Apache TomEE on Ubuntu 24.04 on Azure User Guide

Overview

Apache TomEE is the Jakarta EE / Java EE application server from the Apache Tomcat project. The "plus" distribution this image ships bundles the full enterprise stack - JAX-RS, JPA, EJB, CDI, JMS, JSF, JTA and Bean Validation - on top of Tomcat 10.1, so you can run a complete Jakarta EE application without assembling the server yourself. The cloudimg image installs Apache TomEE 9.1.3 on OpenJDK 17, runs it as a systemd service bound to loopback behind an nginx reverse proxy on port 80, keeps application deployments, logs and work directories on a dedicated Azure data disk, and generates a unique Manager password on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

• Apache TomEE 9.1.3 "plus" (Tomcat 10.1 core, CATALINA_HOME=/opt/tomee) on OpenJDK 17
• The Tomcat/TomEE Manager (/manager) and host-manager (/host-manager) web consoles
• nginx on :80 as a reverse proxy to the loopback TomEE connector on 127.0.0.1:8080
• A per-VM admin account for the Manager, generated on first boot and recorded in a root-only file
• A dedicated Azure data disk at /var/lib/tomee (CATALINA_BASE) for app deployments, logs and work
• A small sample application deployed at /sample/ so the Manager shows a running app out of the box
• tomee.service + nginx.service as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a reasonable starting point; size up for heavier Jakarta EE workloads. NSG inbound: allow 22/tcp from your management network and 80/tcp. TomEE serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Apache TomEE by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name tomee \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name tomee --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active tomee.service nginx.service

Both report active. TomEE listens on the loopback connector 127.0.0.1:8080 and nginx fronts it on port 80. The application deployments, logs and work directories live on the dedicated Azure data disk mounted at /var/lib/tomee.

Step 5 - Retrieve your Manager password

The TomEE Manager admin password is generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/tomee-credentials.txt

This file contains TOMEE_ADMIN_USERNAME (admin) and TOMEE_ADMIN_PASSWORD, along with the Manager and host-manager URLs. Store the password somewhere safe.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/health

It returns ok. This endpoint never requires authentication, so it is safe for an Azure Load Balancer health probe.

Step 7 - Open the TomEE Manager

Browse to http://<vm-public-ip>/manager/html and sign in as admin with the password from Step 5. The Manager lists every deployed application and lets you start, stop, reload, undeploy and deploy WARs. The bundled /sample application is already running.

The Server Status page shows JVM memory, thread pools and connector activity.

The host-manager console at http://<vm-public-ip>/host-manager/html manages Tomcat virtual hosts.

The bundled sample application is served at http://<vm-public-ip>/sample/ and confirms the Java and server versions.

Step 8 - Verify Manager authentication from the command line

The Manager's text interface rejects a wrong password with 401 and accepts the per-VM admin password with 200. Read the password from the credentials file first, then call the Manager. Because the command embeds your unique password, run it interactively rather than from a script - substitute the value of TOMEE_ADMIN_PASSWORD from Step 5 for <TOMEE_ADMIN_PASSWORD>:

curl -s -u "admin:<TOMEE_ADMIN_PASSWORD>" http://localhost/manager/text/list

The response begins with OK - Listed applications for virtual host [localhost] and lists each context, including /sample:running:...:sample. A wrong password returns 401 Unauthorized.

Step 9 - Deploy your own application

You can deploy a WAR from the Manager UI (Deploy section -> WAR file to deploy), or drop it onto the data disk and let TomEE auto-deploy it:

sudo cp /path/to/myapp.war /var/lib/tomee/webapps/

Within a few seconds TomEE expands and starts the application; it then appears in the Manager list and is served at http://<vm-public-ip>/myapp/. The webapps directory lives on the dedicated data disk, so your deployments survive OS changes and can be resized independently.

Step 10 - Confirm app data lives on the dedicated disk

TomEE's CATALINA_BASE - the per-instance webapps, work, temp, logs and conf directories - is stored on the dedicated Azure data disk so it survives OS changes and can be resized independently:

findmnt /var/lib/tomee

The mount is backed by a separate Azure data disk captured into the image and re-provisioned on every VM.

Maintenance

• Manager users: add or rotate Manager users by editing /var/lib/tomee/conf/tomcat-users.xml and restarting tomee.service.
• Deployments: drop WARs into /var/lib/tomee/webapps or use the Manager; manage running apps from the Manager UI.
• Logs: TomEE logs are under /var/lib/tomee/logs (catalina.out, localhost_access_log, etc.) on the data disk.
• Tuning: edit JAVA_OPTS / CATALINA_OPTS in the tomee.service unit (/etc/systemd/system/tomee.service) to adjust heap size, then sudo systemctl daemon-reload && sudo systemctl restart tomee.
• TLS: TomEE serves plain HTTP on port 80; front it with TLS (e.g. certbot) and your own domain before production use.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.