"  - ndp 10/12/2023
 status=$?

From a9c770195fee8209b0456fb4250a255849cadee3 Mon Sep 17 00:00:00 2001
From: Hannah Robertson <1076701+hannahilea@users.noreply.github.com>
Date: Wed, 4 Mar 2026 17:49:22 +0000
Subject: [PATCH 05/17] update helper functions

---
 el8-builds/build-el8 | 1 +
 el9-builds/build-el9 | 1 +
 2 files changed, 2 insertions(+)

diff --git a/el8-builds/build-el8 b/el8-builds/build-el8
index f3c50a66..42001cfc 100755
--- a/el8-builds/build-el8
+++ b/el8-builds/build-el8
@@ -693,6 +693,7 @@ function build_hyrax_docker() {
         --build-arg LIBDAP_VERSION \
         --build-arg BES_VERSION \
         --build-arg OLFS_VERSION \
+        --build-arg BES_CORE_IMAGE_TAG \
         --tag "${BUILD_VERSION_TAG}" \
         --tag "${SNAPSHOT_IMAGE_TAG}" \
         ${docker_name}
diff --git a/el9-builds/build-el9 b/el9-builds/build-el9
index 3615c89b..39fe98e0 100755
--- a/el9-builds/build-el9
+++ b/el9-builds/build-el9
@@ -864,6 +864,7 @@ function build_hyrax_docker() {
         --build-arg LIBDAP_VERSION \
         --build-arg BES_VERSION \
         --build-arg OLFS_VERSION \
+        --build-arg BES_CORE_IMAGE_TAG \
         --tag "${OS_BUILD_VERSION_TAG}" \
         --tag "${OS_SNAPSHOT_IMAGE_TAG}" \
         ${docker_name}

From cfad7854ac593c6d684344752daf19e470ba557d Mon Sep 17 00:00:00 2001
From: Hannah Robertson <1076701+hannahilea@users.noreply.github.com>
Date: Wed, 4 Mar 2026 17:56:45 +0000
Subject: [PATCH 06/17] update .travis.yml to run CI on branch

---
 .travis.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index a4b0cecc..9251660f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -20,6 +20,7 @@ branches:
     - master
     - main
     - /^(.*-test-deploy)$/
+    - hr/HYRAX-1964-use-dockerized-bes
 
 notifications:
   email:
@@ -68,9 +69,9 @@ install:
 
 stages:
   - name: BUILD_AND_TEST
-    if: branch = master OR branch = main OR branch =~ ^(.*-test-deploy)$
+    if: branch = master OR branch = main OR branch =~ ^(.*-test-deploy)$ OR branch "hr/HYRAX-1964-use-dockerized-bes"
   - name: BUILD
-    if: branch = master OR branch = main OR branch =~ ^(.*-test-deploy)$
+    if: branch = master OR branch = main OR branch =~ ^(.*-test-deploy)$ OR branch "hr/HYRAX-1964-use-dockerized-bes"
   - name: TEST_DEPLOYED_IMAGE
     if: ((branch = master or branch = main) and (type != pull_request)) or (branch =~ ^(.*-test-deploy)$)
   - name: disabled

From 28b497a09c833308a2fa3a2a8f171cd3e66923ab Mon Sep 17 00:00:00 2001
From: Hannah Robertson <1076701+hannahilea@users.noreply.github.com>
Date: Wed, 4 Mar 2026 18:00:33 +0000
Subject: [PATCH 07/17] i suppose equals signs are important

---
 .travis.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 9251660f..0118a67f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -69,9 +69,9 @@ install:
 
 stages:
   - name: BUILD_AND_TEST
-    if: branch = master OR branch = main OR branch =~ ^(.*-test-deploy)$ OR branch "hr/HYRAX-1964-use-dockerized-bes"
+    if: branch = master OR branch = main OR branch =~ ^(.*-test-deploy)$ OR branch = "hr/HYRAX-1964-use-dockerized-bes"
   - name: BUILD
-    if: branch = master OR branch = main OR branch =~ ^(.*-test-deploy)$ OR branch "hr/HYRAX-1964-use-dockerized-bes"
+    if: branch = master OR branch = main OR branch =~ ^(.*-test-deploy)$ OR branch = "hr/HYRAX-1964-use-dockerized-bes"
   - name: TEST_DEPLOYED_IMAGE
     if: ((branch = master or branch = main) and (type != pull_request)) or (branch =~ ^(.*-test-deploy)$)
   - name: disabled

From 7f5ed78fc5f80eefb0ab2874833a1f2ba2007ad7 Mon Sep 17 00:00:00 2001
From: The-Robot-Travis <npotter@opendap.org>
Date: Wed, 4 Mar 2026 23:29:33 +0000
Subject: [PATCH 08/17] OLFS: Triggering hyrax-docker image production for el8.
 Build Version Matrix: TARGET_OS: el8 libdap4-3.21.1-390
 2026-03-04T03:14:01+0000 bes-3.21.1-1096 2026-03-04T23:14:34+0000
 olfs-1.18.15-726 2026-03-04T23:29:26+0000 hyrax-1.17.1-726
 2026-03-04T23:29:26+0000

---
 el8-build-recipe    |  6 +++---
 travis-build-recipe | 10 +++++-----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/el8-build-recipe b/el8-build-recipe
index 953f60d9..83c09472 100644
--- a/el8-build-recipe
+++ b/el8-build-recipe
@@ -1,6 +1,6 @@
 TARGET_OS: el8
 TOMCAT_MAJOR_VERSION: 9
 libdap4-3.21.1-390 2026-03-04T03:14:01+0000
-bes-3.21.1-1093 2026-03-04T13:22:30+0000
-olfs-1.18.15-718 2026-03-04T13:35:59+0000
-hyrax-1.17.1-718 2026-03-04T13:35:59+0000
+bes-3.21.1-1096 2026-03-04T23:14:34+0000
+olfs-1.18.15-726 2026-03-04T23:29:26+0000
+hyrax-1.17.1-726 2026-03-04T23:29:26+0000
diff --git a/travis-build-recipe b/travis-build-recipe
index 6d2f3853..83c09472 100644
--- a/travis-build-recipe
+++ b/travis-build-recipe
@@ -1,6 +1,6 @@
-TARGET_OS: el9
-TOMCAT_MAJOR_VERSION: 11
+TARGET_OS: el8
+TOMCAT_MAJOR_VERSION: 9
 libdap4-3.21.1-390 2026-03-04T03:14:01+0000
-bes-3.21.1-1093 2026-03-04T13:22:30+0000
-olfs-1.18.15-719 2026-03-04T13:48:11+0000
-hyrax-1.17.1-719 2026-03-04T13:48:11+0000
+bes-3.21.1-1096 2026-03-04T23:14:34+0000
+olfs-1.18.15-726 2026-03-04T23:29:26+0000
+hyrax-1.17.1-726 2026-03-04T23:29:26+0000

From 38f050cb74078f7a664952ede11b18a1b980ae47 Mon Sep 17 00:00:00 2001
From: The-Robot-Travis <npotter@opendap.org>
Date: Thu, 5 Mar 2026 00:05:19 +0000
Subject: [PATCH 09/17] OLFS: Triggering hyrax-docker image production for el9.
 Build Version Matrix: TARGET_OS: el9 TOMCAT_MAJOR_VERSION: 11
 libdap4-3.21.1-390 2026-03-04T03:14:01+0000 bes-3.21.1-1096
 2026-03-04T23:14:34+0000 olfs-1.18.15-727 2026-03-05T00:05:12+0000
 hyrax-1.17.1-727 2026-03-05T00:05:12+0000

---
 el9-build-recipe    | 6 +++---
 travis-build-recipe | 8 ++++----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/el9-build-recipe b/el9-build-recipe
index 6d2f3853..618da181 100644
--- a/el9-build-recipe
+++ b/el9-build-recipe
@@ -1,6 +1,6 @@
 TARGET_OS: el9
 TOMCAT_MAJOR_VERSION: 11
 libdap4-3.21.1-390 2026-03-04T03:14:01+0000
-bes-3.21.1-1093 2026-03-04T13:22:30+0000
-olfs-1.18.15-719 2026-03-04T13:48:11+0000
-hyrax-1.17.1-719 2026-03-04T13:48:11+0000
+bes-3.21.1-1096 2026-03-04T23:14:34+0000
+olfs-1.18.15-727 2026-03-05T00:05:12+0000
+hyrax-1.17.1-727 2026-03-05T00:05:12+0000
diff --git a/travis-build-recipe b/travis-build-recipe
index 83c09472..618da181 100644
--- a/travis-build-recipe
+++ b/travis-build-recipe
@@ -1,6 +1,6 @@
-TARGET_OS: el8
-TOMCAT_MAJOR_VERSION: 9
+TARGET_OS: el9
+TOMCAT_MAJOR_VERSION: 11
 libdap4-3.21.1-390 2026-03-04T03:14:01+0000
 bes-3.21.1-1096 2026-03-04T23:14:34+0000
-olfs-1.18.15-726 2026-03-04T23:29:26+0000
-hyrax-1.17.1-726 2026-03-04T23:29:26+0000
+olfs-1.18.15-727 2026-03-05T00:05:12+0000
+hyrax-1.17.1-727 2026-03-05T00:05:12+0000

From a35a572f15258e5cee55e2d7e123e91451841a44 Mon Sep 17 00:00:00 2001
From: The-Robot-Travis <npotter@opendap.org>
Date: Thu, 5 Mar 2026 17:35:25 +0000
Subject: [PATCH 10/17] OLFS: Triggering hyrax-docker image production for el8.
 Build Version Matrix: TARGET_OS: el8 libdap4-3.21.1-390
 2026-03-04T03:14:01+0000 bes-3.21.1-1096 2026-03-04T23:14:34+0000
 olfs-1.18.15-730 2026-03-05T17:35:18+0000 hyrax-1.17.1-730
 2026-03-05T17:35:18+0000

---
 el8-build-recipe    | 4 ++--
 travis-build-recipe | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/el8-build-recipe b/el8-build-recipe
index 83c09472..c04ec46e 100644
--- a/el8-build-recipe
+++ b/el8-build-recipe
@@ -2,5 +2,5 @@ TARGET_OS: el8
 TOMCAT_MAJOR_VERSION: 9
 libdap4-3.21.1-390 2026-03-04T03:14:01+0000
 bes-3.21.1-1096 2026-03-04T23:14:34+0000
-olfs-1.18.15-726 2026-03-04T23:29:26+0000
-hyrax-1.17.1-726 2026-03-04T23:29:26+0000
+olfs-1.18.15-730 2026-03-05T17:35:18+0000
+hyrax-1.17.1-730 2026-03-05T17:35:18+0000
diff --git a/travis-build-recipe b/travis-build-recipe
index 618da181..c04ec46e 100644
--- a/travis-build-recipe
+++ b/travis-build-recipe
@@ -1,6 +1,6 @@
-TARGET_OS: el9
-TOMCAT_MAJOR_VERSION: 11
+TARGET_OS: el8
+TOMCAT_MAJOR_VERSION: 9
 libdap4-3.21.1-390 2026-03-04T03:14:01+0000
 bes-3.21.1-1096 2026-03-04T23:14:34+0000
-olfs-1.18.15-727 2026-03-05T00:05:12+0000
-hyrax-1.17.1-727 2026-03-05T00:05:12+0000
+olfs-1.18.15-730 2026-03-05T17:35:18+0000
+hyrax-1.17.1-730 2026-03-05T17:35:18+0000

From 974175695db66006262ebb41372ccf30a44a07b6 Mon Sep 17 00:00:00 2001
From: The-Robot-Travis <npotter@opendap.org>
Date: Thu, 5 Mar 2026 17:37:26 +0000
Subject: [PATCH 11/17] OLFS: Triggering hyrax-docker image production for el8.
 Build Version Matrix: TARGET_OS: el8 libdap4-3.21.1-390
 2026-03-04T03:14:01+0000 bes-3.21.1-1101 2026-03-05T17:25:18+0000
 olfs-1.18.15-731 2026-03-05T17:37:19+0000 hyrax-1.17.1-731
 2026-03-05T17:37:19+0000

---
 el8-build-recipe    | 6 +++---
 travis-build-recipe | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/el8-build-recipe b/el8-build-recipe
index c04ec46e..13d069aa 100644
--- a/el8-build-recipe
+++ b/el8-build-recipe
@@ -1,6 +1,6 @@
 TARGET_OS: el8
 TOMCAT_MAJOR_VERSION: 9
 libdap4-3.21.1-390 2026-03-04T03:14:01+0000
-bes-3.21.1-1096 2026-03-04T23:14:34+0000
-olfs-1.18.15-730 2026-03-05T17:35:18+0000
-hyrax-1.17.1-730 2026-03-05T17:35:18+0000
+bes-3.21.1-1101 2026-03-05T17:25:18+0000
+olfs-1.18.15-731 2026-03-05T17:37:19+0000
+hyrax-1.17.1-731 2026-03-05T17:37:19+0000
diff --git a/travis-build-recipe b/travis-build-recipe
index c04ec46e..13d069aa 100644
--- a/travis-build-recipe
+++ b/travis-build-recipe
@@ -1,6 +1,6 @@
 TARGET_OS: el8
 TOMCAT_MAJOR_VERSION: 9
 libdap4-3.21.1-390 2026-03-04T03:14:01+0000
-bes-3.21.1-1096 2026-03-04T23:14:34+0000
-olfs-1.18.15-730 2026-03-05T17:35:18+0000
-hyrax-1.17.1-730 2026-03-05T17:35:18+0000
+bes-3.21.1-1101 2026-03-05T17:25:18+0000
+olfs-1.18.15-731 2026-03-05T17:37:19+0000
+hyrax-1.17.1-731 2026-03-05T17:37:19+0000

From ef38fb9d68cdac218272333720a35016ed34b25f Mon Sep 17 00:00:00 2001
From: The-Robot-Travis <npotter@opendap.org>
Date: Thu, 5 Mar 2026 18:13:49 +0000
Subject: [PATCH 12/17] OLFS: Triggering hyrax-docker image production for el9.
 Build Version Matrix: TARGET_OS: el9 TOMCAT_MAJOR_VERSION: 11
 libdap4-3.21.1-390 2026-03-04T03:14:01+0000 bes-3.21.1-1101
 2026-03-05T17:25:18+0000 olfs-1.18.15-732 2026-03-05T18:13:42+0000
 hyrax-1.17.1-732 2026-03-05T18:13:42+0000

---
 el9-build-recipe    | 6 +++---
 travis-build-recipe | 8 ++++----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/el9-build-recipe b/el9-build-recipe
index 618da181..f3351da5 100644
--- a/el9-build-recipe
+++ b/el9-build-recipe
@@ -1,6 +1,6 @@
 TARGET_OS: el9
 TOMCAT_MAJOR_VERSION: 11
 libdap4-3.21.1-390 2026-03-04T03:14:01+0000
-bes-3.21.1-1096 2026-03-04T23:14:34+0000
-olfs-1.18.15-727 2026-03-05T00:05:12+0000
-hyrax-1.17.1-727 2026-03-05T00:05:12+0000
+bes-3.21.1-1101 2026-03-05T17:25:18+0000
+olfs-1.18.15-732 2026-03-05T18:13:42+0000
+hyrax-1.17.1-732 2026-03-05T18:13:42+0000
diff --git a/travis-build-recipe b/travis-build-recipe
index 13d069aa..f3351da5 100644
--- a/travis-build-recipe
+++ b/travis-build-recipe
@@ -1,6 +1,6 @@
-TARGET_OS: el8
-TOMCAT_MAJOR_VERSION: 9
+TARGET_OS: el9
+TOMCAT_MAJOR_VERSION: 11
 libdap4-3.21.1-390 2026-03-04T03:14:01+0000
 bes-3.21.1-1101 2026-03-05T17:25:18+0000
-olfs-1.18.15-731 2026-03-05T17:37:19+0000
-hyrax-1.17.1-731 2026-03-05T17:37:19+0000
+olfs-1.18.15-732 2026-03-05T18:13:42+0000
+hyrax-1.17.1-732 2026-03-05T18:13:42+0000

