IRIS isn't suitable (nor meant to be) running on the edge or inside containers for that matter.
As its name implies it is a Data *Platform* a framework on its own for running large-scale mission-critical applications.
IRIS Agents or ECP Clients or whatever you will call them could extend IRIS to the realm of containers and edge applications.

We got an answer from ISC:

====
IRIS and Cache do use log4j but our products do not include versions affected by this vulnerability. This vulnerability affects versions from 2.0-beta9 to 2.14.1. The log4j versions used in Cache and IRIS product are based on version 1.x of log4j which is not affected by this issue.
====


But of course one can use Log4j 2.* in your own Java applications.

Open the ClassDefinition: Set ClassDef=##class(%Dictionalry.ClassDefinition).%OpenId(ClassName)
Add the Parameter

Set Parm=##class(%Dictionary.ParameterDefinition).%New(ClassName_":"_ParameterName)
Set Parm.Default=ParameterValue
Do ClassDef.Parameters.Insert(Parm)


Find the desired method in ClassDef.Methods collection by MethDef.Name
Use the MethDef.Implementation stream to manipulate the code
Compile the class.

I don't know if this is the case, but be sure not to output anything before setting Content-Type or HTTP status.
In my case it was a debug Write statement that wrote directly to the current TCP stream.
Because of IO redirect when something is written to the stream (the HTTP body) first the headers must be written and those are at that time the default values.

But it's not about the front-end, you can use any you like.
The power of CSP is in the back-end: hybrid server-side rendering, seamless integration with Classes, #server/#call.
If you are developing an InterSystems-only web application, not using CSP would be foolish.
You can still use Bootstrap, Tailwind, etc for the UI sugar, but for data integration and routing there's no match.

> ISC was never a leader in WebPages  

I don't agree: Weblink/CSP was Ajax-avant-la-lettre, it was absolutely amazing what you could accomplish with CSP/CSR. Rob Tweed and Chris Munt invented it and Stavros Macrakis marked it. We were able to rewrite our VB based application (dll-hell) within a few months and being much more flexible.
I still think CSP is very useful for 'internal' applications, combined with Tailwind ccs and Alpine js anything is possible.