Public Repository

Last pushed: 7 months ago
Short Description
Apache Hadoop 2.7.1 Docker image with Kerberos enabled
Full Description

Apache Hadoop 2.7.1 Docker image with Kerberos enabled

This project is a fork from sequenceiq hadoop-docker
and extends it with Kerberos enabled. With docker-compose 2 containers get
created, one with MIT KDC installed and one with a single node kerberized
Hadoop cluster.

The Docker image is also available on Docker Hub.


  • JDK8
  • Hadoop 2.7.1
  • Maven 3.5.0

Default Environment Variables

Name Value Description
KRB_REALM EXAMPLE.COM The Kerberos Realm, more information here
DOMAIN_REALM The Kerberos Domain Realm, more information here
KERBEROS_ADMIN admin/admin The KDC admin user
KERBEROS_ADMIN_PASSWORD admin The KDC admin password
KERBEROS_ROOT_USER_PASSWORD password The password of the Kerberos principal root which maps to the OS root user

You can simply define these variables in the docker-compose.yml.

Run image

Clone the Github project and run

docker-compose up -d


Get the container name with docker ps and login to the container with

docker exec -it <container-name> /bin/bash

To obtain a Kerberos ticket, execute


where you will get prompted to enter your password. Afterwards you can use hdfs CLI like

hdfs dfs -ls /

Known issues

Unable to obtain Kerberos password


docker-compose up fails for the first time with the error

Login failure for nn/ from keytab /etc/security/keytabs/nn.service.keytab: Unable to obtain password from user


Stop the containers with docker-compose down and start again with docker-compose up -d.


Make sure you use download a JDK version that is still available. Old versions can be deprecated by Oracle and thus the download link won't be able anymore.

Get the latest JDK8 Download URL with

curl -s

Java Keystore

If the Keystroe has been expired, then create a new keystore.jks:

  1. create private key
openssl genrsa -des3 -out server.key 1024
  1. create csr
openssl req -new -key server.key -out server.csr`
  1. remove passphrase in key

    cp server.key
    openssl rsa -in -out server.key
  2. create self-signed cert

    openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
  3. create JKS and import certificate

    keytool -import -keystore keystore.jks -alias CARoot -file server.crt`
Docker Pull Command