diff --git a/ga/22.0.0.12/kernel/Dockerfile.ubi.ibmjava8 b/ga/22.0.0.12/kernel/Dockerfile.ubi.ibmjava8
index c37a471b..af120054 100644
--- a/ga/22.0.0.12/kernel/Dockerfile.ubi.ibmjava8
+++ b/ga/22.0.0.12/kernel/Dockerfile.ubi.ibmjava8
@@ -85,18 +85,9 @@ RUN mkdir /logs \
     && mkdir /etc/wlp \
     && mkdir -p /opt/ibm/wlp/usr/shared/resources/lib.index.cache \
     && mkdir -p /home/default \
-    && mkdir /output \
-    && chmod -t /output \
-    && rm -rf /output \
-    && ln -s $WLP_OUTPUT_DIR/defaultServer /output \
-    && ln -s /opt/ibm/wlp/usr/servers/defaultServer /config \
     && ln -s /opt/ibm /liberty \
     && ln -s /opt/ibm/fixes /fixes \
     && ln -s /opt/ibm/wlp/usr/shared/resources/lib.index.cache /lib.index.cache \
-    && mkdir -p /config/configDropins/defaults \
-    && mkdir -p /config/configDropins/overrides \
-    && chown -R 1001:0 /config \
-    && chmod -R g+rw /config \
     && chown -R 1001:0 /opt/ibm/helpers \
     && chmod -R g+rwx /opt/ibm/helpers \
     && chown -R 1001:0 /opt/ibm/fixes \
@@ -110,7 +101,36 @@ RUN mkdir /logs \
     && chown -R 1001:0 /etc/wlp \
     && chmod -R g+rw /etc/wlp \
     && chown -R 1001:0 /home/default \
-    && chmod -R g+rw /home/default
+    && chmod -R g+rw /home/default \
+    && mkdir -p /opt/ibm/links \
+    && chown -R 1001:0 /opt/ibm/links \
+    && chmod -R g+rw /opt/ibm/links
+
+# Create second-level symlinks as non-root user
+USER 1001
+
+RUN mkdir -p $WLP_OUTPUT_DIR/defaultServer \
+    && ln -s $WLP_OUTPUT_DIR/defaultServer /opt/ibm/links/output \
+    && ln -s /opt/ibm/wlp/usr/servers/defaultServer /opt/ibm/links/config \
+    && mkdir -p /opt/ibm/links/config/configDropins/defaults \
+    && mkdir -p /opt/ibm/links/config/configDropins/overrides
+
+# Create first-level symlinks as root user
+USER 0
+
+RUN mkdir /output \
+    && chmod -t /output \
+    && rm -rf /output \
+    && ln -s /opt/ibm/links/output /output \
+    && ln -s /opt/ibm/links/config /config \
+    && chown -R 1001:0 /opt/ibm/links/output \
+    && chmod -R g+rw /opt/ibm/links/output \
+    && chown -R 1001:0 /opt/ibm/links/config \
+    && chmod -R g+rw /opt/ibm/links/config \
+    && chown -R 1001:0 /config \
+    && chmod -R g+rw /config \
+    && chown -R 1001:0 /output \
+    && chmod -R g+rw /output
 
 # Create a new SCC layer
 RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
diff --git a/ga/22.0.0.12/kernel/Dockerfile.ubi.openjdk11 b/ga/22.0.0.12/kernel/Dockerfile.ubi.openjdk11
index a2953b56..95d80c80 100644
--- a/ga/22.0.0.12/kernel/Dockerfile.ubi.openjdk11
+++ b/ga/22.0.0.12/kernel/Dockerfile.ubi.openjdk11
@@ -86,18 +86,9 @@ RUN mkdir /logs \
     && mkdir /etc/wlp \
     && mkdir -p /opt/ibm/wlp/usr/shared/resources/lib.index.cache \
     && mkdir -p /home/default \
-    && mkdir /output \
-    && chmod -t /output \
-    && rm -rf /output \
-    && ln -s $WLP_OUTPUT_DIR/defaultServer /output \
-    && ln -s /opt/ibm/wlp/usr/servers/defaultServer /config \
     && ln -s /opt/ibm /liberty \
     && ln -s /opt/ibm/fixes /fixes \
     && ln -s /opt/ibm/wlp/usr/shared/resources/lib.index.cache /lib.index.cache \
-    && mkdir -p /config/configDropins/defaults \
-    && mkdir -p /config/configDropins/overrides \
-    && chown -R 1001:0 /config \
-    && chmod -R g+rw /config \
     && chown -R 1001:0 /opt/ibm/helpers \
