Sign inSign up

onaci/tomcat-base

By onaci

•Updated 5 months ago

Tomcat server base image derived from unidata/tomcat-docker with some extra enhancements

Image
0

732

onaci/tomcat-base repository overview

⁠onaci/tomcat-base

The files in this repository define a set of docker images which are derived from a variety of base images involving Apache Tomcat, with some common, additional hardening to make the images suitable for use in production.

 

⁠Enhancements

Our additions extend the base image(s) to also:

  • Use container-level environment variables to configure the Tomcat connector properties, CORs filter properties and Access Logging. Use default-connector settings that assume the container is deployed behind a reverse proxy that is handling SSL termination
  • Use Log4J for tomcat server logging, so that the tomcat server log configuration and tomcat-hosted web application logging can all be controlled by the same configuration file.
  • Write all tomcat server and application logs to standard output by default (with no logfiles created inside the container and needing rotation).
  • Write all tomcat access log messages to standard output by default
  • Optionally suppress access logging completely (for cases where that's handled by an upstream reverse proxy server)

 

⁠Environment variables

Images which are built from the dockerfiles in this repository can use the following environment variables to control the tomcat server configuration in addition to the ones defined on their base images

VariablePurposeDefault Value
ACCESS_LOGGING_ENABLEDwhether this container should log access requests.true to log access requests to stdout. Set this to false to suppress access logs by directing them to /dev/null (e.g. if that's handled by a reverse proxy webserver).
CONNECTOR_COMPRESSIBLE_MIME_TYPECSV list of MIME types for which HTTP compression may be usedtext/html,text/xml,text/plain,text/css,text/javascript,application/javascript,application/json,application/octet-stream,application/xml
CONNECTOR_COMPRESSIONWhether compression of responses is on or offon
CONNECTOR_COMPRESSION_MIN_SIZEThe minimum amount of data in a response before that response is compressed2048
CONNECTOR_CONNECTION_TIMEOUTThe number of milliseconds the tomcat connector will wait after accepting a connection, for the request URI line to be presented20000
CONNECTOR_MAX_THREADSThe maximum number of request processing threads to be created (simultaneous requests to be handled) by the tomcat connector50
CONNECTOR_PROXY_NAMEThe server name to be returned for calls to request.getServerName()localhost
CONNECTOR_PROXY_PORTThe server port to be returned for calls to request.getServerPort()443
CONNECTOR_PROXY_SCHEMEThe name of the protocol that should be returned by calls to request.getScheme()https
CONNECTOR_PROXY_SECUREWhether the connector is behind a reverse-proxy server that is handling SSL terminationtrue
CONNECTOR_RELAXED_PATH_CHARSList of characters that are usually %nnn encoded in URI paths but will also be handled unencoded(empty string)
CONNECTOR_RELAXED_QUERY_CHARSList of characters that are usually %nnn encoded in QueryStrings but will also be handled unencoded(empty string)
CONNECTOR_SERVEROverride value for the server header set by a web application (used to obscure that)`Apache
CORS_ALLOWED_ORIGINSA list of origins that are allowed to access the hosted web applications* => all origins
CORS_ALLOWED_METHODSA CSV list of HTTP methods that are allowed to access the hosted web applicationsGET,POST,HEAD,OPTIONS,PUT
CORS_ALLOWED_HEADERSA CSV list of headers that can be used when making a request and in pre-flight responsesAuthorization,Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers
CORS_EXPOSED_HEADERSA CSV list of custom headers that browsers are allowed to access in a response(empty string)
CORS_PREFLIGHT_MAXAGEThe amount of seconds a browser is allowed to cache the result of a CORS pre-flight request10
CORS_SUPPORT_CREDENTIALSWhether user credentials can be included as part of a request. If true, `CORS_ALLOWED_ORIGINS`` must NOT be a wildcardfalse
REMOTE_IP_TRUSTED_PROXIESThe IP addresses of upstream reverse proxy servers for which the X-FORWARDED-FOR header can be safely interpreted as the IP address of the actual end-user and dereferenced in access logs.(empty string)

⁠Docker Images

⁠tomcat-base

The default Dockerfile⁠ creates a container derived directly from the hardened unidata/tomcat-docker⁠ base image.

Images built using this dockerfile can be obtained from onaci/tomcat-base⁠ with tags that are a subset of the tags available on the base image.

For containers that use this image, .war files can be mounted below /usr/local/tomcat/webapps/ at runtime.

 

⁠thredds-base

The alternate Dockerfile.thredds-base⁠ derives an enhanced THREDDS Data Server image from the unidata/thredds-docker⁠ base image.

Images built using this dockerfile can be obtained from onaci/thredds-base⁠ with tags that are a subset of the tags available on the base image.

For containers that use this image, you should:

  • Install your THREDDS configuration files below /usr/local/tomcat/content/thredds
  • Mount a fast local volume to be used as the THREDDS cache to /usr/local/tomcat/content/thredds/cache
  • Mount a fast local volume to be used as the JavaUtilPrefs cache at /usr/local/tomcat/javaUtilPrefs
  • Mount your data storages readonly to whichever absolute path your THREDDS configuration expects to find them at
  • Set the TOMCAT_USER_ID and TOMCAT_GROUP_ID to the UID and GID of a user account with permission to access your data storages
  • Set the THREDDS_XMX_SIZE and THREDDS_XMS_SIZE to appropriate memory limits for your hosting environment
  • Remember to cite the Unidata THREDDS Data Server DOI⁠

Tag summary

Content type

Image

Digest

sha256:66020cc32…

Size

206.4 MB

Last updated

5 months ago

docker pull onaci/tomcat-base:main_v2026-04-22T13-24-29-5d534da8440dedeff2c2f04e1aa096ab35553c93