Uploaded image for project: 'Nuxeo Platform'
  1. Nuxeo Platform
  2. NXP-29269

Add Tomcat Native + OpenSSL Library to Docker 10.10+ Image

    XMLWordPrintable

    Details

    • Type: Improvement
    • Status: Open
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: 10.10
    • Fix Version/s: 10.10, 11.x
    • Component/s: Docker Image

      Description

      According to https://medium.com/@crueda/tomcat-native-openssl-in-spring-boot-2-0-a341ad07471d, the most performant way to deploy an SSL-enabled Tomcat instance on openjdk 8 is to configure Tomcat Native + OpenSSL. This configuration leverages JSSE w/OpenSSL and uses only OpenSSL for native code (no native socket, poller etc).

      As noted in the above article, "...NGINX has its strengths and is an excellent option for services that are publicly exposed, but isn’t the best option when dealing with internal TLS termination." A use case that requires Nuxeo internal TLS termination is when a ETL service securely communicates with a Nuxeo Importer deployment all within a single K8s cluster.

      Nuxeo should include the tcnative library in the Nuxeo Docker 10.10+ Image to give users the option to TLS-enable their Nuxeo embedded Tomcat instance via the Tomcat Native + OpenSSL library.

      See https://github.com/docker-library/tomcat/blob/master/9.0/jdk8/openjdk/Dockerfile#L72-L97 for the recipe to include the tcnative library in a Tomcat 9 Docker image.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                hbrown Harlan Brown
                Participants:
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated: