Custom Tomcat Docker Image

Production-ready custom Apache Tomcat Docker image with hot-deploy support, JVM tuning, security hardening, and health checks — designed for modern CI/CD pipelines and containerized Java (Jakarta EE) applications.

---

✨ Features

• ✅ Apache Tomcat (11.x compatible)
• 🔁 WAR hot-swap / hot-deploy (no image rebuild required)
• ⚙️ JVM tuning via environment variables
• 🔐 Security-hardened container configuration
• 📊 Built-in Docker healthcheck
• 📦 Externalized logs
• 🐳 Docker & Docker Compose ready
• 📜 MIT License

---

📦 Project Structure

.
├── Dockerfile
├── docker-compose.yml
├── deploy/          # WAR files mounted here (hot deployment)
├── logs/            # Tomcat logs (externalized)
└── README.md

---

🚀 Quick Start

Build the image

docker build -t custom-tomcat .

Run with Docker Compose (recommended)

docker compose up -d

---

🔁 Hot Deployment (WAR Hot-Swap)

Deploy or update your application by copying a WAR file:

cp my-app.war deploy/

Tomcat will automatically detect the change and redeploy the application without restarting the container.

---

🌍 Application Access

Once running, the application is available at:

http://localhost:8080/

---

⚙️ JVM Configuration

JVM options can be customized using CATALINA_OPTS:

CATALINA_OPTS="-Xms512m -Xmx1024m -Djava.security.egd=file:/dev/./urandom"

Recommended options:

• -Xms / -Xmx – heap sizing
• -XX:+UseG1GC – garbage collector
• -Dfile.encoding=UTF-8

---

🔐 Security Hardening

This image follows container security best practices:

• no-new-privileges:true
• Logs and webapps mounted as external volumes
• Optional read-only root filesystem
• Tomcat manager, host-manager and examples removed

For maximum security, enable read_only: true after mounting all required writable paths.

---

🩺 Health Check

Container health status:

docker inspect --format='{{.State.Health.Status}}' production_tomcat

Health endpoint:

GET /

---

📊 Logs

Tomcat logs are persisted on the host:

./logs → /usr/local/tomcat/logs

This allows easy auditing and integration with external logging systems (e.g. Loki, ELK).

---

🧩 CI/CD Usage

Typical pipeline flow:

1. Build WAR artifact
2. Copy WAR to deploy/
3. Tomcat auto-redeploys the application

No container rebuild required.

---

🛠️ Requirements

• Docker 24+
• Docker Compose v2+
• Java application packaged as WAR

---

📄 License

MIT License

Copyright (c) 2025

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software.