pdbs/glassfish8 repository overview

⁠Glassfish 8

⁠Important

The container removes osgi-cache automatically during an upgrade. To delete the cache on purpose, remove the file 'version' in domain1 directory.

If glassfish does not start after pull of a new image you need to backup your domain1 directory, remove it and restart glassfish container to create a fresh domain1 directory. To debug the startup process, start a container with

--entrypoint=/bin/bash

and start glassfish with verbose option:

/opt/glassfish/bin/asadmin -v

⁠Start Service

docker service create --name $serviceName \
--publish 4848:4848 \
--mount type=bind,source=/$basedir/domains,target=/opt/glassfish/glassfish/domains \
--secret $secretName \
--env PKCSALIAS=$fqdn \
--env KRB_PRINCIPAL=$krbServicePrincipalName \
--env HOSTNAME=$fqdn \
pdbs/glassfish8

Environment variable defaults:

GF_ADMINPASSWORD  = adminadmin
GF_MASTERPASSWORD = changeit

When run as a service, GF_ADMINPASSWORD can be set as variables in a secret file which will be sourced on startup. The name of the secret does not matter - all defined secrets will be sourced.

When not using secrets you can specify passwords on startup:

--env GF_ADMINPASSWORD=changeme

⁠CA import

certificate file import dir: /$basedir/domains/cacerts/

PEM encoded CA certificates can be placed in this directory and will be imported during the start of the glassfish service. Successfully imported certificate files are deleted

⁠Server SSL Certificate

A P12 file /opt/glassfish/domains/server.p12 is automatically imported as alias s1as in keystore.p12 (private key) and cacerts.p12 (public key). The keystore password for server.p12 must be "changeit", the private and public key's aliases "s1as". The file must be owned by uid 1000 and is deleted after the import.

To create server.p12 from an existing p12/pfx file use:

keytool -importkeystore \
-srckeystore <path to p12 file> \
-srcstoretype PKCS12 \
-srcstorepass <password of p12 file> \
-srcalias <alias in p12 file> \
-destkeystore server.p12 \
-deststoretype PKCS12 \
-deststorepass changeit \
-destkeypass changeit \
-destalias s1as

If you are running Glassfish behind Traefik, SSL configuration is not necessary unless you want use your certificate on the admin console (port 4848).