     && chmod -R g+rwx /opt/ibm/helpers \
     && chown -R 1001:0 /opt/ibm/fixes \
@@ -111,7 +102,36 @@ RUN mkdir /logs \
     && chown -R 1001:0 /etc/wlp \
     && chmod -R g+rw /etc/wlp \
     && chown -R 1001:0 /home/default \
-    && chmod -R g+rw /home/default
+    && chmod -R g+rw /home/default \
+    && mkdir -p /opt/ibm/links \
+    && chown -R 1001:0 /opt/ibm/links \
+    && chmod -R g+rw /opt/ibm/links
+
+# Create second-level symlinks as non-root user
+USER 1001
+
+RUN mkdir -p $WLP_OUTPUT_DIR/defaultServer \
+    && ln -s $WLP_OUTPUT_DIR/defaultServer /opt/ibm/links/output \
+    && ln -s /opt/ibm/wlp/usr/servers/defaultServer /opt/ibm/links/config \
+    && mkdir -p /opt/ibm/links/config/configDropins/defaults \
+    && mkdir -p /opt/ibm/links/config/configDropins/overrides
+
+# Create first-level symlinks as root user
+USER 0
+
+RUN mkdir /output \
+    && chmod -t /output \
+    && rm -rf /output \
+    && ln -s /opt/ibm/links/output /output \
+    && ln -s /opt/ibm/links/config /config \
+    && chown -R 1001:0 /opt/ibm/links/output \
+    && chmod -R g+rw /opt/ibm/links/output \
+    && chown -R 1001:0 /opt/ibm/links/config \
+    && chmod -R g+rw /opt/ibm/links/config \
+    && chown -R 1001:0 /config \
+    && chmod -R g+rw /config \
+    && chown -R 1001:0 /output \
+    && chmod -R g+rw /output
 
 # Create a new SCC layer
 RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
diff --git a/ga/22.0.0.12/kernel/Dockerfile.ubi.openjdk17 b/ga/22.0.0.12/kernel/Dockerfile.ubi.openjdk17
index 509904e4..9e95aeb2 100644
--- a/ga/22.0.0.12/kernel/Dockerfile.ubi.openjdk17
+++ b/ga/22.0.0.12/kernel/Dockerfile.ubi.openjdk17
@@ -86,18 +86,9 @@ RUN mkdir /logs \
     && mkdir /etc/wlp \
     && mkdir -p /opt/ibm/wlp/usr/shared/resources/lib.index.cache \
     && mkdir -p /home/default \
-    && mkdir /output \
-    && chmod -t /output \
-    && rm -rf /output \
-    && ln -s $WLP_OUTPUT_DIR/defaultServer /output \
-    && ln -s /opt/ibm/wlp/usr/servers/defaultServer /config \
     && ln -s /opt/ibm /liberty \
     && ln -s /opt/ibm/fixes /fixes \
     && ln -s /opt/ibm/wlp/usr/shared/resources/lib.index.cache /lib.index.cache \
-    && mkdir -p /config/configDropins/defaults \
-    && mkdir -p /config/configDropins/overrides \
-    && chown -R 1001:0 /config \
-    && chmod -R g+rw /config \
     && chown -R 1001:0 /opt/ibm/helpers \
     && chmod -R g+rwx /opt/ibm/helpers \
     && chown -R 1001:0 /opt/ibm/fixes \
@@ -111,7 +102,36 @@ RUN mkdir /logs \
     && chown -R 1001:0 /etc/wlp \
     && chmod -R g+rw /etc/wlp \
     && chown -R 1001:0 /home/default \
-    && chmod -R g+rw /home/default
+    && chmod -R g+rw /home/default \
+    && mkdir -p /opt/ibm/links \
+    && chown -R 1001:0 /opt/ibm/links \
+    && chmod -R g+rw /opt/ibm/links
+
+# Create second-level symlinks as non-root user
+USER 1001
+
+RUN mkdir -p $WLP_OUTPUT_DIR/defaultServer \
+    && ln -s $WLP_OUTPUT_DIR/defaultServer /opt/ibm/links/output \
+    && ln -s /opt/ibm/wlp/usr/servers/defaultServer /opt/ibm/links/config \
+    && mkdir -p /opt/ibm/links/config/configDropins/defaults \
+    && mkdir -p /opt/ibm/links/config/configDropins/overrides
+
+# Create first-level symlinks as root user
+USER 0
+
+RUN mkdir /output \
+    && chmod -t /output \
+    && rm -rf /output \
+    && ln -s /opt/ibm/links/output /output \
+    && ln -s /opt/ibm/links/config /config \
+    && chown -R 1001:0 /opt/ibm/links/output \
+    && chmod -R g+rw /opt/ibm/links/output \
+    && chown -R 1001:0 /opt/ibm/links/config \
+    && chmod -R g+rw /opt/ibm/links/config \
+    && chown -R 1001:0 /config \
+    && chmod -R g+rw /config \
+    && chown -R 1001:0 /output \
+    && chmod -R g+rw /output
 
 # Create a new SCC layer
 RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
diff --git a/ga/22.0.0.12/kernel/Dockerfile.ubi.openjdk8 b/ga/22.0.0.12/kernel/Dockerfile.ubi.openjdk8
index fb9a60d5..6e7eae08 100644
--- a/ga/22.0.0.12/kernel/Dockerfile.ubi.openjdk8
+++ b/ga/22.0.0.12/kernel/Dockerfile.ubi.openjdk8
@@ -86,18 +86,9 @@ RUN mkdir /logs \
     && mkdir /etc/wlp \
     && mkdir -p /opt/ibm/wlp/usr/shared/resources/lib.index.cache \
     && mkdir -p /home/default \
-    && mkdir /output \
-    && chmod -t /output \
-    && rm -rf /output \
-    && ln -s $WLP_OUTPUT_DIR/defaultServer /output \
-    && ln -s /opt/ibm/wlp/usr/servers/defaultServer /config \
     && ln -s /opt/ibm /liberty \
     && ln -s /opt/ibm/fixes /fixes \
     && ln -s /opt/ibm/wlp/usr/shared/resources/lib.index.cache /lib.index.cache \
-    && mkdir -p /config/configDropins/defaults \
-    && mkdir -p /config/configDropins/overrides \
-    && chown -R 1001:0 /config \
-    && chmod -R g+rw /config \
     && chown -R 1001:0 /opt/ibm/helpers \
     && chmod -R g+rwx /opt/ibm/helpers \
     && chown -R 1001:0 /opt/ibm/fixes \
@@ -111,7 +102,36 @@ RUN mkdir /logs \
     && chown -R 1001:0 /etc/wlp \
     && chmod -R g+rw /etc/wlp \
     && chown -R 1001:0 /home/default \
-    && chmod -R g+rw /home/default
+    && chmod -R g+rw /home/default \
+    && mkdir -p /opt/ibm/links \
+    && chown -R 1001:0 /opt/ibm/links \
+    && chmod -R g+rw /opt/ibm/links
+
+# Create second-level symlinks as non-root user
+USER 1001
+
+RUN mkdir -p $WLP_OUTPUT_DIR/defaultServer \
+    && ln -s $WLP_OUTPUT_DIR/defaultServer /opt/ibm/links/output \
+    && ln -s /opt/ibm/wlp/usr/servers/defaultServer /opt/ibm/links/config \
+    && mkdir -p /opt/ibm/links/config/configDropins/defaults \
+    && mkdir -p /opt/ibm/links/config/configDropins/overrides
+
+# Create first-level symlinks as root user
+USER 0
+
+RUN mkdir /output \
+    && chmod -t /output \
+    && rm -rf /output \
+    && ln -s /opt/ibm/links/output /output \
+    && ln -s /opt/ibm/links/config /config \
+    && chown -R 1001:0 /opt/ibm/links/output \
+    && chmod -R g+rw /opt/ibm/links/output \
+    && chown -R 1001:0 /opt/ibm/links/config \
+    && chmod -R g+rw /opt/ibm/links/config \
+    && chown -R 1001:0 /config \
+    && chmod -R g+rw /config \
+    && chown -R 1001:0 /output \
+    && chmod -R g+rw /output
 
 # Create a new SCC layer
 RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
diff --git a/ga/22.0.0.12/kernel/Dockerfile.ubuntu.ibmjava8 b/ga/22.0.0.12/kernel/Dockerfile.ubuntu.ibmjava8
index 0fd1e89c..2c6b9a7a 100644
--- a/ga/22.0.0.12/kernel/Dockerfile.ubuntu.ibmjava8
+++ b/ga/22.0.0.12/kernel/Dockerfile.ubuntu.ibmjava8
@@ -84,18 +84,9 @@ RUN mkdir /logs \
     && mkdir /etc/wlp \
     && mkdir -p /opt/ibm/wlp/usr/shared/resources/lib.index.cache \
     && mkdir -p /home/default \
-    && mkdir /output \
-    && chmod -t /output \
-    && rm -rf /output \
