Catalog / API gateways & app servers

Apache TomEE

Jakarta EE full-profile application server built on Tomcat

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

Azure Marketplace10.2.0↗
Availability and pricing
CloudVersionSoftware priceLast build
Azure Marketplace
VM image · plan payg-gen2 · Gen2
10.2.0$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-08-07Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseApache-2.0
UpstreamApache Software Foundation
Machine-readableproduct.json · catalog.json
What is Apache TomEE

Apache TomEE is the Apache Software Foundation's Jakarta EE application server: Apache Tomcat at its core, with the enterprise APIs assembled on top that Tomcat alone does not provide. It implements the Jakarta EE 10 specifications - Enterprise Beans for transactional business logic, Contexts and Dependency Injection for wiring, Persistence for object-relational mapping, RESTful and SOAP Web Services, Messaging, Faces for server-side UI, and Bean Validation. Applications deploy as ordinary WAR or EAR archives. This image ships the official Plume distribution (the full profile, built on EclipseLink for Persistence and Mojarra for Faces), verified against the upstream SHA-512 checksum and running on OpenJDK 17 as a non-root service. One JVM process, no external database, cache tier or container runtime. Apache-2.0 license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • HTTP connector bound to 127.0.0.1:8080 (loopback only); nginx terminates TLS on port 443 and reverse-proxies to it - port 8080 is never exposed
  • Manager and Host-Manager webapps are never reachable from the internet: nginx returns 403 at the perimeter, and TomEE additionally restricts them to localhost connections
  • Manager admin password generated uniquely at first launch, written to /root/tomee-credentials.txt (mode 600) - nothing is baked into the image
  • Only the required listeners are enabled - the AJP connector and the secondary HTTPS connector remain disabled
  • The bundled message broker binds no TCP listener until an application configures one
  • Runs as a non-root tomee system user with UMask 0027
  • JVM heap (-Xms/-Xmx) sized from the instance RAM at first launch
  • UFW firewall pre-configured (only ports 22, 80 and 443 open; 80 serves the HTTPS redirect and certificate renewal)
  • certbot pre-installed - one command swaps the self-signed certificate for a CA-signed one
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
  • Jakarta EE verification application at /usr/share/lynxroute/tomee-sample.war - shipped but not deployed, so you can confirm the enterprise stack works on your own instance in one command
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/tomee-credentials.txt.

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer tomee --plan payg-gen2
az vm create -g my-rg -n tomee --size Standard_D2s_v3 \
  --image lynxroute:tomee:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Apache TomEE 10.2.0 - Initial release (August 2026)

Azure · 2026-08-07
  • Apache TomEE 10.2.0 Plume on Ubuntu 24.04 LTS (OpenJDK 17, full Jakarta EE 10 profile)
  • CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
  • CVE-scanned before every release
  • HTTP connector bound to 127.0.0.1:8080; nginx terminates TLS on port 443
  • Manager / Host-Manager never exposed on the public perimeter; admin password generated at first launch
  • Only the required listeners enabled; the bundled message broker opens no TCP port by default
  • Runs as a non-root tomee user (UMask 0027); JVM heap sized from the instance RAM at first launch
  • Jakarta EE verification application included at /usr/share/lynxroute/tomee-sample.war (not deployed)
  • certbot pre-installed for CA-signed TLS certificates
  • UFW firewall pre-configured (ports 22, 80, 443 only)
  • fail2ban, auditd, AppArmor pre-configured
  • SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
  • CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
  • IMDSv2 enforced