Apache Tomcat 9

• Introduction
• Setup
• Packaging and Building
• Native image configuration
• Building the native image
• Compatibility

Tomcat supports using the GraalVM Native Image tool to produce a native binary including the container. This documentation page describes the build process of such an image.

The native image tool is much easier to use with single JARs, as a result the process will use the Maven shade plugin JAR packaging (fat JAR). The idea is to produce a single JAR that contains all necessary classes from Tomcat, the webapps and all additional dependencies. Although Tomcat has received compatibility fixes to support GraalVM native images, any library may not be compatible and may require replacement code (the GraalVM documentation has more details about this).

Download and install GraalVM. The first step is then to add the native-image tool.

export JAVA_HOME=/absolute...path...to/graalvm-ce-x.y.z
cd $JAVA_HOME/bin
./gu install native-image

export TOMCAT_MAVEN=/absolute...path...to/tomcat-maven

Inside the tomcat-maven folder, the directory structure is the same as for regular Tomcat. The main configuration files are placed in the conf folder, and if using the default server.xml the webapps are placed in the webapps folder.

The first step is to build the fat Tomcat JAR with all dependencies. Any JSP in the webapp must all be precompiled and packaged.

cd $TOMCAT_MAVEN
mvn package
ant -Dwebapp.name=somewebapp -f graal-webapp.ant.xml

mvn package

Native images do not support any form of dynamic classloading or reflection unless it is defined explicitly in descriptors. Generating them uses a tracing agent from the GraalVM, and needs additional manual configuration in some cases.

Run the GraalVM substrate VM using the trace agent:

$JAVA_HOME/bin/java\
        -agentlib:native-image-agent=trace-output=$TOMCAT_MAVEN/target/trace-file.json\
        -Dcatalina.base=. -Djava.util.logging.config.file=conf/logging.properties\
        -jar target/tomcat-maven-1.0.jar

Now all paths from the webapp that lead to dynamic classloading (ex: Servlet access, websockets, etc) need to be accessed using a script that will exercise the webapp. Servlets may be loaded on startup instead of needing an actual access. Listeners may also be used to load additional classes on startup.

Once that is done, the VM may be shut down. The descriptors can now be generated from the trace file.

$JAVA_HOME/bin/native-image-configure generate\
        --trace-input=$TOMCAT_MAVEN/target/trace-file.json\
        --output-dir=$TOMCAT_MAVEN/target

If everything has been done properly, the native image can now be built using the native-image tool.

$JAVA_HOME/bin/native-image --no-server\
        --allow-incomplete-classpath --enable-https\
        --initialize-at-build-time=org.eclipse.jdt,org.apache.el.parser.SimpleNode,javax.servlet.jsp.JspFactory,org.apache.jasper.servlet.JasperInitializer,org.apache.jasper.runtime.JspFactoryImpl\
        -H:+JNI -H:+ReportUnsupportedElementsAtRuntime\
        -H:+ReportExceptionStackTraces -H:EnableURLProtocols=http,https,jar\
        -H:ConfigurationFileDirectories=$TOMCAT_MAVEN/target/\
        -H:ReflectionConfigurationFiles=$TOMCAT_MAVEN/tomcat-reflection.json\
        -H:ResourceConfigurationFiles=$TOMCAT_MAVEN/tomcat-resource.json\
        -H:JNIConfigurationFiles=$TOMCAT_MAVEN/tomcat-jni.json\
        -jar $TOMCAT_MAVEN/target/tomcat-maven-1.0.jar

Running the native image is then:

./tomcat-maven-1.0 -Djava.library.path=$JAVA_HOME/jre/lib/amd64\
        -Dcatalina.base=. -Djava.util.logging.config.file=conf/logging.properties

Servlets, JSPs, EL, websockets, the Tomcat container, tomcat-native, HTTP/2 are all supported out of the box in a native image.

At the time of writing this documentation, JULI is not supported as the log manager configuration property is not supported by Graal, in addition to some static initializer problems, and the regular java.util.logging loggers and implementation should be used instead.

If using the default server.xml file, some Server listeners have to be removed from the configuration as they are not compatible with native images, such as a JMX listener (JMX is unsupported) and leak prevention listeners (use of internal code that does not exist in Graal).

Missing items for better Tomcat functionality:

• Java 11: ALPN for TLS, TLS 1.3, etc
• BeanInfo support: BeanInfo use in JSP taglibs must be configured manually in descriptors
• Java serialization: Clustering, session persistence
• Static linking configuration: JSSE elliptic curve support, tomcat-native support when creating an image with static linking
• JMX: Tomcat monitoring and management