-    && ln -s $WLP_OUTPUT_DIR/defaultServer /output \
-    && ln -s /opt/ibm/wlp/usr/servers/defaultServer /config \
     && ln -s /opt/ibm /liberty \
     && ln -s /opt/ibm/fixes /fixes \
     && ln -s /opt/ibm/wlp/usr/shared/resources/lib.index.cache /lib.index.cache \
-    && mkdir -p /config/configDropins/defaults \
-    && mkdir -p /config/configDropins/overrides \
-    && chown -R 1001:0 /config \
-    && chmod -R g+rw /config \
     && chown -R 1001:0 /opt/ibm/helpers \
     && chmod -R g+rwx /opt/ibm/helpers \
     && chown -R 1001:0 /opt/ibm/fixes \
@@ -109,7 +100,36 @@ RUN mkdir /logs \
     && chown -R 1001:0 /etc/wlp \
     && chmod -R g+rw /etc/wlp \
     && chown -R 1001:0 /home/default \
-    && chmod -R g+rw /home/default
+    && chmod -R g+rw /home/default \
+    && mkdir -p /opt/ibm/links \
+    && chown -R 1001:0 /opt/ibm/links \
+    && chmod -R g+rw /opt/ibm/links
+
+# Create second-level symlinks as non-root user
+USER 1001
+
+RUN mkdir -p $WLP_OUTPUT_DIR/defaultServer \
+    && ln -s $WLP_OUTPUT_DIR/defaultServer /opt/ibm/links/output \
+    && ln -s /opt/ibm/wlp/usr/servers/defaultServer /opt/ibm/links/config \
+    && mkdir -p /opt/ibm/links/config/configDropins/defaults \
+    && mkdir -p /opt/ibm/links/config/configDropins/overrides
+
+# Create first-level symlinks as root user
+USER 0
+
+RUN mkdir /output \
+    && chmod -t /output \
+    && rm -rf /output \
+    && ln -s /opt/ibm/links/output /output \
+    && ln -s /opt/ibm/links/config /config \
+    && chown -R 1001:0 /opt/ibm/links/output \
+    && chmod -R g+rw /opt/ibm/links/output \
+    && chown -R 1001:0 /opt/ibm/links/config \
+    && chmod -R g+rw /opt/ibm/links/config \
+    && chown -R 1001:0 /config \
+    && chmod -R g+rw /config \
+    && chown -R 1001:0 /output \
+    && chmod -R g+rw /output
 
 # Create a new SCC layer
 RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
diff --git a/ga/22.0.0.12/kernel/Dockerfile.ubuntu.openjdk11 b/ga/22.0.0.12/kernel/Dockerfile.ubuntu.openjdk11
index db81d88b..b6742f65 100644
--- a/ga/22.0.0.12/kernel/Dockerfile.ubuntu.openjdk11
+++ b/ga/22.0.0.12/kernel/Dockerfile.ubuntu.openjdk11
@@ -84,18 +84,9 @@ RUN mkdir /logs \
     && mkdir /etc/wlp \
     && mkdir -p /opt/ibm/wlp/usr/shared/resources/lib.index.cache \
     && mkdir -p /home/default \
-    && mkdir /output \
-    && chmod -t /output \
-    && rm -rf /output \
-    && ln -s $WLP_OUTPUT_DIR/defaultServer /output \
-    && ln -s /opt/ibm/wlp/usr/servers/defaultServer /config \
     && ln -s /opt/ibm /liberty \
     && ln -s /opt/ibm/fixes /fixes \
     && ln -s /opt/ibm/wlp/usr/shared/resources/lib.index.cache /lib.index.cache \
-    && mkdir -p /config/configDropins/defaults \
-    && mkdir -p /config/configDropins/overrides \
-    && chown -R 1001:0 /config \
-    && chmod -R g+rw /config \
     && chown -R 1001:0 /opt/ibm/helpers \
     && chmod -R g+rwx /opt/ibm/helpers \
     && chown -R 1001:0 /opt/ibm/fixes \
@@ -109,7 +100,36 @@ RUN mkdir /logs \
     && chown -R 1001:0 /etc/wlp \
     && chmod -R g+rw /etc/wlp \
     && chown -R 1001:0 /home/default \
-    && chmod -R g+rw /home/default
+    && chmod -R g+rw /home/default \
+    && mkdir -p /opt/ibm/links \
+    && chown -R 1001:0 /opt/ibm/links \
+    && chmod -R g+rw /opt/ibm/links
+
+# Create second-level symlinks as non-root user
+USER 1001
