Why does Keycloak try to modify its own installation? #38973

siepkes · 2025-04-15T09:21:22Z

siepkes
Apr 15, 2025

I've installed Keycloak in a directory where it only has read rights on the installation. For example to be able to verify the integrity of the installation to see if it hasn't been compromised. Running applications from reproducible builds (especially if something is as security sensitive as Keycloak) seems like good practice to me.

However trying to start Keycloak when it is installed this way will fail with the error below. It seems Keycloak tries to modify it's own installation before starting it. Maybe I'm missing something here but this feels like poor practice to me in a production environment, and therefor I would like to avoid it. I can workaround this issue by manually modifying kc.sh and setting PRE_BUILD=false.

Can anyone tell me what the implications are of doing this?

Updating the configuration and installing your custom providers, if any. Please wait.
ERROR: Failed to run 'build' command.
ERROR: io.quarkus.builder.BuildException: Build failure: Build failed due to errors
        [error]: Build step io.quarkus.deployment.pkg.steps.JarResultBuildStep#buildRunnerJar threw an exception: java.nio.file.ReadOnlyFileSystemException
        at jdk.zipfs/jdk.nio.zipfs.ZipFileSystem.checkWritable(ZipFileSystem.java:370)
        at jdk.zipfs/jdk.nio.zipfs.ZipFileSystem.createDirectory(ZipFileSystem.java:708)
        at jdk.zipfs/jdk.nio.zipfs.ZipPath.createDirectory(ZipPath.java:742)
        at jdk.zipfs/jdk.nio.zipfs.ZipFileSystemProvider.createDirectory(ZipFileSystemProvider.java:186)
        at java.base/java.nio.file.Files.createDirectory(Files.java:699)
        at java.base/java.nio.file.Files.createAndCheckIsDirectory(Files.java:807)
        at java.base/java.nio.file.Files.createDirectories(Files.java:752)
        at io.quarkus.deployment.pkg.steps.JarResultBuildStep.buildThinJar(JarResultBuildStep.java:654)
        at io.quarkus.deployment.pkg.steps.JarResultBuildStep.buildRunnerJar(JarResultBuildStep.java:217)
        at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:733)
        at io.quarkus.deployment.ExtensionLoader$3.execute(ExtensionLoader.java:856)
        at io.quarkus.builder.BuildContext.run(BuildContext.java:255)
        at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
        at org.jboss.threads.EnhancedQueueExecutor$Task.doRunWith(EnhancedQueueExecutor.java:2675)
        at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2654)
        at org.jboss.threads.EnhancedQueueExecutor.runThreadBody(EnhancedQueueExecutor.java:1627)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1594)
        at java.base/java.lang.Thread.run(Thread.java:1583)
        at org.jboss.threads.JBossThread.run(JBossThread.java:499)

ERROR: Build failure: Build failed due to errors
        [error]: Build step io.quarkus.deployment.pkg.steps.JarResultBuildStep#buildRunnerJar threw an exception: java.nio.file.ReadOnlyFileSystemException
        at jdk.zipfs/jdk.nio.zipfs.ZipFileSystem.checkWritable(ZipFileSystem.java:370)
        at jdk.zipfs/jdk.nio.zipfs.ZipFileSystem.createDirectory(ZipFileSystem.java:708)
        at jdk.zipfs/jdk.nio.zipfs.ZipPath.createDirectory(ZipPath.java:742)
        at jdk.zipfs/jdk.nio.zipfs.ZipFileSystemProvider.createDirectory(ZipFileSystemProvider.java:186)
        at java.base/java.nio.file.Files.createDirectory(Files.java:699)
        at java.base/java.nio.file.Files.createAndCheckIsDirectory(Files.java:807)
        at java.base/java.nio.file.Files.createDirectories(Files.java:752)
        at io.quarkus.deployment.pkg.steps.JarResultBuildStep.buildThinJar(JarResultBuildStep.java:654)
        at io.quarkus.deployment.pkg.steps.JarResultBuildStep.buildRunnerJar(JarResultBuildStep.java:217)
        at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:733)
        at io.quarkus.deployment.ExtensionLoader$3.execute(ExtensionLoader.java:856)
        at io.quarkus.builder.BuildContext.run(BuildContext.java:255)
        at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
        at org.jboss.threads.EnhancedQueueExecutor$Task.doRunWith(EnhancedQueueExecutor.java:2675)
        at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2654)
        at org.jboss.threads.EnhancedQueueExecutor.runThreadBody(EnhancedQueueExecutor.java:1627)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1594)
        at java.base/java.lang.Thread.run(Thread.java:1583)

shawkins · 2025-04-17T18:11:26Z

shawkins
Apr 17, 2025
Collaborator

It seems Keycloak tries to modify it's own installation before starting it.

There is a step Keycloak needs to is called augmentation - see https://quarkus.io/guides/reaugmentation

augmentation will happen if you run the build command or any of the other commands that effectively start a server (start, start-dev, import, export, bootstrap-admin) without the --optimized argument. See also https://www.keycloak.org/server/containers

Keycloak also assumes that the /data directory is writable.

Can anyone tell me what the implications are of doing this?

You mean skipping the pre-build check? You can do that with --optimized without modifying the shell script.

2 replies

siepkes Sep 21, 2026
Author

How would that work if Keycloak is packaged in an RPM for example for RedHat or Fedora? Would Quarkus then modify the files installed by DNF / RPM?

darius-m Sep 22, 2026

As far as I can tell, no, Keycloak would not need to modify the files set up by RPM, generally speaking - however, a build step would still need to run at least once, which can be achieved via RPM post-installation scripts.

We have been using this approach for a while, and as far as I'm aware, there aren't any major issues with it. In our case Keycloak is deployed using Ansible and the build step only runs as an Ansible task https://github.com/UPB-Admin/ansible-keycloak/blob/master/roles/keycloak/tasks/main.yml#L342; otherwise Keycloak runs with the --optimized flag as a systemd service https://github.com/UPB-Admin/ansible-keycloak/blob/master/roles/keycloak/templates/keycloak.service.

I think you still need to run the build step if you add or update any plugins / themes, however.

Navigation Menu

Repository navigation

Why does Keycloak try to modify its own installation? #38973

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 2 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Why does Keycloak try to modify its own installation? #38973

Uh oh!

siepkes Apr 15, 2025

Replies: 1 comment · 2 replies

Uh oh!

shawkins Apr 17, 2025 Collaborator

Uh oh!

siepkes Sep 21, 2026 Author

Uh oh!

darius-m Sep 22, 2026

siepkes
Apr 15, 2025

Replies: 1 comment 2 replies

shawkins
Apr 17, 2025
Collaborator

siepkes Sep 21, 2026
Author