Tomcat 11

Search the Marketplace for Tomcat 11, select the SecureAnyCloud publisher and click Create.

Add NSG rules that allow TCP 22 (admin) and TCP 8080 (HTTP) from your client networks. Do not expose 8080 to the public internet. Instead, front Tomcat with a reverse proxy that terminates TLS. SecureAnyCloud ships nginx-ssl-certbot-ubuntu-24-04 as a one-step option.

RG="tomcat-prod"; LOCATION="eastus"; VM_NAME="tomcat-01" IMAGE_URN="sac1647283583153:tomcat-11-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name tomcat-vnet --address-prefix 10.100.0.0/16 --subnet-name tomcat-subnet --subnet-prefix 10.100.1.0/24 az network nsg create -g "$RG" --name tomcat-nsg az network nsg rule create -g "$RG" --nsg-name tomcat-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name tomcat-nsg --name allow-http --priority 110 \
  --source-address-prefixes 10.100.0.0/16 --destination-port-ranges 8080 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:tomcat-11-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name tomcat-vnet --subnet tomcat-subnet --nsg tomcat-nsg --public-ip-sku Standard

ssh azureuser@<vm-ip>

Both tomcat.service and tomcat-firstboot.service run automatically.

sudo systemctl status tomcat.service --no-pager sudo test -f /var/lib/sac/data/tomcat-firstboot.done && echo FIRSTBOOT_DONE
sudo ss -tln | grep -E ':(8080|8005)'

sudo cat /stage/scripts/tomcat-credentials.log

The file contains:

TOMCAT_MANAGER_USER=manager TOMCAT_MANAGER_PASSWORD=<TOMCAT_MANAGER_PASSWORD> TOMCAT_ADMIN_USER=admin TOMCAT_ADMIN_PASSWORD=<TOMCAT_ADMIN_PASSWORD> HTTP_PORT=8080 CATALINA_HOME=/opt/tomcat

MGR_PASS=$(sudo grep '^TOMCAT_MANAGER_PASSWORD=' /stage/scripts/tomcat-credentials.log | cut -d= -f2-)
# List all deployed apps curl -fsS -u "manager:${MGR_PASS}" http://localhost:8080/manager/text/list
# Server info — version, JVM, OS curl -fsS -u "manager:${MGR_PASS}" http://localhost:8080/manager/text/serverinfo
# Deploy a WAR file curl -fsS -u "manager:${MGR_PASS}" \
  -T /tmp/myapp.war \
  "http://localhost:8080/manager/text/deploy?path=/myapp&update=true"
# Undeploy curl -fsS -u "manager:${MGR_PASS}" \
  "http://localhost:8080/manager/text/undeploy?path=/myapp"

From your workstation, with the NSG allowing TCP 8080, run:

open http://<vm-ip>:8080/

The Tomcat default landing page confirms the install:

Navigate to http://<vm-ip>:8080/manager/html. Your browser prompts for HTTP Basic credentials. Enter manager as the user and the <TOMCAT_MANAGER_PASSWORD> value from /stage/scripts/tomcat-credentials.log as the password.

The Manager dashboard lists all deployed web apps (ROOT, manager, host-manager, examples and docs by default). It provides start, stop, reload and undeploy controls and a WAR upload form:

The /manager/status page shows JVM memory usage, all configured connectors, request stats and per-thread state. It is useful for production monitoring:

Copy a .war file into /opt/tomcat/webapps/. Tomcat deploys it automatically with no restart. Alternatively, use the Manager web upload at /manager/html:

# Build your WAR (locally) mvn package -DskipTests
# Copy to the VM scp target/myapp.war azureuser@<vm-ip>:/tmp/
# Deploy via Manager API ssh azureuser@<vm-ip>
MGR_PASS=$(sudo grep '^TOMCAT_MANAGER_PASSWORD=' /stage/scripts/tomcat-credentials.log | cut -d= -f2-)
curl -fsS -u "manager:${MGR_PASS}" \
  -T /tmp/myapp.war \
  "http://localhost:8080/manager/text/deploy?path=/myapp&update=true"
# Visit http://<vm-ip>:8080/myapp/

Component Path

CATALINA_HOME /opt/tomcat

startup.sh / shutdown.sh /opt/tomcat/bin/

Server config /opt/tomcat/conf/server.xml

Default web.xml /opt/tomcat/conf/web.xml

User database /opt/tomcat/conf/tomcat-users.xml

Web apps /opt/tomcat/webapps/

Logs /opt/tomcat/logs/ (catalina.out, localhost_access_log)

Systemd unit /etc/systemd/system/tomcat.service

First-boot script /usr/local/sbin/tomcat-firstboot.sh

First-boot service /etc/systemd/system/tomcat-firstboot.service

Credentials file /stage/scripts/tomcat-credentials.log (mode 0600)

First-boot sentinel /var/lib/sac/data/tomcat-firstboot.done

Only the tomcat user can read /opt/tomcat/bin, so run version.sh as that user:

sudo -u tomcat /opt/tomcat/bin/version.sh

sudo systemctl status tomcat.service --no-pager sudo systemctl restart tomcat.service
sudo tail -f /opt/tomcat/logs/catalina.out
sudo tail -f /opt/tomcat/logs/localhost_access_log.$(date +%Y-%m-%d).txt

• Rotate the manager and admin passwords by editing /opt/tomcat/conf/tomcat-users.xml and restarting Tomcat.
• Restrict the NSG so that 8080 is reachable only from your client networks, never from the public internet.
• Front Tomcat with a TLS reverse proxy (nginx, Apache or SecureAnyCloud's nginx-ssl-certbot-ubuntu-24-04). Never expose 8080 directly with HTTP Basic authentication.
• Tighten the RemoteAddrValve allowlist in /opt/tomcat/webapps/manager/META-INF/context.xml to only your admin CIDRs.
• Disable or remove unused web apps in /opt/tomcat/webapps/ (examples and docs) for production.
• Run Tomcat as a non-privileged user. The image already does this with the tomcat:tomcat system user.
• Enable JMX over an SSH tunnel for monitoring. Do not expose JMX RMI to the network.
• Patch the OS monthly with apt-get update && apt-get upgrade && reboot.

Apache Tomcat is licensed under the Apache License 2.0. There is no per-CPU or per-deployment fee.

SecureAnyCloud provides commercial support for this image separately from the upstream project.

• Email: sales@secureanycloud.com

• Website: secureanycloud.com

• Support hours: 24/7 with guaranteed 24 hour response SLA

Deploy on Azure

Launch Apache Tomcat 11 on Ubuntu 24.04 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Launch Apache Tomcat 11 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com