From b18beec893b0d2ba65d2ba4e5322ad24bc732600 Mon Sep 17 00:00:00 2001
From: Hannah Robertson <1076701+hannahilea@users.noreply.github.com>
Date: Thu, 5 Mar 2026 20:03:08 +0000
Subject: [PATCH 13/17] install chkconfig for el9

---
 el8-builds/hyrax/Dockerfile           | 2 +-
 el8-builds/ngap/Dockerfile            | 2 +-
 el9-builds/besd/Dockerfile            | 2 +-
 el9-builds/hyrax/Dockerfile           | 4 ++--
 el9-builds/ngap/Dockerfile            | 4 ++--
 el9-builds/olfs/Dockerfile            | 2 +-
 utils/rocky9-hyrax-builder/Dockerfile | 2 +-
 7 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/el8-builds/hyrax/Dockerfile b/el8-builds/hyrax/Dockerfile
index 8b176b91..48982218 100644
--- a/el8-builds/hyrax/Dockerfile
+++ b/el8-builds/hyrax/Dockerfile
@@ -25,7 +25,7 @@ RUN if test -n "$BES_CORE_IMAGE_TAG"; then \
     fi
 
 # User defined and created in the `bes_core` image
-ENV BES_USER ${USER:-"bes_user"}
+ENV BES_USER="${USER:-bes_user}"
 
 ENV ARCH="x86_64"
 ENV java_version="java-17-openjdk"
diff --git a/el8-builds/ngap/Dockerfile b/el8-builds/ngap/Dockerfile
index d3aa32e2..3d4841a8 100644
--- a/el8-builds/ngap/Dockerfile
+++ b/el8-builds/ngap/Dockerfile
@@ -23,7 +23,7 @@ RUN if [ -z "$BES_CORE_IMAGE_TAG" ]; then \
     fi
 
 # User defined and created in the `bes_core` image
-ENV BES_USER ${USER:-"bes_user"}
+ENV BES_USER="${USER:-bes_user}"
 
 ENV ARCH="x86_64"
 ENV java_version="java-17-openjdk"
diff --git a/el9-builds/besd/Dockerfile b/el9-builds/besd/Dockerfile
index 4250762f..f8c87ae6 100644
--- a/el9-builds/besd/Dockerfile
+++ b/el9-builds/besd/Dockerfile
@@ -24,7 +24,7 @@ RUN if [ -z "$BES_CORE_IMAGE_TAG" ]; then \
     fi
 
 # User defined and created in the `bes_core` image
-ENV BES_USER ${USER:-"bes_user"}
+ENV BES_USER="${USER:-bes_user}"
 
 ENV HR="###############################################################################################################"
 ENV HR2="-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --"
diff --git a/el9-builds/hyrax/Dockerfile b/el9-builds/hyrax/Dockerfile
index 184ddfa1..bb179a40 100644
--- a/el9-builds/hyrax/Dockerfile
+++ b/el9-builds/hyrax/Dockerfile
@@ -25,7 +25,7 @@ RUN if test -n "$BES_CORE_IMAGE_TAG"; then \
     fi
 
 # User defined and created in the `bes_core` image
-ENV BES_USER ${USER:-"bes_user"}
+ENV BES_USER="${USER:-bes_user}"
 
 ENV HR="###############################################################################################################"
 ENV HR2="-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --"
@@ -164,7 +164,7 @@ RUN set -e \
 # RUN set -e \
     && echo "$HR" >&2 \
     && echo "# Installing cURL for developers (not minimal cURL)" >&2 \
-    && dnf install -y curl curl-devel --allowerasing \
+    && dnf install -y curl curl-devel --allowerasing chkconfig \
     && echo "# cURL version: $(curl --version)" >&2 \
     # && dnf clean all \
     && echo "$HR" >&2 \
diff --git a/el9-builds/ngap/Dockerfile b/el9-builds/ngap/Dockerfile
index 3b6b1471..8b27ed0a 100644
--- a/el9-builds/ngap/Dockerfile
+++ b/el9-builds/ngap/Dockerfile
@@ -23,7 +23,7 @@ RUN if [ -z "$BES_CORE_IMAGE_TAG" ]; then \
     fi
 
 # User defined and created in the `bes_core` image
-ENV BES_USER ${USER:-"bes_user"}
+ENV BES_USER="${USER:-bes_user}"
 
 LABEL org.opencontainers.image.authors="support@opendap.org"
 USER root
@@ -172,7 +172,7 @@ RUN set -e \
 # RUN set -e \
     && echo "$HR" >&2 \
     && echo "# Installing cURL for developers (not minimal cURL)" >&2 \
-    && dnf install -y curl curl-devel --allowerasing \
+    && dnf install -y curl curl-devel --allowerasing chkconfig \
     && echo "# cURL version: $(curl --version)" >&2 \
     # && dnf clean all \
     && echo "$HR" >&2 \
diff --git a/el9-builds/olfs/Dockerfile b/el9-builds/olfs/Dockerfile
index d06f19ae..55cf2466 100644
--- a/el9-builds/olfs/Dockerfile
+++ b/el9-builds/olfs/Dockerfile
@@ -92,7 +92,7 @@ RUN set -e \
 RUN set -e \
     && echo "$HR" \
     && echo "# Installing cURL" \
-    && yum install -y curl curl-devel --allowerasing \
+    && yum install -y curl curl-devel --allowerasing chkconfig \
     && echo "# cURL version: $(curl --version)" \
     && dnf clean all
 
diff --git a/utils/rocky9-hyrax-builder/Dockerfile b/utils/rocky9-hyrax-builder/Dockerfile
index f965f2af..735ace6e 100644
--- a/utils/rocky9-hyrax-builder/Dockerfile
+++ b/utils/rocky9-hyrax-builder/Dockerfile
@@ -60,7 +60,7 @@ RUN set -e \
 # RUN set -e \
     && echo "$HR" \
     && echo "# Installing cURL" \
-    && yum install -y curl curl-devel --allowerasing \
+    && yum install -y curl curl-devel --allowerasing chkconfig \
     && echo "# cURL version: $(curl --version)" \
 #    && yum clean all
 #

From 16b21760a0be3290224ca7553893585a5fe7c467 Mon Sep 17 00:00:00 2001
From: Hannah Robertson <1076701+hannahilea@users.noreply.github.com>
Date: Thu, 5 Mar 2026 20:30:17 +0000
Subject: [PATCH 14/17] fix spelling bork

---
 el8-builds/besd/Dockerfile     | 2 +-
 el9-builds/hyrax/entrypoint.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/el8-builds/besd/Dockerfile b/el8-builds/besd/Dockerfile
index 836c732b..5a002775 100644
--- a/el8-builds/besd/Dockerfile
+++ b/el8-builds/besd/Dockerfile
@@ -23,7 +23,7 @@ RUN if [ -z "$BES_CORE_IMAGE_TAG" ]; then \
     fi
 
 # User defined and created in the `bes_core` image
-ENV BES_USER ${USER:-"bes_user"}
+ENV BES_USER="${USER:-bes_user}"
 
 ARG RELEASE_DATE
 ENV RELEASE_DATE ${RELEASE_DATE:-"unknown"}
diff --git a/el9-builds/hyrax/entrypoint.sh b/el9-builds/hyrax/entrypoint.sh
index f391d22b..7b85dfb4 100755
--- a/el9-builds/hyrax/entrypoint.sh
+++ b/el9-builds/hyrax/entrypoint.sh
@@ -180,7 +180,7 @@ echo "bes_gid: $bes_gid"
 # Start the BES daemon process
 # /usr/bin/besdaemon -i /usr -c $PREFIX/etc/bes/bes.conf -r /var/run/bes.pid (old way)
 loggy "Launching besd..."
-$PREFIX/bin/besctl starttart
+$PREFIX/bin/besctl start
 status=$?
 if test $status -ne 0 ; then
     loggy "ERROR: Failed to start BES: $status"

From 0b40ca4530dd63bd8792a08689ef756f6ddc0b9a Mon Sep 17 00:00:00 2001
From: Hannah Robertson <1076701+hannahilea@users.noreply.github.com>
Date: Thu, 5 Mar 2026 20:54:57 +0000
Subject: [PATCH 15/17] rearrange

---
 el9-builds/ngap/Dockerfile    | 33 ++++++++++++++++-----------------
 el9-builds/ngap/entrypoint.sh |  4 ++--
 el9-builds/olfs/Dockerfile    |  2 +-
 3 files changed, 19 insertions(+), 20 deletions(-)

diff --git a/el9-builds/ngap/Dockerfile b/el9-builds/ngap/Dockerfile
index 8b27ed0a..b1736893 100644
--- a/el9-builds/ngap/Dockerfile
+++ b/el9-builds/ngap/Dockerfile
@@ -162,7 +162,6 @@ RUN set -e \
     && echo "dnf install -y $dnf_developer_tools_packages" > /install-dev-tools \
     && chmod 755 /install-dev-tools \
 
-
 ######################################################################
 # Rocky9 comes with built in curl-minimal. For our puposes we want
 # want the full package (I think, probably need to verify).
@@ -255,23 +254,8 @@ RUN set -e \
     && dnf -y info libuuid >&2 \
     && echo "# libuuid-devel info:" >&2 \
     && dnf -y info libuuid-devel >&2 \
-    # && dnf clean all; \
+    && dnf clean all; \
     else echo "# Skipping Sanity Checks." >&2 ; fi \
-    && echo "$HR" >&2 \
-
-################################################################
-# Install the Apache-Portable-Runtime (Apache APR)
-#  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -
-# RUN set -e \
-    && echo "$HR" >&2 \
-    && echo "Installing the Apache APR rpm: $APACHE_APR_RPM" >&2 \
-    && ls -l ./apr*  >&2\
-    && dnf -y install ./apr-*.rpm  >&2\
-    && echo "# The 'dnf install' command exited with status: $?" >&2 \
-    && dnf list installed | grep apr >&2 \
-    && rm -f "./$APACHE_APR_RPM" \
-    && dnf clean all \
-    && echo "Apache APR is installed." >&2 \
     && echo "$HR" >&2
 
 ################################################################
@@ -308,6 +292,21 @@ RUN sed -i.dist \
     && touch "/var/log/bes/bes.log" \
     && sudo chown -R $BES_USER:$BES_USER "/var/log/bes/"
 
+################################################################
+# Install the Apache-Portable-Runtime (Apache APR)
+#  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -
+RUN set -e \
+    && echo "$HR" >&2 \
+    && echo "Installing the Apache APR rpm: $APACHE_APR_RPM" >&2 \
+    && ls -l ./apr*  >&2\
+    && dnf -y install ./apr-*.rpm  >&2\
+    && echo "# The 'dnf install' command exited with status: $?" >&2 \
+    && dnf list installed | grep apr >&2 \
+    && rm -f "./$APACHE_APR_RPM" \
+    && dnf clean all \
+    && echo "Apache APR is installed." >&2 \
+    && echo "$HR" >&2
+
 ################################################################
 # Install and Setup Tomcat
 #
diff --git a/el9-builds/ngap/entrypoint.sh b/el9-builds/ngap/entrypoint.sh
index f936c9c6..557e4c8d 100755
--- a/el9-builds/ngap/entrypoint.sh
+++ b/el9-builds/ngap/entrypoint.sh
@@ -16,8 +16,8 @@ fi
 # Set in docker image.
 # BES_USER initially defined upstream in docker image base `bes_core` as $USER,
 # updated to $BES_USER in ngap/Dockerfile
-export PREFIX=${PREFIX:-"/root/install"}
-export BES_USER=${BES_USER:-"bes_user"}
+export PREFIX="${PREFIX:-/root/install}"
+export BES_USER="${BES_USER:-bes_user}"
 
 ##########################################################################
 #
diff --git a/el9-builds/olfs/Dockerfile b/el9-builds/olfs/Dockerfile
index 55cf2466..d06f19ae 100644
--- a/el9-builds/olfs/Dockerfile
+++ b/el9-builds/olfs/Dockerfile
@@ -92,7 +92,7 @@ RUN set -e \
 RUN set -e \
     && echo "$HR" \
     && echo "# Installing cURL" \
-    && yum install -y curl curl-devel --allowerasing chkconfig \
+    && yum install -y curl curl-devel --allowerasing \
     && echo "# cURL version: $(curl --version)" \
     && dnf clean all
 

From e80f3e29cf01b0673181af3596bbaadc4376fca7 Mon Sep 17 00:00:00 2001
From: Hannah Robertson <1076701+hannahilea@users.noreply.github.com>
Date: Thu, 5 Mar 2026 21:45:02 +0000
Subject: [PATCH 16/17] update chkconfig install

---
 el9-builds/besd/Dockerfile            | 2 +-
 el9-builds/hyrax/Dockerfile           | 4 ++--
 el9-builds/ngap/Dockerfile            | 4 ++--
 utils/rocky9-hyrax-builder/Dockerfile | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/el9-builds/besd/Dockerfile b/el9-builds/besd/Dockerfile
index f8c87ae6..77e91684 100644
--- a/el9-builds/besd/Dockerfile
+++ b/el9-builds/besd/Dockerfile
@@ -36,7 +36,7 @@ RUN echo "# BEGIN - besd docker build"
 # rocky9 comes with python 3.9 by default, and replacing it seems problematic at best.
 RUN echo "# Python Version: $(python3 --version)"
 
-ENV dnf_runtime_packages="which unzip procps bc"
+ENV dnf_runtime_packages="which unzip procps bc chkconfig"
 RUN echo "# dnf_runtime_packages: $dnf_runtime_packages"
 
 ENV dnf_developer_tools_packages="emacs vim awscli jq gdb valgrind"
diff --git a/el9-builds/hyrax/Dockerfile b/el9-builds/hyrax/Dockerfile
index bb179a40..2efb3a87 100644
--- a/el9-builds/hyrax/Dockerfile
+++ b/el9-builds/hyrax/Dockerfile
@@ -44,7 +44,7 @@ RUN echo "# Python Version: $(python3 --version)"
 # procps - so we can use 'ps' to track the bes and tomcat processes.
 #     bc - is used by the cleanup_files.sh script to compute time stuff for
 #          orphaned files.
-ENV dnf_runtime_packages="which unzip procps bc"
+ENV dnf_runtime_packages="which unzip procps bc chkconfig"
 RUN echo "# dnf_runtime_packages: $dnf_runtime_packages"
 
 # Stuff we need to build the hyrax_regression_tests
@@ -164,7 +164,7 @@ RUN set -e \
 # RUN set -e \
     && echo "$HR" >&2 \
     && echo "# Installing cURL for developers (not minimal cURL)" >&2 \
-    && dnf install -y curl curl-devel --allowerasing chkconfig \
+    && dnf install -y curl curl-devel --allowerasing \
     && echo "# cURL version: $(curl --version)" >&2 \
     # && dnf clean all \
     && echo "$HR" >&2 \
diff --git a/el9-builds/ngap/Dockerfile b/el9-builds/ngap/Dockerfile
index b1736893..b68868e3 100644
--- a/el9-builds/ngap/Dockerfile
+++ b/el9-builds/ngap/Dockerfile
@@ -40,7 +40,7 @@ ENV java_version="java-21-openjdk"
 # 'awscli' is used by entrypoint.sh
 # 'ps' (aka procps) is used by besctl and entrypoint.sh
 # 'bc' is used entrypoint.sh and cleanup_files.sh
-ENV dnf_runtime_packages="which unzip jq procps bc"
+ENV dnf_runtime_packages="which unzip jq procps bc chkconfig"
 RUN echo "# dnf_runtime_packages: $dnf_runtime_packages"
 
 
@@ -171,7 +171,7 @@ RUN set -e \
 # RUN set -e \
     && echo "$HR" >&2 \
     && echo "# Installing cURL for developers (not minimal cURL)" >&2 \
-    && dnf install -y curl curl-devel --allowerasing chkconfig \
+    && dnf install -y curl curl-devel --allowerasing \
     && echo "# cURL version: $(curl --version)" >&2 \
     # && dnf clean all \
     && echo "$HR" >&2 \
diff --git a/utils/rocky9-hyrax-builder/Dockerfile b/utils/rocky9-hyrax-builder/Dockerfile
index 735ace6e..f965f2af 100644
--- a/utils/rocky9-hyrax-builder/Dockerfile
+++ b/utils/rocky9-hyrax-builder/Dockerfile
@@ -60,7 +60,7 @@ RUN set -e \
 # RUN set -e \
     && echo "$HR" \
     && echo "# Installing cURL" \
-    && yum install -y curl curl-devel --allowerasing chkconfig \
+    && yum install -y curl curl-devel --allowerasing \
     && echo "# cURL version: $(curl --version)" \
 #    && yum clean all
 #

From 4a380cc890ca22f3ce447e722a58beb901b1f81a Mon Sep 17 00:00:00 2001
From: Hannah Robertson <1076701+hannahilea@users.noreply.github.com>
Date: Fri, 6 Mar 2026 15:02:06 +0000
Subject: [PATCH 17/17] tweaks from code review

---
 el8-builds/besd/Dockerfile  |  8 ++++----
 el8-builds/hyrax/Dockerfile |  6 +++---
 el8-builds/ngap/Dockerfile  |  6 +++---
 el9-builds/besd/Dockerfile  | 10 +++++-----
 el9-builds/hyrax/Dockerfile |  8 ++++----
 el9-builds/ngap/Dockerfile  |  8 ++++----
 6 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/el8-builds/besd/Dockerfile b/el8-builds/besd/Dockerfile
index 5a002775..59e5e73b 100644
--- a/el8-builds/besd/Dockerfile
+++ b/el8-builds/besd/Dockerfile
@@ -23,7 +23,7 @@ RUN if [ -z "$BES_CORE_IMAGE_TAG" ]; then \
     fi
 
 # User defined and created in the `bes_core` image
-ENV BES_USER="${USER:-bes_user}"
+ENV BES_USER="${USER:-"bes_user"}"
 
 ARG RELEASE_DATE
 ENV RELEASE_DATE ${RELEASE_DATE:-"unknown"}
@@ -81,8 +81,8 @@ RUN cp ${PREFIX}/etc/rc.d/init.d/besd /etc/rc.d/init.d/besd \
     && chkconfig --add besd \
     && ldconfig \
     && chkconfig --list | grep besd \
-    && echo "whoami: "`whoami` \
-    && echo "besdaemon is here: "`which besdaemon`
+    && echo "whoami: $(whoami)" \
+    && echo "besdaemon is here: $(which besdaemon)"
 
 # Adapted from bes/spec.all_static.in in RPM creation.
 # The four *.pem substitutions may be unnecessary, as those *.pem files may be
@@ -103,7 +103,7 @@ RUN sed -i.dist \
     && touch "/var/log/bes/bes.log" \
     && sudo chown -R $BES_USER:$BES_USER "/var/log/bes/"
 
-RUN echo "besdaemon is here: "`which besdaemon`
+RUN echo "besdaemon is here: $(which besdaemon)"
 
 COPY entrypoint.sh /entrypoint.sh
 RUN  chmod +x /entrypoint.sh
diff --git a/el8-builds/hyrax/Dockerfile b/el8-builds/hyrax/Dockerfile
index 48982218..be648d7c 100644
--- a/el8-builds/hyrax/Dockerfile
+++ b/el8-builds/hyrax/Dockerfile
@@ -25,7 +25,7 @@ RUN if test -n "$BES_CORE_IMAGE_TAG"; then \
     fi
 
 # User defined and created in the `bes_core` image
-ENV BES_USER="${USER:-bes_user}"
+ENV BES_USER="${USER:-"bes_user"}"
 
 ENV ARCH="x86_64"
 ENV java_version="java-17-openjdk"
@@ -186,8 +186,8 @@ RUN cp ${PREFIX}/etc/rc.d/init.d/besd /etc/rc.d/init.d/besd \
     && chkconfig --add besd \
     && ldconfig \
     && chkconfig --list | grep besd \
-    && echo "whoami: "`whoami` \
-    && echo "besdaemon is here: "`which besdaemon`
+    && echo "whoami: $(whoami)" \
+    && echo "besdaemon is here: $(which besdaemon)"
 
 # Adapted from bes/spec.all_static.in in RPM creation.
 # The four *.pem substitutions may be unnecessary, as those *.pem files may be
diff --git a/el8-builds/ngap/Dockerfile b/el8-builds/ngap/Dockerfile
index 3d4841a8..81653891 100644
--- a/el8-builds/ngap/Dockerfile
+++ b/el8-builds/ngap/Dockerfile
@@ -23,7 +23,7 @@ RUN if [ -z "$BES_CORE_IMAGE_TAG" ]; then \
     fi
 
 # User defined and created in the `bes_core` image
-ENV BES_USER="${USER:-bes_user}"
+ENV BES_USER="${USER:-"bes_user"}"
 
 ENV ARCH="x86_64"
 ENV java_version="java-17-openjdk"
@@ -167,8 +167,8 @@ RUN cp ${PREFIX}/etc/rc.d/init.d/besd /etc/rc.d/init.d/besd \
     && chkconfig --add besd \
     && ldconfig \
     && chkconfig --list | grep besd \
-    && echo "whoami: "`whoami` \
-    && echo "besdaemon is here: "`which besdaemon`
+    && echo "whoami: $(whoami)" \
+    && echo "besdaemon is here: $(which besdaemon)"
 
 # Adapted from bes/spec.all_static.in in RPM creation.
 # The four *.pem substitutions may be unnecessary, as those *.pem files may be
diff --git a/el9-builds/besd/Dockerfile b/el9-builds/besd/Dockerfile
index 77e91684..b8ca58e2 100644
--- a/el9-builds/besd/Dockerfile
+++ b/el9-builds/besd/Dockerfile
@@ -15,7 +15,7 @@
 # Set one or more individual labels
 #
 ARG BES_CORE_IMAGE_TAG
-FROM ${BES_CORE_IMAGE_TAG:-"rockylinux:8"}
+FROM ${BES_CORE_IMAGE_TAG:-"rockylinux:9"}
 
 ARG BES_CORE_IMAGE_TAG
 RUN if [ -z "$BES_CORE_IMAGE_TAG" ]; then \
@@ -24,7 +24,7 @@ RUN if [ -z "$BES_CORE_IMAGE_TAG" ]; then \
     fi
 
 # User defined and created in the `bes_core` image
-ENV BES_USER="${USER:-bes_user}"
+ENV BES_USER="${USER:-"bes_user"}"
 
 ENV HR="###############################################################################################################"
 ENV HR2="-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --"
@@ -101,8 +101,8 @@ RUN cp ${PREFIX}/etc/rc.d/init.d/besd /etc/rc.d/init.d/besd \
     && chkconfig --add besd \
     && ldconfig \
     && chkconfig --list | grep besd \
-    && echo "whoami: "`whoami` \
-    && echo "besdaemon is here: "`which besdaemon`
+    && echo "whoami: $(whoami)" \
+    && echo "besdaemon is here: $(which besdaemon)"
 
 # Adapted from bes/spec.all_static.in in RPM creation.
 # The four *.pem substitutions may be unnecessary, as those *.pem files may be
@@ -123,7 +123,7 @@ RUN sed -i.dist \
     && touch "/var/log/bes/bes.log" \
     && sudo chown -R $BES_USER:$BES_USER "/var/log/bes/"
 
-RUN echo "besdaemon is here: "`which besdaemon`
+RUN echo "besdaemon is here: $(which besdaemon)"
 
 COPY entrypoint.sh /entrypoint.sh
 RUN  chmod +x /entrypoint.sh
diff --git a/el9-builds/hyrax/Dockerfile b/el9-builds/hyrax/Dockerfile
index 2efb3a87..63027cdb 100644
--- a/el9-builds/hyrax/Dockerfile
+++ b/el9-builds/hyrax/Dockerfile
@@ -14,7 +14,7 @@
 #
 # Set one or more individual labels
 ARG BES_CORE_IMAGE_TAG
-FROM ${BES_CORE_IMAGE_TAG:-rockylinux:8}
+FROM ${BES_CORE_IMAGE_TAG:-rockylinux:9}
 
 ARG BES_CORE_IMAGE_TAG
 RUN if test -n "$BES_CORE_IMAGE_TAG"; then \
@@ -25,7 +25,7 @@ RUN if test -n "$BES_CORE_IMAGE_TAG"; then \
     fi
 
 # User defined and created in the `bes_core` image
-ENV BES_USER="${USER:-bes_user}"
+ENV BES_USER="${USER:-"bes_user"}"
 
 ENV HR="###############################################################################################################"
 ENV HR2="-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --"
@@ -212,8 +212,8 @@ RUN cp ${PREFIX}/etc/rc.d/init.d/besd /etc/rc.d/init.d/besd \
     && chkconfig --add besd \
     && ldconfig \
     && chkconfig --list | grep besd \
-    && echo "whoami: "`whoami` \
-    && echo "besdaemon is here: "`which besdaemon`
+    && echo "whoami: $(whoami)" \
+    && echo "besdaemon is here: $(which besdaemon)"
 
 # Adapted from bes/spec.all_static.in in RPM creation.
 # The four *.pem substitutions may be unnecessary, as those *.pem files may be
diff --git a/el9-builds/ngap/Dockerfile b/el9-builds/ngap/Dockerfile
index b68868e3..9beb0f36 100644
--- a/el9-builds/ngap/Dockerfile
+++ b/el9-builds/ngap/Dockerfile
@@ -14,7 +14,7 @@
 #
 # Set one or more individual labels
 ARG BES_CORE_IMAGE_TAG
-FROM ${BES_CORE_IMAGE_TAG:-"rockylinux:8"}
+FROM ${BES_CORE_IMAGE_TAG:-"rockylinux:9"}
 
 ARG BES_CORE_IMAGE_TAG
 RUN if [ -z "$BES_CORE_IMAGE_TAG" ]; then \
@@ -23,7 +23,7 @@ RUN if [ -z "$BES_CORE_IMAGE_TAG" ]; then \
     fi
 
 # User defined and created in the `bes_core` image
-ENV BES_USER="${USER:-bes_user}"
+ENV BES_USER="${USER:-"bes_user"}"
 
 LABEL org.opencontainers.image.authors="support@opendap.org"
 USER root
@@ -270,8 +270,8 @@ RUN cp ${PREFIX}/etc/rc.d/init.d/besd /etc/rc.d/init.d/besd \
     && chkconfig --add besd \
     && ldconfig \
     && chkconfig --list | grep besd \
-    && echo "whoami: "`whoami` \
-    && echo "besdaemon is here: "`which besdaemon`
+    && echo "whoami: $(whoami)" \
+    && echo "besdaemon is here: $(which besdaemon)"
 
 # Adapted from bes/spec.all_static.in in RPM creation.
 # The four *.pem substitutions may be unnecessary, as those *.pem files may be