Merge cb3710b7c3 into 462e723faa
This commit is contained in:
Tianon Gravi
GitHub
commit
3f64b51a46
|
|
@ -0,0 +1,160 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:11-al2023-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
# a helper function to install things, but only if they aren't installed (and to mark them so "autoremove" can purge them for us)
|
||||||
|
_install_temporary() { ( set -eu +x; \
|
||||||
|
local pkg todo=''; \
|
||||||
|
for pkg; do \
|
||||||
|
if ! rpm --query "$pkg" > /dev/null 2>&1; then \
|
||||||
|
todo="$todo $pkg"; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
if [ -n "$todo" ]; then \
|
||||||
|
set -x; \
|
||||||
|
dnf install -y $todo; \
|
||||||
|
dnf mark remove $todo; \
|
||||||
|
fi; \
|
||||||
|
) }; \
|
||||||
|
_install_temporary gzip tar; \
|
||||||
|
# gnupg2-minimal (installed by default) conflicts with gnupg2 and does not include dirmngr so cannot fetch keys
|
||||||
|
dnf install -y --allowerasing gnupg2; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
_install_temporary \
|
||||||
|
apr-devel \
|
||||||
|
findutils \
|
||||||
|
gcc \
|
||||||
|
make \
|
||||||
|
openssl-devel \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ && $(NF-1) != "=>" { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt rpm --query --whatprovides \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r dnf mark install \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
# clean up anything added temporarily and not later marked as necessary
|
||||||
|
dnf autoremove -y; \
|
||||||
|
dnf clean all; \
|
||||||
|
rm -rf /var/cache/dnf; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:11-alpine3.19-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:11-alpine3.20-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:11-alpine3.21-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:11-alpine3.22-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM sapmachine:11-ubuntu-jammy
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM sapmachine:11-ubuntu-noble
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM ibm-semeru-runtimes:open-11-jdk-jammy
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM ibm-semeru-runtimes:open-11-jdk-noble
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,144 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:11-jdk-alpine-3.20
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,144 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:11-jdk-alpine-3.21
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,144 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:11-jdk-alpine-3.22
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -111,6 +111,15 @@ RUN set -eux; \
|
||||||
rm -rf "$nativeBuildDir"; \
|
rm -rf "$nativeBuildDir"; \
|
||||||
rm bin/tomcat-native.tar.gz; \
|
rm bin/tomcat-native.tar.gz; \
|
||||||
\
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
apt-mark auto '.*' > /dev/null; \
|
apt-mark auto '.*' > /dev/null; \
|
||||||
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
|
@ -128,15 +137,6 @@ RUN set -eux; \
|
||||||
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
rm -rf /var/lib/apt/lists/*; \
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
\
|
\
|
||||||
# sh removes env vars it doesn't support (ones with periods)
|
|
||||||
# https://github.com/docker-library/tomcat/issues/77
|
|
||||||
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
|
||||||
\
|
|
||||||
# fix permissions (especially for running as non-root)
|
|
||||||
# https://github.com/docker-library/tomcat/issues/35
|
|
||||||
chmod -R +rX .; \
|
|
||||||
chmod 1777 logs temp work; \
|
|
||||||
\
|
|
||||||
# smoke test
|
# smoke test
|
||||||
catalina.sh version
|
catalina.sh version
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -111,6 +111,15 @@ RUN set -eux; \
|
||||||
rm -rf "$nativeBuildDir"; \
|
rm -rf "$nativeBuildDir"; \
|
||||||
rm bin/tomcat-native.tar.gz; \
|
rm bin/tomcat-native.tar.gz; \
|
||||||
\
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
apt-mark auto '.*' > /dev/null; \
|
apt-mark auto '.*' > /dev/null; \
|
||||||
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
|
@ -128,15 +137,6 @@ RUN set -eux; \
|
||||||
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
rm -rf /var/lib/apt/lists/*; \
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
\
|
\
|
||||||
# sh removes env vars it doesn't support (ones with periods)
|
|
||||||
# https://github.com/docker-library/tomcat/issues/77
|
|
||||||
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
|
||||||
\
|
|
||||||
# fix permissions (especially for running as non-root)
|
|
||||||
# https://github.com/docker-library/tomcat/issues/35
|
|
||||||
chmod -R +rX .; \
|
|
||||||
chmod 1777 logs temp work; \
|
|
||||||
\
|
|
||||||
# smoke test
|
# smoke test
|
||||||
catalina.sh version
|
catalina.sh version
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,167 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:11-jdk-ubi9-minimal
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
# removing dnf after it is installed gets really hairy, so we'll just live with it (since we need it for "dnf mark")
|
||||||
|
microdnf install -y dnf; \
|
||||||
|
# a helper function to install things, but only if they aren't installed (and to mark them so "autoremove" can purge them for us)
|
||||||
|
_install_temporary() { ( set -eu +x; \
|
||||||
|
local pkg todo=''; \
|
||||||
|
for pkg; do \
|
||||||
|
if ! rpm --query "$pkg" > /dev/null 2>&1; then \
|
||||||
|
todo="$todo $pkg"; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
if [ -n "$todo" ]; then \
|
||||||
|
set -x; \
|
||||||
|
dnf install -y $todo; \
|
||||||
|
dnf mark remove $todo; \
|
||||||
|
fi; \
|
||||||
|
) }; \
|
||||||
|
_install_temporary gzip tar; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
_install_temporary \
|
||||||
|
apr-devel \
|
||||||
|
findutils \
|
||||||
|
gcc \
|
||||||
|
make \
|
||||||
|
openssl-devel \
|
||||||
|
# "gcc: error: /usr/lib/rpm/redhat/redhat-hardened-cc1: No such file or directory"
|
||||||
|
redhat-rpm-config \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ && $(NF-1) != "=>" { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt rpm --query --whatprovides \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r dnf mark install \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
# clean up anything added temporarily and not later marked as necessary
|
||||||
|
dnf autoremove -y; \
|
||||||
|
dnf clean all; \
|
||||||
|
rm -rf /var/cache/dnf; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,160 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:17-al2023-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
# a helper function to install things, but only if they aren't installed (and to mark them so "autoremove" can purge them for us)
|
||||||
|
_install_temporary() { ( set -eu +x; \
|
||||||
|
local pkg todo=''; \
|
||||||
|
for pkg; do \
|
||||||
|
if ! rpm --query "$pkg" > /dev/null 2>&1; then \
|
||||||
|
todo="$todo $pkg"; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
if [ -n "$todo" ]; then \
|
||||||
|
set -x; \
|
||||||
|
dnf install -y $todo; \
|
||||||
|
dnf mark remove $todo; \
|
||||||
|
fi; \
|
||||||
|
) }; \
|
||||||
|
_install_temporary gzip tar; \
|
||||||
|
# gnupg2-minimal (installed by default) conflicts with gnupg2 and does not include dirmngr so cannot fetch keys
|
||||||
|
dnf install -y --allowerasing gnupg2; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
_install_temporary \
|
||||||
|
apr-devel \
|
||||||
|
findutils \
|
||||||
|
gcc \
|
||||||
|
make \
|
||||||
|
openssl-devel \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ && $(NF-1) != "=>" { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt rpm --query --whatprovides \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r dnf mark install \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
# clean up anything added temporarily and not later marked as necessary
|
||||||
|
dnf autoremove -y; \
|
||||||
|
dnf clean all; \
|
||||||
|
rm -rf /var/cache/dnf; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:17-alpine3.19-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:17-alpine3.20-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:17-alpine3.21-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:17-alpine3.22-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM sapmachine:17-ubuntu-jammy
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM sapmachine:17-ubuntu-noble
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM ibm-semeru-runtimes:open-17-jdk-jammy
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM ibm-semeru-runtimes:open-17-jdk-noble
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,144 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:17-jdk-alpine-3.20
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,144 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:17-jdk-alpine-3.21
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,144 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:17-jdk-alpine-3.22
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -111,6 +111,15 @@ RUN set -eux; \
|
||||||
rm -rf "$nativeBuildDir"; \
|
rm -rf "$nativeBuildDir"; \
|
||||||
rm bin/tomcat-native.tar.gz; \
|
rm bin/tomcat-native.tar.gz; \
|
||||||
\
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
apt-mark auto '.*' > /dev/null; \
|
apt-mark auto '.*' > /dev/null; \
|
||||||
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
|
@ -128,15 +137,6 @@ RUN set -eux; \
|
||||||
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
rm -rf /var/lib/apt/lists/*; \
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
\
|
\
|
||||||
# sh removes env vars it doesn't support (ones with periods)
|
|
||||||
# https://github.com/docker-library/tomcat/issues/77
|
|
||||||
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
|
||||||
\
|
|
||||||
# fix permissions (especially for running as non-root)
|
|
||||||
# https://github.com/docker-library/tomcat/issues/35
|
|
||||||
chmod -R +rX .; \
|
|
||||||
chmod 1777 logs temp work; \
|
|
||||||
\
|
|
||||||
# smoke test
|
# smoke test
|
||||||
catalina.sh version
|
catalina.sh version
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -111,6 +111,15 @@ RUN set -eux; \
|
||||||
rm -rf "$nativeBuildDir"; \
|
rm -rf "$nativeBuildDir"; \
|
||||||
rm bin/tomcat-native.tar.gz; \
|
rm bin/tomcat-native.tar.gz; \
|
||||||
\
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
apt-mark auto '.*' > /dev/null; \
|
apt-mark auto '.*' > /dev/null; \
|
||||||
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
|
@ -128,15 +137,6 @@ RUN set -eux; \
|
||||||
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
rm -rf /var/lib/apt/lists/*; \
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
\
|
\
|
||||||
# sh removes env vars it doesn't support (ones with periods)
|
|
||||||
# https://github.com/docker-library/tomcat/issues/77
|
|
||||||
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
|
||||||
\
|
|
||||||
# fix permissions (especially for running as non-root)
|
|
||||||
# https://github.com/docker-library/tomcat/issues/35
|
|
||||||
chmod -R +rX .; \
|
|
||||||
chmod 1777 logs temp work; \
|
|
||||||
\
|
|
||||||
# smoke test
|
# smoke test
|
||||||
catalina.sh version
|
catalina.sh version
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,167 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:17-jdk-ubi9-minimal
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
# removing dnf after it is installed gets really hairy, so we'll just live with it (since we need it for "dnf mark")
|
||||||
|
microdnf install -y dnf; \
|
||||||
|
# a helper function to install things, but only if they aren't installed (and to mark them so "autoremove" can purge them for us)
|
||||||
|
_install_temporary() { ( set -eu +x; \
|
||||||
|
local pkg todo=''; \
|
||||||
|
for pkg; do \
|
||||||
|
if ! rpm --query "$pkg" > /dev/null 2>&1; then \
|
||||||
|
todo="$todo $pkg"; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
if [ -n "$todo" ]; then \
|
||||||
|
set -x; \
|
||||||
|
dnf install -y $todo; \
|
||||||
|
dnf mark remove $todo; \
|
||||||
|
fi; \
|
||||||
|
) }; \
|
||||||
|
_install_temporary gzip tar; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
_install_temporary \
|
||||||
|
apr-devel \
|
||||||
|
findutils \
|
||||||
|
gcc \
|
||||||
|
make \
|
||||||
|
openssl-devel \
|
||||||
|
# "gcc: error: /usr/lib/rpm/redhat/redhat-hardened-cc1: No such file or directory"
|
||||||
|
