pdbs/glassfish repository overview

⁠Start Service

docker service create --name $serviceName \
  --network $networkName \
  --publish 4848:4848 \
  --mount type=bind,source=/$basedir/domains,target=/opt/glassfish/glassfish/domains \
  --secret $secretName \
  --env PKCSALIAS=$fqdn \
  --env KRB_PRINCIPAL=$krbServicePrincipalName \
  --env HOSTNAME=$fqdn \
pdbs/glassfish

environment variable defaults:
GF_ADMINPASSWORD = adminadmin
GF_MASTERPASSWORD = changeit
PKCSALIAS = localhost
HOSTNAME = localhost
KRB_PRINCIPAL = (empty)

When run as a service, GF_ADMINPASSWORD and GF_MASTERPASSWORD can be set as variables in a secret file which will be sourced on startup. The name of the secret does not matter - all defined secrets will be sourced.

When not using secrets you can specify passwords on startup:

--env GF_ADMINPASSWORD=$gfAdminPassword
--env GF_MASTERPASSWORD=$gfMasterPassword

⁠Initital CA import

certificate file import dir: /$basedir/domains/certs/

CA-Certificates can be places in this directory and will be imported during first start of service

⁠Server SSL Certificate

SSL Certificate for server is imported during first start of service if the server.p12 file has the same password as GF_MASTERPASSWORD.

P12 file: /$basedir/domains/server.p12
storepass = GF_MASTERPASSWORD
alias = PKCSALIAS

If you are running Glassfish behind Traefik, SSL configuration is not necessary unless you want use your certificate on the admin console (port 4848).
When using self signed certificates, place CA certificate in /$basedir/domains/certs/

⁠Initial Kerberos Configuration

Place the configuration files in the following locations before first run:

krb5.conf: /$basedir/domains/krb5.conf
keytab: /$basedir/domains/server.keytab

Service principal name will be set in login.conf using environment variable KRB_PRINCIPAL