Apache TomEE Jakarta EE Application Server

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

Apache TomEE is the Jakarta EE application server from the Apache Tomcat project. It takes the Tomcat servlet container everyone already knows and adds the full enterprise Java stack on top, so applications that need JPA persistence, EJB components, CDI injection, JAX-RS REST endpoints, JMS messaging, JSF, JTA transactions and Bean Validation run on a single lightweight server. This image delivers a fully configured, security hardened TomEE server, eliminating the connector hardening, reverse proxy setup, Manager console lockdown and credential provisioning that a bare install leaves to you. It ships the TomEE 10.2.0 plus distribution on OpenJDK 17.

## Why This Image Over Alternatives

A default TomEE or Tomcat install exposes its HTTP connector on every interface and ships a Manager console whose access depends entirely on an administrator remembering to edit tomcat-users.xml. This image inverts both defaults. The TomEE connector binds to loopback only and never listens on a public interface; nginx fronts port 80 as the sole public entry point. The Manager and host-manager consoles require HTTP Basic authentication and are further restricted by a RemoteAddrValve that accepts only the loopback proxy. No shared or default administrator password exists anywhere in the image - a unique one is generated on each instance's first boot. Application state lives on its own EBS volume rather than the OS disk.

## What Is Included

• Apache TomEE 10.2.0 plus - the full Jakarta EE 10 stack on Tomcat 10.1, installed from the official Apache release and sha512 verified
• OpenJDK 17 headless JVM with heap sizing applied through the service unit
• nginx reverse proxy on port 80 with an unauthenticated health endpoint for load balancer and monitoring checks
• Loopback only application connector so the server is never directly exposed
• Manager and host-manager consoles authenticated and restricted to the local proxy
• A deployed sample application so the Manager shows a running deployment immediately
• Dedicated data volume carrying CATALINA_BASE, your deployed applications and logs

## Secure First Boot

On first boot a one-shot service generates a cryptographically strong administrator password unique to that instance, writes it into the server's user realm, and records it in a file readable only by root. The captured image contains a roles-only user realm with no administrator account at all, so there is no window in which a known credential is valid.

## AWS Integration Points

• Amazon EBS - application deployments, configuration and logs live on a dedicated EBS volume; use EBS Snapshots for point in time backups or resize storage independently of the OS disk.
• Amazon VPC - deploy into the subnets and security groups you choose; only port 80 and SSH need to be reachable, and the application connector stays on loopback regardless.
• Elastic Load Balancing - the unauthenticated health endpoint served by nginx is designed to be used directly as an ELB or Auto Scaling health check target.

## Ready To Use

Connect over SSH, read the generated administrator password, then open the TomEE Manager in a browser to deploy your own WAR. Applications can equally be deployed by dropping a WAR into the webapps directory on the data volume. The bundled sample application demonstrates a working deployment and can be undeployed once you no longer need it.

## Use Cases

• Running Jakarta EE applications - host applications that need JPA, EJB, CDI, JMS and JAX-RS without assembling and maintaining the stack yourself.
• Migrating Java EE workloads to AWS - move existing enterprise Java applications onto a supported, current Jakarta EE 10 runtime on EC2.
• REST and microservice back ends - serve JAX-RS APIs from a lightweight server that starts fast and stays small.

## cloudimg Support

24/7 technical support by email and live chat. Our engineers assist with deployment, TomEE and Tomcat configuration, application deployment troubleshooting, JVM and heap tuning, and reverse proxy and TLS setup.

To discuss your architecture, contact our team through the support channels listed below.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.