Thanks for the reply.  I still have a few issues with the way this works.  I understand Arquillian probably can't do anything about it, but would still value your opinion.

When using Arquillian, I take responsibility for starting the JVM via Maven Surefire.  That means I'm also the only on that can set java.endorsed.dirs since it must be set when the JVM is started, right?  I found an old bug report that describes the problem a bit better.

Now, the problem I have is that for me, the user, there isn't a decent source for the endorsed .jars that need to be included.  Maybe I'm confused because it doesn't seem right that I should have to deal with such a messy situation if I stick to the Java EE spec.  I shouldn't need to figure out where every container stores its endorsed .jars and if / how they get loaded when I'm using the embedded versions of those containers.

Am I misunderstanding how java.endorsed.dirs works and how it relates to Java EE containers?  To me it seems like a recipe for JAR hell, yet I can't find anyone else having problems.  My questions are already the first hits on Google.  Sometimes I think I'm on a sadistic version of the Truman Show and that I'm the only one on the planet using Java EE.  Lol.