+
+RUN mkdir -p $WLP_OUTPUT_DIR/defaultServer \
+    && ln -s $WLP_OUTPUT_DIR/defaultServer /opt/ibm/links/output \
+    && ln -s /opt/ibm/wlp/usr/servers/defaultServer /opt/ibm/links/config \
+    && mkdir -p /opt/ibm/links/config/configDropins/defaults \
+    && mkdir -p /opt/ibm/links/config/configDropins/overrides
+
+# Create first-level symlinks as root user
+USER 0
+
+RUN mkdir /output \
+    && chmod -t /output \
+    && rm -rf /output \
+    && ln -s /opt/ibm/links/output /output \
+    && ln -s /opt/ibm/links/config /config \
+    && chown -R 1001:0 /opt/ibm/links/output \
+    && chmod -R g+rw /opt/ibm/links/output \
+    && chown -R 1001:0 /opt/ibm/links/config \
+    && chmod -R g+rw /opt/ibm/links/config \
+    && chown -R 1001:0 /config \
+    && chmod -R g+rw /config \
+    && chown -R 1001:0 /output \
+    && chmod -R g+rw /output
 
 # Create a new SCC layer
 RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
diff --git a/ga/22.0.0.12/kernel/Dockerfile.ubuntu.openjdk17 b/ga/22.0.0.12/kernel/Dockerfile.ubuntu.openjdk17
index 9712e248..cdbb710a 100644
--- a/ga/22.0.0.12/kernel/Dockerfile.ubuntu.openjdk17
+++ b/ga/22.0.0.12/kernel/Dockerfile.ubuntu.openjdk17
@@ -84,18 +84,9 @@ RUN mkdir /logs \
     && mkdir /etc/wlp \
     && mkdir -p /opt/ibm/wlp/usr/shared/resources/lib.index.cache \
     && mkdir -p /home/default \
-    && mkdir /output \
-    && chmod -t /output \
-    && rm -rf /output \
-    && ln -s $WLP_OUTPUT_DIR/defaultServer /output \
-    && ln -s /opt/ibm/wlp/usr/servers/defaultServer /config \
     && ln -s /opt/ibm /liberty \
     && ln -s /opt/ibm/fixes /fixes \
     && ln -s /opt/ibm/wlp/usr/shared/resources/lib.index.cache /lib.index.cache \
-    && mkdir -p /config/configDropins/defaults \
-    && mkdir -p /config/configDropins/overrides \
-    && chown -R 1001:0 /config \
-    && chmod -R g+rw /config \
     && chown -R 1001:0 /opt/ibm/helpers \
     && chmod -R g+rwx /opt/ibm/helpers \
     && chown -R 1001:0 /opt/ibm/fixes \
@@ -109,7 +100,36 @@ RUN mkdir /logs \
     && chown -R 1001:0 /etc/wlp \
     && chmod -R g+rw /etc/wlp \
     && chown -R 1001:0 /home/default \
-    && chmod -R g+rw /home/default
+    && chmod -R g+rw /home/default \
+    && mkdir -p /opt/ibm/links \
+    && chown -R 1001:0 /opt/ibm/links \
+    && chmod -R g+rw /opt/ibm/links
+
+# Create second-level symlinks as non-root user
+USER 1001
+
+RUN mkdir -p $WLP_OUTPUT_DIR/defaultServer \
+    && ln -s $WLP_OUTPUT_DIR/defaultServer /opt/ibm/links/output \
+    && ln -s /opt/ibm/wlp/usr/servers/defaultServer /opt/ibm/links/config \
+    && mkdir -p /opt/ibm/links/config/configDropins/defaults \
+    && mkdir -p /opt/ibm/links/config/configDropins/overrides
+
+# Create first-level symlinks as root user
+USER 0
+
+RUN mkdir /output \
+    && chmod -t /output \
+    && rm -rf /output \
+    && ln -s /opt/ibm/links/output /output \
+    && ln -s /opt/ibm/links/config /config \
+    && chown -R 1001:0 /opt/ibm/links/output \
+    && chmod -R g+rw /opt/ibm/links/output \
+    && chown -R 1001:0 /opt/ibm/links/config \
+    && chmod -R g+rw /opt/ibm/links/config \
+    && chown -R 1001:0 /config \
+    && chmod -R g+rw /config \
+    && chown -R 1001:0 /output \
+    && chmod -R g+rw /output
 
 # Create a new SCC layer
 RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \