Skip to content

Feature/tomcat upgrades - for 9.0.65 with TLS cipher changes #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Aug 11, 2022
Merged

Feature/tomcat upgrades - for 9.0.65 with TLS cipher changes #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7276f00
Updated for tomcat 9.0.55 jre8/11/17
sathya1104 Nov 29, 2021
e25ca25
Merge pull request #3 from sathya1104/master
sathya1104 Nov 29, 2021
f6d3571
Updated for tomcat - 9.0.65 with SSL Handshake TLS ciphers jlink modules
sathya1104 Aug 11, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile-alpine-jre11
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ ENV OS_RELEASE="Alpine Linux v3.14"
ENV JRE_HOME=/usr/lib/jvm/default-jvm/jre
COPY --from=stage-0 /usr/lib/jvm/default-jvm/jre/bin/jre ${JRE_HOME}
ENV PATH=${JRE_HOME}/bin:$PATH
ENV JAVA_VERSION=11.0.11+9-alpine-r0
ENV JAVA_VERSION=11.0.12+7-alpine-r0

RUN set -eux;\
apk update \
Expand Down
52 changes: 52 additions & 0 deletions Dockerfile-alpine-jre17
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
# docker build -t sathya1104/tomcat-custom:9.0.44.0-alpine-jre-17.0.10 . -f Dockerfile-tomcat-jre-17 --no-cache
FROM alpine:latest AS stage-0
# Prefer openjdk11 over openjdk11-jre for jlink and we can use it remove more default modules and reduce image size
RUN set -eux;\
apk --no-cache --virtual add openjdk17 \
--repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing
WORKDIR /usr/lib/jvm/default-jvm/jre/bin/
RUN set -eux;\
./jlink --output jre --compress=2 --no-header-files --no-man-pages --module-path ../jmods --add-modules jdk.xml.dom,java.management,java.management.rmi,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.se,java.security.jgss,java.security.sasl,java.smartcardio,java.sql,java.sql.rowset,java.transaction.xa,java.xml,java.xml.crypto

FROM alpine:latest
MAINTAINER "Sathya KUMARASWAMY <sathya1104@gmail.com>"
ENV OS_RELEASE="Alpine Linux v3.14"

# Installed main dependencies:
# ca-certificates-bundle-20191127-r5 x86_64: for certificate management to support SSL
# openjdk11: OpenJDK built by Simon Frankenberger <simon@fraho.eu> from https://hg.openjdk.java.net/jdk-updates/jdk11u
# https://git.alpinelinux.org/aports/commit/?id=b85efc501595136485aea134946fa459bff115b0
# fontconfig-2.13.1-r4 x86_64 : For supporting UI/ Fonts for reporting purposes
# freetype-2.10.4-r1 x86_64: To support freetype fonts
# Tomcat: Java Runtime Container

# https://adoptopenjdk.net/installation.html#x64_linux-jre
# Set JRE_HOME not JAVA_HOME as we don't intend to run tomcat in debug mode
ENV JRE_HOME=/usr/lib/jvm/default-jvm/jre
COPY --from=stage-0 /usr/lib/jvm/default-jvm/jre/bin/jre ${JRE_HOME}
ENV PATH=${JRE_HOME}/bin:$PATH
#ENV JAVA_VERSION=11.0.11+9-alpine-r0

RUN set -eux;\
apk update \
&& apk upgrade \
# Now Add Support for cacerts
# https://hackernoon.com/alpine-docker-image-with-secured-communication-ssl-tls-go-restful-api-128eb6b54f1f
&& apk add --no-cache ca-certificates\

# Now Add Support for UI/Font configurations
# java.lang.UnsatisfiedLinkError: /usr/local/openjdk-11/lib/libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
# java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
\fontconfig freetype\

&& rm -rf /var/cache/apk/*

# COPY ./org-cacert-bundle.crt /usr/local/share/ca-certificates/mycert.crt
# COPY --from stage-0 /usr/local/share/ca-certificates /usr/local/share/ca-certificates
RUN set -eux;\
chmod 755 /usr/local/share/ca-certificates\
&& update-ca-certificates\
# Load Organisational fonts
&& mkdir -p /usr/share/fonts/default/TrueType
# COPY --from stage-0 /tmp/custom-fonts/ /usr/share/fonts/default/TrueType
151 changes: 151 additions & 0 deletions Dockerfile-tomcat-jre-17-curl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,151 @@
# docker build -t sathya1104/tomcat-custom:9.0.65.0-alpine-jre-17.0.0-r1 . -f Dockerfile-tomcat-jre-17-curl --no-cache
FROM alpine:latest AS stage-0
# Prefer openjdk11 over openjdk11-jre for jlink and we can use it remove more default modules and reduce image size
RUN set -eux;\
apk --no-cache --virtual add openjdk17 \
--repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing
WORKDIR /usr/lib/jvm/default-jvm/jre/bin/
RUN set -eux;\
./jlink --output jre --compress=2 --no-header-files --no-man-pages --module-path ../jmods --add-modules jdk.crypto.ec,java.desktop,jdk.aot,jdk.xml.dom,java.management,java.management.rmi,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.se,java.security.jgss,java.security.sasl,java.smartcardio,java.sql,java.sql.rowset,java.transaction.xa,java.xml,java.xml.crypto

FROM alpine:latest
MAINTAINER "Sathya KUMARASWAMY <sathya1104@gmail.com>"
ENV OS_RELEASE="Alpine Linux v3.15"

# Installed main dependencies:
# ca-certificates-bundle-20211220-r0 x86_64: for certificate management to support SSL
# openjdk8-jre: OpenJDK built by Timo Teräs <timo.teras@iki.fi> from https://icedtea.classpath.org/
# https://git.alpinelinux.org/aports/commit/?id=f10a27abc4a038853c5b0f74655a1ca75356c93a
# fontconfig-2.13.1-r4 x86_64 : For supporting UI/ Fonts for reporting purposes
# freetype-2.11.0-r0 x86_64: To support freetype fonts
# Tomcat: Java Runtime Container

# https://adoptopenjdk.net/installation.html#x64_linux-jre
# Set JRE_HOME not JAVA_HOME as we don't intend to run tomcat in debug mode
ENV JRE_HOME=/usr/lib/jvm/default-jvm/jre
COPY --from=stage-0 /usr/lib/jvm/default-jvm/jre/bin/jre ${JRE_HOME}
ENV PATH=${JRE_HOME}/bin:$PATH
ENV JAVA_VERSION=17.0.0+35-alpine-r1
COPY Dockerfile-tomcat-jre-17-curl /tmp

RUN set -eux;\
apk update \
&& apk upgrade \
# Now Add Support for cacerts
# https://hackernoon.com/alpine-docker-image-with-secured-communication-ssl-tls-go-restful-api-128eb6b54f1f
&& apk add --no-cache ca-certificates\

# Now Add Support for UI/Font configurations
# java.lang.UnsatisfiedLinkError: /usr/local/openjdk-11/lib/libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
# java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
\fontconfig freetype\

&& rm -rf /var/cache/apk/*

RUN apk add --update curl && \
apk add --update iputils && \
apk add --update netcat-openbsd && \
apk add --update tzdata && \
apk add --update openssl && \
apk add --update lcms2 && \
rm -rf /var/cache/apk/* && \
curl --version && \
ping -c4 localhost && \
nc -h

# COPY ./org-cacert-bundle.crt /usr/local/share/ca-certificates/mycert.crt
# COPY --from stage-0 /usr/local/share/ca-certificates /usr/local/share/ca-certificates
RUN set -eux;\
chmod 755 /usr/local/share/ca-certificates\
&& update-ca-certificates\
# Load Organisational fonts
&& mkdir -p /usr/share/fonts/default/TrueType
# COPY --from stage-0 /tmp/custom-fonts/ /usr/share/fonts/default/TrueType


# Inspired from https://github.com/docker-library/tomcat/blob/d570ad0cee10e4526bcbb03391b2c0e322b59313/9.0/jdk11/openjdk-slim/Dockerfile
ENV CATALINA_HOME /usr/local/tomcat
ENV PATH $CATALINA_HOME/bin:$PATH
RUN mkdir -p "$CATALINA_HOME"

WORKDIR $CATALINA_HOME

# let "Tomcat Native" live somewhere isolated
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR

# see https://www.apache.org/dist/tomcat/tomcat-$TOMCAT_MAJOR/KEYS
# see also "update.sh" (https://github.com/docker-library/tomcat/blob/master/update.sh)
ENV GPG_KEYS 48F8E69F6390C9F25CFEDCD268248959359E722B A9C5DF4D22E99998D9875A5110C01C5A2F6059E7

ENV TOMCAT_MAJOR 9
ENV TOMCAT_VERSION 9.0.58
ENV TOMCAT_DOWNLOAD_URL https://downloads.apache.org/tomcat/tomcat-${TOMCAT_MAJOR}/v${TOMCAT_VERSION}/bin/apache-tomcat-${TOMCAT_VERSION}.tar.gz
ENV TOMCAT_SHA512_URL https://downloads.apache.org/tomcat/tomcat-${TOMCAT_MAJOR}/v${TOMCAT_VERSION}/bin/apache-tomcat-${TOMCAT_VERSION}.tar.gz.sha512
# https://downloads.apache.org/tomcat/tomcat-${TOMCAT_MAJOR}/v${TOMCAT_VERSION}/bin/apache-tomcat-${TOMCAT_VERSION}.tar.gz.sha512
# ENV TOMCAT_SHA512 83430f24d42186ce2ff51eeef2f7a5517048f37d9050c45cac1e3dba8926d61a1f7f5aba122a34a11ac1dbdd3c1f6d98671841047df139394d43751263de57c3

# Install Tomcat
RUN set -eux;\
wget "$TOMCAT_DOWNLOAD_URL" -qO apache-tomcat-${TOMCAT_VERSION}.tar.gz\
&& wget -qO- "$TOMCAT_SHA512_URL" | sha512sum -c -\
&& mkdir -p /usr/local/tomcat\
&& tar -xf apache-tomcat-${TOMCAT_VERSION}.tar.gz --strip-components=1\
&& rm bin/*.bat\
&& rm apache-tomcat-${TOMCAT_VERSION}.tar.gz*\
&& rm -rf webapps\
&& mkdir webapps\
&& find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env sh|' '{}' + \
&& chmod -R +rX . \
&& chmod 777 logs temp work

#Create config and log folders
RUN mkdir -p ${CATALINA_HOME}/conf/ ${CATALINA_HOME}/logs/ ${CATALINA_HOME}/config/

# Copy Custom init scripts if required
# COPY bin/setenv.sh ${CATALINA_HOME}/bin/setenv.sh

# Remove default Tomcat installation files
RUN rm -rf ${CATALINA_HOME}/webapps/*
# COPY conf/context.xml $CATALINA_HOME/conf/context.xml
# COPY conf/server.xml $CATALINA_HOME/conf/server.xml
# COPY conf/web.xml $CATALINA_HOME/conf/web.xml
# COPY conf/logging.properties $CATALINA_HOME/conf/logging.properties
# Copy any additional organisational default files to override tomcat default config files

# User Management
# Add custom group tomcat with 61000 as a groupid to avoid conflicts with any existing groups
RUN addgroup -g 61000 tomcat

# Add custom user tomcat with same uid 61000 as gid to avoid conflict with exist user
# User with no home directory, no password, group as tomcat and username as tomcat
RUN adduser -H -D -G tomcat -u 61000 tomcat

# We put the tomcat user as the owner of the folder of tomcat to limit access to tomcat process on container resources
RUN set -eux;\
chown -R tomcat:tomcat /usr/local/tomcat\
# Users cannot modify configuration of tomcat
&& chmod -R g+r /usr/local/tomcat/conf\
# Users can modify the other folders
&& chmod -R g+w /usr/local/tomcat/logs\
&& chmod -R g+w /usr/local/tomcat/temp\
&& chmod -R g+w /usr/local/tomcat/webapps\
&& chmod -R g+w /usr/local/tomcat/work\
# Activate the sticky-bit for new files keep permissions defined:
&& chmod -R g+s /usr/local/tomcat/conf\
&& chmod -R g+s /usr/local/tomcat/logs\
&& chmod -R g+s /usr/local/tomcat/temp\
&& chmod -R g+s /usr/local/tomcat/webapps\
&& chmod -R g+s /usr/local/tomcat/work

# Set Execute permissions on init script
# RUN chown tomcat:tomcat ${CATALINA_HOME}/bin/setenv.sh
# RUN chmod 750 ${CATALINA_HOME}/bin/setenv.sh

# Set user as tocmat by uid to be compatible with kubernetes psp
USER 61000

EXPOSE 8080

CMD [ "catalina.sh", "run" ]
24 changes: 15 additions & 9 deletions Dockerfile-tomcat-jre-8-curl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,22 +1,22 @@
# docker build -t sathya/tomcat-custom:9.0.53.0-alpine-jre-1.8.0-302-08-r0 . -f Dockerfile-tomcat-jre-8-curl --no-cache
# docker build -t bnppwmis/tomcat-custom:9.0.65.0-alpine-jre-1.8.0-322-06-r0 . -f Dockerfile-tomcat-jre-8-curl --no-cache
FROM alpine:latest
MAINTAINER "Sathya KUMARASWAMY <sathya1104@gmail.com>"
ENV OS_RELEASE="Alpine Linux v3.14"
ENV OS_RELEASE="Alpine Linux v3.16"

# Installed main dependencies:
# ca-certificates-bundle-20191127-r5 x86_64: for certificate management to support SSL
# ca-certificates-20211220-r0 x86_64: for certificate management to support SSL
# openjdk8-jre: OpenJDK built by Timo Teräs <timo.teras@iki.fi> from https://icedtea.classpath.org/
# https://git.alpinelinux.org/aports/commit/?id=f10a27abc4a038853c5b0f74655a1ca75356c93a
# fontconfig-2.13.1-r4 x86_64 : For supporting UI/ Fonts for reporting purposes
# freetype-2.10.4-r1 x86_64: To support freetype fonts
# fontconfig-2.14.0-r0 x86_64 : For supporting UI/ Fonts for reporting purposes
# freetype-2.12.1-r0 x86_64: To support freetype fonts
# Tomcat: Java Runtime Container

# https://adoptopenjdk.net/installation.html#x64_linux-jre
# Set JRE_HOME not JAVA_HOME as we don't intend to run tomcat in debug mode
ENV JRE_HOME=/usr/lib/jvm/default-jvm/jre
RUN apk --no-cache --virtual add openjdk8-jre --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community
ENV PATH=${JRE_HOME}/bin:$PATH
ENV JAVA_VERSION=1.8.0_302-b08
ENV JAVA_VERSION=1.8.0_322-b06
RUN set -eux;\
apk update \
&& apk upgrade \
Expand All @@ -33,8 +33,14 @@ RUN set -eux;\
&& rm -rf /var/cache/apk/*

RUN apk add --update curl && \
apk add --update iputils && \
apk add --update netcat-openbsd && \
apk add --update tzdata && \
apk add --update openssl && \
rm -rf /var/cache/apk/* && \
curl --version
curl --version && \
ping -c4 localhost && \
nc -h

# COPY ./org-cacert-bundle.crt /usr/local/share/ca-certificates/mycert.crt
# COPY --from stage-0 /usr/local/share/ca-certificates /usr/local/share/ca-certificates
Expand Down Expand Up @@ -62,11 +68,11 @@ ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
ENV GPG_KEYS 48F8E69F6390C9F25CFEDCD268248959359E722B A9C5DF4D22E99998D9875A5110C01C5A2F6059E7 DCFD35E0BF8CA7344752DE8B6FB21E8933C60243

ENV TOMCAT_MAJOR 9
ENV TOMCAT_VERSION 9.0.53
ENV TOMCAT_VERSION 9.0.65
ENV TOMCAT_DOWNLOAD_URL https://downloads.apache.org/tomcat/tomcat-${TOMCAT_MAJOR}/v${TOMCAT_VERSION}/bin/apache-tomcat-${TOMCAT_VERSION}.tar.gz
ENV TOMCAT_SHA512_URL https://downloads.apache.org/tomcat/tomcat-${TOMCAT_MAJOR}/v${TOMCAT_VERSION}/bin/apache-tomcat-${TOMCAT_VERSION}.tar.gz.sha512
# https://downloads.apache.org/tomcat/tomcat-${TOMCAT_MAJOR}/v${TOMCAT_VERSION}/bin/apache-tomcat-${TOMCAT_VERSION}.tar.gz.sha512
# ENV TOMCAT_SHA512 df71834116f506b77cea9d9f8ac66ed65e74754e202df9f337f6559f81daf6490b0d569dd63f3eb46826b85ca899b79c754c2dd3d21927bed41d773c70253c4f
# ENV TOMCAT_SHA512 b6a707efcf23ac4d8506925146e0344c9f9b4e95c3a8fe56f3adfa9d7d912f0a0e458f6696d465607d2d531d7c0ef1afd5da206bb21bea47a13ae452d4f37f8e

# Install Tomcat
RUN set -eux;\
Expand Down
Loading