6.2.7.16-RC seems to install unwanted extensions

dev support
1

I’m trying to make Lucee only install allow-listed extensions e.g. remove from the default set of “bundled extensions”, and have read Extension Installation :: Lucee Documentation

I’ve set LUCEE_EXTENSIONS to this list, on the grounds that it defines what extensions to install., but at startup Lucee still installs unwanted extensions, like 99A4EF8D-F2FD-40C8-8FB8C2E67A4EEEB6;name=MSSQL

I can only find a 2 year old thread ( Extend env var LUCEE_EXTENSIONS to support removal, or prevent install - #3 by Gavin_Baumanis ) about this where people agreed it’d be a good idea.

Did this get implemented but not documented in the page I’ve been reading ?
Or is it not possible e.g. Lucee always deploys all the default bundled extensions still?

Do I need to be editing .CFConfig.json to remove things ? Removing extensions with the UUID doesn’t appear to prevent subsequent install (eg jq 'del(.extensions[]|select(.id =="99A4EF8D-F2FD-40C8-8FB8C2E67A4EEEB6"))' /opt/lucee/server/lucee-server/context/.CFConfig.json)

This is my startup log, which lists both the default list, the allow list from the env var, and the subsequent install.

"INFO","main","05/18/2026","09:14:15","controller","No new extension available to add to local extension directory"
"INFO","main","05/18/2026","09:14:15","controller","Found Extensions to install (new;new-fresh):7E673D15-D87C-41A6-8
B5F1956528C605F;name=MySQL;label=MySQL;version=9.3.0, 99A4EF8D-F2FD-40C8-8FB8C2E67A4EEEB6;name=MSSQL;label=MS SQL Se
rver;version=12.6.3.jre11, 671B01B8-B3B3-42B9-AC055A356BED5281;name=PostgreSQL;label=PostgreSQL;version=42.7.7, 2BCD
080F-4E1E-48F5-BEFE794232A21AF6;name=JDTsSQL;label=jTDS (MSSQL);version=1.3.1, CED6227E-0F49-6367-A68D21AACA6B07E8;n
ame=Admin;label=Lucee Administrator;version=1.0.0.5, D46D49C3-EB85-8D97-30BEC2F38561E985;name=Doc;label=Lucee Docume
ntation;version=1.0.0.4, 17AB52DE-B300-A94B-E058BD978511E39E;name=S3;label=S3;version=2.0.2.21, 87FE44E5-179C-43A3-A
87B3D38BEF4652E;name=EHCache;label=EHCache;version=2.10.0.36, 66E312DD-D083-27C0-64189D16753FD6F0;name=PDF;label=PDF
;version=1.2.0.12-RC, B737ABC4-D43F-4D91-8E8E973E37C40D1B;name=Image;label=Image;version=2.0.0.33-RC;since=5.3.0.35-
ALPHA, 37C61C0A-5D7E-4256-8572639BE0CF5838;name=Esapi;label=ESAPI;version=2.6.0.1;since=5.3.0.37-ALPHA, 8D7FB0DF-08B
B-1589-FE3975678F07DB17;name=Compress;label=Compress;version=1.0.0.16;since=5.3.2.31-SNAPSHOT"
"INFO","main","05/18/2026","09:14:15","controller","Extensions to install defined in env variable or system property
:8D7FB0DF-08BB-1589-FE3975678F07DB17,37C61C0A-5D7E-4256-8572639BE0CF5838,B737ABC4-D43F-4D91-8E8E973E37C40D1B,66E312D
D-D083-27C0-64189D16753FD6F0,87FE44E5-179C-43A3-A87B3D38BEF4652E,17AB52DE-B300-A94B-E058BD978511E39E,7E673D15-D87C-4
1A6-8B5F1956528C605F"
"INFO","main","05/18/2026","09:14:15","extension","installing the extension 99A4EF8D-F2FD-40C8-8FB8C2E67A4EEEB6;name
=MSSQL;label=MS SQL Server;version=12.6.3.jre11"
"INFO","main","05/18/2026","09:14:15","extension","Installing extension [99A4EF8D-F2FD-40C8-8FB8C2E67A4EEEB6;name=MS
SQL;label=MS SQL Server;version=12.6.3.jre11] from local provider"
2

It looks like if you

  • edit .CFConfig.json to remove unwanted extensions
  • set the same allow list in LUCEE_EXTENSIONS
  • set LUCEE_EXTENSIONS_INSTALL=false

then it works as I expect.

Is this intended behaviour we can rely on ?

Then Lucee only installs those :

"INFO","main","05/18/2026","09:30:06","controller","No extension(s) found to add/install"
"INFO","main","05/18/2026","09:30:06","controller","Extensions to install defined in env variable or system property:8D7FB0DF-08BB-1589-FE3975678F07DB17,37C61C0A-5D7E-4256-8572639BE0CF5838,B737ABC4-D43F-4D91-8E8E973E37C40D1B,66E312DD-D083-27C0-64189D16753FD6F0,87FE44E5-179C-43A3-A87B3D38BEF4652E,17AB52DE-B300-A94B-E058BD978511E39E,7E673D15-D87C-41A6-8B5F1956528C605F"
"INFO","main","05/18/2026","09:30:06","controller","Successfully installed the following extensions: 17AB52DE-B300-A94B-E058BD978511E39E, 66E312DD-D083-27C0-64189D16753FD6F0, 87FE44E5-179C-43A3-A87B3D38BEF4652E, 37C61C0A-5D7E-4256-8572639BE0CF5838, 7E673D15-D87C-41A6-8B5F1956528C605F, 8D7FB0DF-08BB-1589-FE3975678F07DB17, B737ABC4-D43F-4D91-8E8E973E37C40D1B"
"INFO","main","05/18/2026","09:30:07","extension","Found the extension [99A4EF8D-F2FD-40C8-8FB8C2E67A4EEEB6;symbolic-name=99A4EF8D-F2FD-40C8-8FB8C2E67A4EEEB6;description=JDBC Driver from Microsoft for SQL Server, SQL Server is a relational database management system developed by Microsoft.;version=12.6.3.jre11] in the installed folder that is not present in the configuration in any version, so we will uninstall it"
3

yeah, i’m digging into the quirks here…

meanwhile, are you using the installer or docker?

Any reason you aren’t just using Lucee light as your starting point?

The installer GUI allows selecting a different jar, or via the commandline

--customLuceejar=/path/to/light.jar

4

Ta.

We’re running Lucee via Docker ; the way we have things set up, if we have a common base Lucee image, which is currently FROM lucee/lucee:6.2.7.16-RC-nginx
Then our desktop development as well as live Docker images both build off that common base.
I noticed while updating to the RC that although the base removes the .CFConfig.json entries, the dev image logs it’s putting them back.

We don’t use the light version just for historical versions - the Nginx image comes with “batteries included”. Probably not something we’d change for a point release.
Come Lucee v7 though …

5

can you elaborate?

6

the dev image logs it’s putting them back.

This output is from the dev image:

This only happens if the Dev image adds ENV LUCEE_EXTENSIONS_INSTALL=false

The base image has LUCEE_EXTENSIONS=... and LUCEE_EXTENSIONS_INSTALL=false as well as removals of the extensions from .CFConfig.json