{
 "slug": "tomee",
 "name": "Apache TomEE",
 "tagline": "Jakarta EE full-profile application server built on Tomcat",
 "category": "api-app-server",
 "use_cases": [
  "jakarta-ee",
  "java-ee",
  "enterprise-java"
 ],
 "aliases": [
  "apache tomee"
 ],
 "status": "live",
 "upstream": {
  "vendor": "Apache Software Foundation",
  "url": "https://tomee.apache.org",
  "license": "Apache-2.0",
  "license_url": "https://www.apache.org/licenses/LICENSE-2.0"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "restricted",
   "restricted_on": "2026-08-24"
  },
  "azure": {
   "status": "live",
   "version": "10.2.0",
   "last_build": "2026-08-07",
   "offer_id": "tomee",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:tomee:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.tomee?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/tomee/",
  "json": "https://lynxroute.com/products/tomee/product.json"
 },
 "release_notes": [
  {
   "version": "10.2.0",
   "title": "Apache TomEE 10.2.0 - Initial release (August 2026)",
   "notes": "* Apache TomEE 10.2.0 Plume on Ubuntu 24.04 LTS (OpenJDK 17, full Jakarta EE 10 profile)\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* HTTP connector bound to 127.0.0.1:8080; nginx terminates TLS on port 443\n* Manager / Host-Manager never exposed on the public perimeter; admin password generated at first launch\n* Only the required listeners enabled; the bundled message broker opens no TCP port by default\n* Runs as a non-root tomee user (UMask 0027); JVM heap sized from the instance RAM at first launch\n* Jakarta EE verification application included at /usr/share/lynxroute/tomee-sample.war (not deployed)\n* certbot pre-installed for CA-signed TLS certificates\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "azure": "2026-08-07"
   }
  }
 ],
 "release_history": [
  {
   "version": "10.2.0",
   "azure": "2026-08-07"
  }
 ],
 "deploy": {
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer tomee --plan payg-gen2\naz vm create -g my-rg -n tomee --size Standard_D2s_v3 \\\n  --image lynxroute:tomee:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Apache TomEE is the Apache Software Foundation's Jakarta EE application server: Apache Tomcat at its core, with the enterprise APIs assembled on top that Tomcat alone does not provide. It implements the Jakarta EE 10 specifications - Enterprise Beans for transactional business logic, Contexts and Dependency Injection for wiring, Persistence for object-relational mapping, RESTful and SOAP Web Services, Messaging, Faces for server-side UI, and Bean Validation. Applications deploy as ordinary WAR or EAR archives. This image ships the official Plume distribution (the full profile, built on EclipseLink for Persistence and Mojarra for Faces), verified against the upstream SHA-512 checksum and running on OpenJDK 17 as a non-root service. One JVM process, no external database, cache tier or container runtime. Apache-2.0 license, no vendor lock-in.",
  "image_adds": "Security hardening:\n* HTTP connector bound to 127.0.0.1:8080 (loopback only); nginx terminates TLS on port 443 and reverse-proxies to it - port 8080 is never exposed\n* Manager and Host-Manager webapps are never reachable from the internet: nginx returns 403 at the perimeter, and TomEE additionally restricts them to localhost connections\n* Manager admin password generated uniquely at first launch, written to /root/tomee-credentials.txt (mode 600) - nothing is baked into the image\n* Only the required listeners are enabled - the AJP connector and the secondary HTTPS connector remain disabled\n* The bundled message broker binds no TCP listener until an application configures one\n* Runs as a non-root tomee system user with UMask 0027\n* JVM heap (-Xms/-Xmx) sized from the instance RAM at first launch\n* UFW firewall pre-configured (only ports 22, 80 and 443 open; 80 serves the HTTPS redirect and certificate renewal)\n* certbot pre-installed - one command swaps the self-signed certificate for a CA-signed one\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md\n* Jakarta EE verification application at /usr/share/lynxroute/tomee-sample.war - shipped but not deployed, so you can confirm the enterprise stack works on your own instance in one command"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}