pdbs/glassfish7 repository overview

⁠Glassfish 7

⁠Important

If glassfish7 does not start after pull of a new image, delete (or move) directories 'generated' and 'osgi-cache' from /domains/domain1. Since 7.0.9 the container removes osgi-cache automatically on update. To delete the cache on purpose, remove the file 'version' in domain1 directory.

If glassfish7 still does not start after pull of a new image you need to backup your domain1 directory, remove it and restart glassfish7 container to create a fresh domain1 directory. To debug the startup process, start a container with

--entrypoint=/bin/bash

and start glassfish with verbose option:

/opt/glassfish/bin/asadmin -v

Glassfish 7 releases come with an empty cacerts.jks file so be sure to import required CA certificates into cacerts.jks using GF_MASTERPASSWORD as storepass.

⁠Certbot

From Release 7.0.11 pdbs/glassfish7 includes certbot & /usr/bin/acme-dns-auth.py from https://github.com/joohoi/acme-dns-certbot-joohoi⁠. Documentation is on the correxponding website. The script /usr/bin/replace-cert.sh is triggered through /etc/letsencrypt/renewal-hooks/deploy/ upon certificate renewal. Certbot checks for certificate renewal can be triggered from outside the container using i.e. pdbs/docker-service-exec or pdbs/docker-swarm-cron.

⁠Start Service

docker service create --name $serviceName \
--label 'traefik.port=8080' \
--label 'traefik.frontend.rule=Host:$fqdn' \
--network $networkName \
--publish 4848:4848 \
--mount type=bind,source=/$basedir/domains,target=/opt/glassfish/glassfish/domains \
--secret $secretName \
--env PKCSALIAS=$fqdn \
--env KRB_PRINCIPAL=$krbServicePrincipalName \
--env HOSTNAME=$fqdn \
pdbs/glassfish7

Environment variable defaults:

GF_ADMINPASSWORD = adminadmin GF_MASTERPASSWORD = changeit PKCSALIAS = localhost HOSTNAME = localhost KRB_PRINCIPAL = (empty)

When run as a service, GF_ADMINPASSWORD and GF_MASTERPASSWORD can be set as variables in a secret file which will be sourced on startup. The name of the secret does not matter - all defined secrets will be sourced.

When not using secrets you can specify passwords on startup:

--env GF_ADMINPASSWORD=changeme --env GF_MASTERPASSWORD=changeme

⁠Initital CA import

certificate file import dir: /$basedir/domains/certs/

CA certificates can be placed in this directory and will be imported during first start of the service

⁠Server SSL Certificate

SSL Certificate for server is imported during first start of service if the server.p12 file has the same password as GF_MASTERPASSWORD.

P12 file: /$basedir/domains/server.p12 storepass = GF_MASTERPASSWORD alias = PKCSALIAS

If you are running Glassfish behind Traefik, SSL configuration is not necessary unless you want use your certificate on the admin console (port 4848).

When using self signed certificates, place CA certificate in /$basedir/domains/certs/

⁠Initial Kerberos Configuration

Place the configuration files in the following locations before first run:

krb5.conf: /BASEDIR/domains/krb5.conf keytab: /BASEDIR/domains/server.keytab

Service principal name will be set in login.conf using environment variable KRB_PRINCIPAL