redhat-rpm-config \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ && $(NF-1) != "=>" { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt rpm --query --whatprovides \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r dnf mark install \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
# clean up anything added temporarily and not later marked as necessary
|
||||||
|
dnf autoremove -y; \
|
||||||
|
dnf clean all; \
|
||||||
|
rm -rf /var/cache/dnf; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,160 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:21-al2023-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
# a helper function to install things, but only if they aren't installed (and to mark them so "autoremove" can purge them for us)
|
||||||
|
_install_temporary() { ( set -eu +x; \
|
||||||
|
local pkg todo=''; \
|
||||||
|
for pkg; do \
|
||||||
|
if ! rpm --query "$pkg" > /dev/null 2>&1; then \
|
||||||
|
todo="$todo $pkg"; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
if [ -n "$todo" ]; then \
|
||||||
|
set -x; \
|
||||||
|
dnf install -y $todo; \
|
||||||
|
dnf mark remove $todo; \
|
||||||
|
fi; \
|
||||||
|
) }; \
|
||||||
|
_install_temporary gzip tar; \
|
||||||
|
# gnupg2-minimal (installed by default) conflicts with gnupg2 and does not include dirmngr so cannot fetch keys
|
||||||
|
dnf install -y --allowerasing gnupg2; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
_install_temporary \
|
||||||
|
apr-devel \
|
||||||
|
findutils \
|
||||||
|
gcc \
|
||||||
|
make \
|
||||||
|
openssl-devel \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ && $(NF-1) != "=>" { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt rpm --query --whatprovides \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r dnf mark install \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
# clean up anything added temporarily and not later marked as necessary
|
||||||
|
dnf autoremove -y; \
|
||||||
|
dnf clean all; \
|
||||||
|
rm -rf /var/cache/dnf; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:21-alpine3.19-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:21-alpine3.20-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:21-alpine3.21-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:21-alpine3.22-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM sapmachine:21-ubuntu-jammy
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM sapmachine:21-ubuntu-noble
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM ibm-semeru-runtimes:open-21-jdk-jammy
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM ibm-semeru-runtimes:open-21-jdk-noble
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,144 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:21-jdk-alpine-3.20
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,144 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:21-jdk-alpine-3.21
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,144 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:21-jdk-alpine-3.22
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -111,6 +111,15 @@ RUN set -eux; \
|
||||||
rm -rf "$nativeBuildDir"; \
|
rm -rf "$nativeBuildDir"; \
|
||||||
rm bin/tomcat-native.tar.gz; \
|
rm bin/tomcat-native.tar.gz; \
|
||||||
\
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
apt-mark auto '.*' > /dev/null; \
|
apt-mark auto '.*' > /dev/null; \
|
||||||
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
|
@ -128,15 +137,6 @@ RUN set -eux; \
|
||||||
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
rm -rf /var/lib/apt/lists/*; \
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
\
|
\
|
||||||
# sh removes env vars it doesn't support (ones with periods)
|
|
||||||
# https://github.com/docker-library/tomcat/issues/77
|
|
||||||
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
|
||||||
\
|
|
||||||
# fix permissions (especially for running as non-root)
|
|
||||||
# https://github.com/docker-library/tomcat/issues/35
|
|
||||||
chmod -R +rX .; \
|
|
||||||
chmod 1777 logs temp work; \
|
|
||||||
\
|
|
||||||
# smoke test
|
# smoke test
|
||||||
catalina.sh version
|
catalina.sh version
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -111,6 +111,15 @@ RUN set -eux; \
|
||||||
rm -rf "$nativeBuildDir"; \
|
rm -rf "$nativeBuildDir"; \
|
||||||
rm bin/tomcat-native.tar.gz; \
|
rm bin/tomcat-native.tar.gz; \
|
||||||
\
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
apt-mark auto '.*' > /dev/null; \
|
apt-mark auto '.*' > /dev/null; \
|
||||||
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
|
@ -128,15 +137,6 @@ RUN set -eux; \
|
||||||
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
rm -rf /var/lib/apt/lists/*; \
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
\
|
\
|
||||||
# sh removes env vars it doesn't support (ones with periods)
|
|
||||||
# https://github.com/docker-library/tomcat/issues/77
|
|
||||||
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
|
||||||
\
|
|
||||||
# fix permissions (especially for running as non-root)
|
|
||||||
# https://github.com/docker-library/tomcat/issues/35
|
|
||||||
chmod -R +rX .; \
|
|
||||||
chmod 1777 logs temp work; \
|
|
||||||
\
|
|
||||||
# smoke test
|
# smoke test
|
||||||
catalina.sh version
|
catalina.sh version
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,167 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:21-jdk-ubi9-minimal
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
# removing dnf after it is installed gets really hairy, so we'll just live with it (since we need it for "dnf mark")
|
||||||
|
microdnf install -y dnf; \
|
||||||
|
# a helper function to install things, but only if they aren't installed (and to mark them so "autoremove" can purge them for us)
|
||||||
|
_install_temporary() { ( set -eu +x; \
|
||||||
|
local pkg todo=''; \
|
||||||
|
for pkg; do \
|
||||||
|
if ! rpm --query "$pkg" > /dev/null 2>&1; then \
|
||||||
|
todo="$todo $pkg"; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
if [ -n "$todo" ]; then \
|
||||||
|
set -x; \
|
||||||
|
dnf install -y $todo; \
|
||||||
|
dnf mark remove $todo; \
|
||||||
|
fi; \
|
||||||
|
) }; \
|
||||||
|
_install_temporary gzip tar; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
_install_temporary \
|
||||||
|
apr-devel \
|
||||||
|
findutils \
|
||||||
|
gcc \
|
||||||
|
make \
|
||||||
|
openssl-devel \
|
||||||
|
# "gcc: error: /usr/lib/rpm/redhat/redhat-hardened-cc1: No such file or directory"
|
||||||
|
redhat-rpm-config \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ && $(NF-1) != "=>" { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt rpm --query --whatprovides \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r dnf mark install \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
# clean up anything added temporarily and not later marked as necessary
|
||||||
|
dnf autoremove -y; \
|
||||||
|
dnf clean all; \
|
||||||
|
rm -rf /var/cache/dnf; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,160 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:24-al2023-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
# a helper function to install things, but only if they aren't installed (and to mark them so "autoremove" can purge them for us)
|
||||||
|
_install_temporary() { ( set -eu +x; \
|
||||||
|
local pkg todo=''; \
|
||||||
|
for pkg; do \
|
||||||
|
if ! rpm --query "$pkg" > /dev/null 2>&1; then \
|
||||||
|
todo="$todo $pkg"; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
if [ -n "$todo" ]; then \
|
||||||
|
set -x; \
|
||||||
|
dnf install -y $todo; \
|
||||||
|
dnf mark remove $todo; \
|
||||||
|
fi; \
|
||||||
|
) }; \
|
||||||
|
_install_temporary gzip tar; \
|
||||||
|
# gnupg2-minimal (installed by default) conflicts with gnupg2 and does not include dirmngr so cannot fetch keys
|
||||||
|
dnf install -y --allowerasing gnupg2; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
_install_temporary \
|
||||||
|
apr-devel \
|
||||||
|
findutils \
|
||||||
|
gcc \
|
||||||
|
make \
|
||||||
|
openssl-devel \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ && $(NF-1) != "=>" { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt rpm --query --whatprovides \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r dnf mark install \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
# clean up anything added temporarily and not later marked as necessary
|
||||||
|
dnf autoremove -y; \
|
||||||
|
dnf clean all; \
|
||||||
|
rm -rf /var/cache/dnf; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:24-alpine3.19-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:24-alpine3.20-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:24-alpine3.21-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:24-alpine3.22-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM ibm-semeru-runtimes:open-24-jdk-jammy
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM ibm-semeru-runtimes:open-24-jdk-noble
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,160 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:25-al2023-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
# a helper function to install things, but only if they aren't installed (and to mark them so "autoremove" can purge them for us)
|
||||||
|
_install_temporary() { ( set -eu +x; \
|
||||||
|
local pkg todo=''; \
|
||||||
|
for pkg; do \
|
||||||
|
if ! rpm --query "$pkg" > /dev/null 2>&1; then \
|
||||||
|
todo="$todo $pkg"; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
if [ -n "$todo" ]; then \
|
||||||
|
set -x; \
|
||||||
|
dnf install -y $todo; \
|
||||||
|
dnf mark remove $todo; \
|
||||||
|
fi; \
|
||||||
|
) }; \
|
||||||
|
_install_temporary gzip tar; \
|
||||||
|
# gnupg2-minimal (installed by default) conflicts with gnupg2 and does not include dirmngr so cannot fetch keys
|
||||||
|
dnf install -y --allowerasing gnupg2; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
_install_temporary \
|
||||||
|
apr-devel \
|
||||||
|
findutils \
|
||||||
|
gcc \
|
||||||
|
make \
|
||||||
|
openssl-devel \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ && $(NF-1) != "=>" { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt rpm --query --whatprovides \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r dnf mark install \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
# clean up anything added temporarily and not later marked as necessary
|
||||||
|
dnf autoremove -y; \
|
||||||
|
dnf clean all; \
|
||||||
|
rm -rf /var/cache/dnf; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:25-alpine3.19-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:25-alpine3.20-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:25-alpine3.21-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:25-alpine3.22-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM sapmachine:25-ubuntu-jammy
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM sapmachine:25-ubuntu-noble
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,144 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:25-jdk-alpine-3.21
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,144 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:25-jdk-alpine-3.22
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -111,6 +111,15 @@ RUN set -eux; \
|
||||||
rm -rf "$nativeBuildDir"; \
|
rm -rf "$nativeBuildDir"; \
|
||||||
rm bin/tomcat-native.tar.gz; \
|
rm bin/tomcat-native.tar.gz; \
|
||||||
\
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
apt-mark auto '.*' > /dev/null; \
|
apt-mark auto '.*' > /dev/null; \
|
||||||
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
|
@ -128,15 +137,6 @@ RUN set -eux; \
|
||||||
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
rm -rf /var/lib/apt/lists/*; \
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
\
|
\
|
||||||
# sh removes env vars it doesn't support (ones with periods)
|
|
||||||
# https://github.com/docker-library/tomcat/issues/77
|
|
||||||
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
|
||||||
\
|
|
||||||
# fix permissions (especially for running as non-root)
|
|
||||||
# https://github.com/docker-library/tomcat/issues/35
|
|
||||||
chmod -R +rX .; \
|
|
||||||
chmod 1777 logs temp work; \
|
|
||||||
\
|
|
||||||
# smoke test
|
# smoke test
|
||||||
catalina.sh version
|
catalina.sh version
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -111,6 +111,15 @@ RUN set -eux; \
|
||||||
rm -rf "$nativeBuildDir"; \
|
rm -rf "$nativeBuildDir"; \
|
||||||
rm bin/tomcat-native.tar.gz; \
|
rm bin/tomcat-native.tar.gz; \
|
||||||
\
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
apt-mark auto '.*' > /dev/null; \
|
apt-mark auto '.*' > /dev/null; \
|
||||||
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
|
@ -128,15 +137,6 @@ RUN set -eux; \
|
||||||
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
rm -rf /var/lib/apt/lists/*; \
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
\
|
\
|
||||||
# sh removes env vars it doesn't support (ones with periods)
|
|
||||||
# https://github.com/docker-library/tomcat/issues/77
|
|
||||||
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
|
||||||
\
|
|
||||||
# fix permissions (especially for running as non-root)
|
|
||||||
# https://github.com/docker-library/tomcat/issues/35
|
|
||||||
chmod -R +rX .; \
|
|
||||||
chmod 1777 logs temp work; \
|
|
||||||
\
|
|
||||||
# smoke test
|
# smoke test
|
||||||
catalina.sh version
|
catalina.sh version
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM openjdk:26-jdk-bookworm
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,163 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM openjdk:26-jdk-oraclelinux9
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
# removing dnf after it is installed gets really hairy, so we'll just live with it (since we need it for "dnf mark")
|
||||||
|
microdnf install -y dnf; \
|
||||||
|
# a helper function to install things, but only if they aren't installed (and to mark them so "autoremove" can purge them for us)
|
||||||
|
_install_temporary() { ( set -eu +x; \
|
||||||
|
local pkg todo=''; \
|
||||||
|
for pkg; do \
|
||||||
|
if ! rpm --query "$pkg" > /dev/null 2>&1; then \
|
||||||
|
todo="$todo $pkg"; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
if [ -n "$todo" ]; then \
|
||||||
|
set -x; \
|
||||||
|
dnf install -y $todo; \
|
||||||
|
dnf mark remove $todo; \
|
||||||
|
fi; \
|
||||||
|
) }; \
|
||||||
|
_install_temporary gzip tar; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
_install_temporary \
|
||||||
|
apr-devel \
|
||||||
|
findutils \
|
||||||
|
gcc \
|
||||||
|
make \
|
||||||
|
openssl-devel \
|
||||||
|
# "gcc: error: /usr/lib/rpm/redhat/redhat-hardened-cc1: No such file or directory"
|
||||||
|
redhat-rpm-config \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ && $(NF-1) != "=>" { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt rpm --query --whatprovides \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r dnf mark install \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
# clean up anything added temporarily and not later marked as necessary
|
||||||
|
dnf autoremove -y; \
|
||||||
|
dnf clean all; \
|
||||||
|
rm -rf /var/cache/dnf; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM openjdk:26-jdk-slim-bookworm
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM openjdk:26-jdk-slim-trixie
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM openjdk:26-jdk-trixie
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-10/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-10/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'5C3C5F3E314C866292F359A8F3AD5C94A67F707E' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,39 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM ibm-semeru-runtimes:open-11-jre-jammy
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk11-semeru-jammy $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
apt-get update; \
|
||||||
|
xargs -rt apt-get install -y --no-install-recommends < "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt"; \
|
||||||
|
rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,39 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM ibm-semeru-runtimes:open-11-jre-noble
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk11-semeru-noble $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
apt-get update; \
|
||||||
|
xargs -rt apt-get install -y --no-install-recommends < "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt"; \
|
||||||
|
rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,42 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:11-jre-alpine-3.20
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk11-temurin-alpine3.20 $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
deps="$(cat "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt")"; \
|
||||||
|
apk add --no-cache --virtual .tomcat-native-deps $deps
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,42 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:11-jre-alpine-3.21
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk11-temurin-alpine3.21 $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
deps="$(cat "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt")"; \
|
||||||
|
apk add --no-cache --virtual .tomcat-native-deps $deps
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,42 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:11-jre-alpine-3.22
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk11-temurin-alpine3.22 $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
deps="$(cat "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt")"; \
|
||||||
|
apk add --no-cache --virtual .tomcat-native-deps $deps
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,45 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:11-jre-ubi9-minimal
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk11-temurin-ubi9-minimal $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
# no xargs in al20XX and ubiX-minimal /o\
|
||||||
|
deps="$(cat "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt")"; \
|
||||||
|
microdnf install -y $deps; \
|
||||||
|
microdnf clean all; \
|
||||||
|
rm -rf /var/cache/dnf
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,39 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM ibm-semeru-runtimes:open-17-jre-jammy
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk17-semeru-jammy $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
apt-get update; \
|
||||||
|
xargs -rt apt-get install -y --no-install-recommends < "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt"; \
|
||||||
|
rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,39 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM ibm-semeru-runtimes:open-17-jre-noble
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk17-semeru-noble $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
apt-get update; \
|
||||||
|
xargs -rt apt-get install -y --no-install-recommends < "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt"; \
|
||||||
|
rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,42 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:17-jre-alpine-3.20
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk17-temurin-alpine3.20 $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
deps="$(cat "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt")"; \
|
||||||
|
apk add --no-cache --virtual .tomcat-native-deps $deps
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,42 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:17-jre-alpine-3.21
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk17-temurin-alpine3.21 $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
deps="$(cat "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt")"; \
|
||||||
|
apk add --no-cache --virtual .tomcat-native-deps $deps
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,42 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:17-jre-alpine-3.22
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk17-temurin-alpine3.22 $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
deps="$(cat "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt")"; \
|
||||||
|
apk add --no-cache --virtual .tomcat-native-deps $deps
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,45 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:17-jre-ubi9-minimal
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk17-temurin-ubi9-minimal $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
# no xargs in al20XX and ubiX-minimal /o\
|
||||||
|
deps="$(cat "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt")"; \
|
||||||
|
microdnf install -y $deps; \
|
||||||
|
microdnf clean all; \
|
||||||
|
rm -rf /var/cache/dnf
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,39 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM ibm-semeru-runtimes:open-21-jre-jammy
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk21-semeru-jammy $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
apt-get update; \
|
||||||
|
xargs -rt apt-get install -y --no-install-recommends < "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt"; \
|
||||||
|
rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,39 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM ibm-semeru-runtimes:open-21-jre-noble
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk21-semeru-noble $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
apt-get update; \
|
||||||
|
xargs -rt apt-get install -y --no-install-recommends < "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt"; \
|
||||||
|
rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,42 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:21-jre-alpine-3.20
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk21-temurin-alpine3.20 $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
deps="$(cat "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt")"; \
|
||||||
|
apk add --no-cache --virtual .tomcat-native-deps $deps
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,42 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:21-jre-alpine-3.21
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk21-temurin-alpine3.21 $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
deps="$(cat "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt")"; \
|
||||||
|
apk add --no-cache --virtual .tomcat-native-deps $deps
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,42 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:21-jre-alpine-3.22
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk21-temurin-alpine3.22 $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
deps="$(cat "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt")"; \
|
||||||
|
apk add --no-cache --virtual .tomcat-native-deps $deps
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,45 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:21-jre-ubi9-minimal
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk21-temurin-ubi9-minimal $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
# no xargs in al20XX and ubiX-minimal /o\
|
||||||
|
deps="$(cat "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt")"; \
|
||||||
|
microdnf install -y $deps; \
|
||||||
|
microdnf clean all; \
|
||||||
|
rm -rf /var/cache/dnf
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,39 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM ibm-semeru-runtimes:open-24-jre-jammy
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk24-semeru-jammy $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
apt-get update; \
|
||||||
|
xargs -rt apt-get install -y --no-install-recommends < "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt"; \
|
||||||
|
rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,39 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM ibm-semeru-runtimes:open-24-jre-noble
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk24-semeru-noble $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
apt-get update; \
|
||||||
|
xargs -rt apt-get install -y --no-install-recommends < "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt"; \
|
||||||
|
rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,42 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:25-jre-alpine-3.21
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk25-temurin-alpine3.21 $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
deps="$(cat "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt")"; \
|
||||||
|
apk add --no-cache --virtual .tomcat-native-deps $deps
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,42 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:25-jre-alpine-3.22
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 10
|
||||||
|
ENV TOMCAT_VERSION 10.1.46
|
||||||
|
ENV TOMCAT_SHA512 20da89fa77fb8d4dbfccf6c68383751348169542aad9d3cbcaf82011337355b9847b883cc71678fa6cc71ef3f55e8d5d7a09a53238b86011816fa989f9c4ff5e
|
||||||
|
|
||||||
|
COPY --from=tomcat:10.1.46-jdk25-temurin-alpine3.22 $CATALINA_HOME $CATALINA_HOME
|
||||||
|
RUN set -eux; \
|
||||||
|
deps="$(cat "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt")"; \
|
||||||
|
apk add --no-cache --virtual .tomcat-native-deps $deps
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,160 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:17-al2023-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 11
|
||||||
|
ENV TOMCAT_VERSION 11.0.11
|
||||||
|
ENV TOMCAT_SHA512 a26b2269530fd2fc834e9b1544962f6524cf87925de43b05ad050e66b5eaa76a4ad754a2c5fc4f851baf75a0ea1b0ed8f51082300393a4c35d8c2da0d7c535bd
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
# a helper function to install things, but only if they aren't installed (and to mark them so "autoremove" can purge them for us)
|
||||||
|
_install_temporary() { ( set -eu +x; \
|
||||||
|
local pkg todo=''; \
|
||||||
|
for pkg; do \
|
||||||
|
if ! rpm --query "$pkg" > /dev/null 2>&1; then \
|
||||||
|
todo="$todo $pkg"; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
if [ -n "$todo" ]; then \
|
||||||
|
set -x; \
|
||||||
|
dnf install -y $todo; \
|
||||||
|
dnf mark remove $todo; \
|
||||||
|
fi; \
|
||||||
|
) }; \
|
||||||
|
_install_temporary gzip tar; \
|
||||||
|
# gnupg2-minimal (installed by default) conflicts with gnupg2 and does not include dirmngr so cannot fetch keys
|
||||||
|
dnf install -y --allowerasing gnupg2; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-11/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-11/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'48F8E69F6390C9F25CFEDCD268248959359E722B' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
_install_temporary \
|
||||||
|
apr-devel \
|
||||||
|
findutils \
|
||||||
|
gcc \
|
||||||
|
make \
|
||||||
|
openssl-devel \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ && $(NF-1) != "=>" { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt rpm --query --whatprovides \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r dnf mark install \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
# clean up anything added temporarily and not later marked as necessary
|
||||||
|
dnf autoremove -y; \
|
||||||
|
dnf clean all; \
|
||||||
|
rm -rf /var/cache/dnf; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:17-alpine3.19-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 11
|
||||||
|
ENV TOMCAT_VERSION 11.0.11
|
||||||
|
ENV TOMCAT_SHA512 a26b2269530fd2fc834e9b1544962f6524cf87925de43b05ad050e66b5eaa76a4ad754a2c5fc4f851baf75a0ea1b0ed8f51082300393a4c35d8c2da0d7c535bd
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-11/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-11/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'48F8E69F6390C9F25CFEDCD268248959359E722B' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:17-alpine3.20-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 11
|
||||||
|
ENV TOMCAT_VERSION 11.0.11
|
||||||
|
ENV TOMCAT_SHA512 a26b2269530fd2fc834e9b1544962f6524cf87925de43b05ad050e66b5eaa76a4ad754a2c5fc4f851baf75a0ea1b0ed8f51082300393a4c35d8c2da0d7c535bd
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-11/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-11/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'48F8E69F6390C9F25CFEDCD268248959359E722B' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:17-alpine3.21-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 11
|
||||||
|
ENV TOMCAT_VERSION 11.0.11
|
||||||
|
ENV TOMCAT_SHA512 a26b2269530fd2fc834e9b1544962f6524cf87925de43b05ad050e66b5eaa76a4ad754a2c5fc4f851baf75a0ea1b0ed8f51082300393a4c35d8c2da0d7c535bd
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-11/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-11/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'48F8E69F6390C9F25CFEDCD268248959359E722B' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM amazoncorretto:17-alpine3.22-jdk
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 11
|
||||||
|
ENV TOMCAT_VERSION 11.0.11
|
||||||
|
ENV TOMCAT_SHA512 a26b2269530fd2fc834e9b1544962f6524cf87925de43b05ad050e66b5eaa76a4ad754a2c5fc4f851baf75a0ea1b0ed8f51082300393a4c35d8c2da0d7c535bd
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-11/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-11/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'48F8E69F6390C9F25CFEDCD268248959359E722B' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM sapmachine:17-ubuntu-jammy
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 11
|
||||||
|
ENV TOMCAT_VERSION 11.0.11
|
||||||
|
ENV TOMCAT_SHA512 a26b2269530fd2fc834e9b1544962f6524cf87925de43b05ad050e66b5eaa76a4ad754a2c5fc4f851baf75a0ea1b0ed8f51082300393a4c35d8c2da0d7c535bd
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-11/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-11/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'48F8E69F6390C9F25CFEDCD268248959359E722B' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM sapmachine:17-ubuntu-noble
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 11
|
||||||
|
ENV TOMCAT_VERSION 11.0.11
|
||||||
|
ENV TOMCAT_SHA512 a26b2269530fd2fc834e9b1544962f6524cf87925de43b05ad050e66b5eaa76a4ad754a2c5fc4f851baf75a0ea1b0ed8f51082300393a4c35d8c2da0d7c535bd
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-11/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-11/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'48F8E69F6390C9F25CFEDCD268248959359E722B' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM ibm-semeru-runtimes:open-17-jdk-jammy
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 11
|
||||||
|
ENV TOMCAT_VERSION 11.0.11
|
||||||
|
ENV TOMCAT_SHA512 a26b2269530fd2fc834e9b1544962f6524cf87925de43b05ad050e66b5eaa76a4ad754a2c5fc4f851baf75a0ea1b0ed8f51082300393a4c35d8c2da0d7c535bd
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-11/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-11/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'48F8E69F6390C9F25CFEDCD268248959359E722B' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,154 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM ibm-semeru-runtimes:open-17-jdk-noble
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 11
|
||||||
|
ENV TOMCAT_VERSION 11.0.11
|
||||||
|
ENV TOMCAT_SHA512 a26b2269530fd2fc834e9b1544962f6524cf87925de43b05ad050e66b5eaa76a4ad754a2c5fc4f851baf75a0ea1b0ed8f51082300393a4c35d8c2da0d7c535bd
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
savedAptMark="$(apt-mark showmanual)"; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-11/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-11/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'48F8E69F6390C9F25CFEDCD268248959359E722B' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
dpkg-dev \
|
||||||
|
gcc \
|
||||||
|
libapr1-dev \
|
||||||
|
libssl-dev \
|
||||||
|
make \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# sh removes env vars it doesn't support (ones with periods)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/77
|
||||||
|
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||||
|
apt-mark auto '.*' > /dev/null; \
|
||||||
|
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
|
||||||
|
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
|
||||||
|
| awk '/=>/ { print $(NF-1) }' \
|
||||||
|
| xargs -rt readlink -e \
|
||||||
|
| sort -u \
|
||||||
|
| xargs -rt dpkg-query --search \
|
||||||
|
| cut -d: -f1 \
|
||||||
|
| sort -u \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
| xargs -r apt-mark manual \
|
||||||
|
; \
|
||||||
|
\
|
||||||
|
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||||
|
rm -rf /var/lib/apt/lists/*; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
|
|
@ -0,0 +1,144 @@
|
||||||
|
#
|
||||||
|
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
|
||||||
|
#
|
||||||
|
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||||
|
#
|
||||||
|
|
||||||
|
FROM eclipse-temurin:17-jdk-alpine-3.20
|
||||||
|
|
||||||
|
ENV CATALINA_HOME /usr/local/tomcat
|
||||||
|
ENV PATH $CATALINA_HOME/bin:$PATH
|
||||||
|
RUN mkdir -p "$CATALINA_HOME"
|
||||||
|
WORKDIR $CATALINA_HOME
|
||||||
|
|
||||||
|
# let "Tomcat Native" live somewhere isolated
|
||||||
|
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
|
||||||
|
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
|
||||||
|
|
||||||
|
ENV TOMCAT_MAJOR 11
|
||||||
|
ENV TOMCAT_VERSION 11.0.11
|
||||||
|
ENV TOMCAT_SHA512 a26b2269530fd2fc834e9b1544962f6524cf87925de43b05ad050e66b5eaa76a4ad754a2c5fc4f851baf75a0ea1b0ed8f51082300393a4c35d8c2da0d7c535bd
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
\
|
||||||
|
apk add --no-cache --virtual .fetch-deps gnupg; \
|
||||||
|
\
|
||||||
|
ddist() { \
|
||||||
|
local f="$1"; shift; \
|
||||||
|
local distFile="$1"; shift; \
|
||||||
|
local mvnFile="${1:-}"; \
|
||||||
|
local success=; \
|
||||||
|
local distUrl=; \
|
||||||
|
for distUrl in \
|
||||||
|
# https://apache.org/history/mirror-history.html
|
||||||
|
"https://dlcdn.apache.org/$distFile" \
|
||||||
|
# if the version is outdated, we have to pull from the archive
|
||||||
|
"https://archive.apache.org/dist/$distFile" \
|
||||||
|
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
|
||||||
|
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
|
||||||
|
; do \
|
||||||
|
if wget -O "$f" "$distUrl" && [ -s "$f" ]; then \
|
||||||
|
success=1; \
|
||||||
|
break; \
|
||||||
|
fi; \
|
||||||
|
done; \
|
||||||
|
[ -n "$success" ]; \
|
||||||
|
}; \
|
||||||
|
\
|
||||||
|
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
|
||||||
|
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum -c -; \
|
||||||
|
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
wget -O upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-11/KEYS'; \
|
||||||
|
gpg --batch --import upstream-KEYS; \
|
||||||
|
# filter upstream KEYS file to *just* known/precomputed fingerprints
|
||||||
|
printf '' > filtered-KEYS; \
|
||||||
|
# see https://www.apache.org/dist/tomcat/tomcat-11/KEYS
|
||||||
|
for key in \
|
||||||
|
'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
|
||||||
|
'48F8E69F6390C9F25CFEDCD268248959359E722B' \
|
||||||
|
; do \
|
||||||
|
gpg --batch --fingerprint "$key"; \
|
||||||
|
gpg --batch --export --armor "$key" >> filtered-KEYS; \
|
||||||
|
done; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
|
||||||
|
gpg --batch --import filtered-KEYS; \
|
||||||
|
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
|
||||||
|
tar -xf tomcat.tar.gz --strip-components=1; \
|
||||||
|
rm bin/*.bat; \
|
||||||
|
rm tomcat.tar.gz*; \
|
||||||
|
gpgconf --kill all; \
|
||||||
|
rm -rf "$GNUPGHOME"; \
|
||||||
|
\
|
||||||
|
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
|
||||||
|
mv webapps webapps.dist; \
|
||||||
|
mkdir webapps; \
|
||||||
|
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
|
||||||
|
\
|
||||||
|
nativeBuildDir="$(mktemp -d)"; \
|
||||||
|
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
|
||||||
|
apk add --no-cache --virtual .build-deps \
|
||||||
|
apr-dev \
|
||||||
|
dpkg-dev dpkg \
|
||||||
|
gcc \
|
||||||
|
libc-dev \
|
||||||
|
make \
|
||||||
|
openssl3-dev \
|
||||||
|
; \
|
||||||
|
( \
|
||||||
|
export CATALINA_HOME="$PWD"; \
|
||||||
|
cd "$nativeBuildDir/native"; \
|
||||||
|
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||||
|
aprConfig="$(command -v apr-1-config)"; \
|
||||||
|
./configure \
|
||||||
|
--build="$gnuArch" \
|
||||||
|
--libdir="$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
--prefix="$CATALINA_HOME" \
|
||||||
|
--with-apr="$aprConfig" \
|
||||||
|
--with-java-home="$JAVA_HOME" \
|
||||||
|
; \
|
||||||
|
nproc="$(nproc)"; \
|
||||||
|
make -j "$nproc"; \
|
||||||
|
make install; \
|
||||||
|
); \
|
||||||
|
rm -rf "$nativeBuildDir"; \
|
||||||
|
rm bin/tomcat-native.tar.gz; \
|
||||||
|
\
|
||||||
|
# fix permissions (especially for running as non-root)
|
||||||
|
# https://github.com/docker-library/tomcat/issues/35
|
||||||
|
chmod -R +rX .; \
|
||||||
|
chmod 1777 logs temp work; \
|
||||||
|
\
|
||||||
|
# mark any explicit dependencies as manually installed
|
||||||
|
deps="$( \
|
||||||
|
scanelf --needed --nobanner --format '%n#p' --recursive "$TOMCAT_NATIVE_LIBDIR" \
|
||||||
|
| tr ',' '\n' \
|
||||||
|
| sort -u \
|
||||||
|
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||||
|
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
|
||||||
|
)"; \
|
||||||
|
apk add --no-network --virtual .tomcat-native-deps $deps; \
|
||||||
|
\
|
||||||
|
apk del --no-network .fetch-deps .build-deps; \
|
||||||
|
\
|
||||||
|
# smoke test
|
||||||
|
catalina.sh version
|
||||||
|
|
||||||
|
# verify Tomcat Native is working properly
|
||||||
|
RUN set -eux; \
|
||||||
|
nativeLines="$(catalina.sh configtest 2>&1)"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
|
||||||
|
nativeLines="$(echo "$nativeLines" | sort -u)"; \
|
||||||
|
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
|
||||||
|
echo >&2 "$nativeLines"; \
|
||||||
|
exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
|
||||||
|
ENTRYPOINT []
|
||||||
|
|
||||||
|
CMD ["catalina.sh", "run"]
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue