How configure correctly TLS (.crt + .key) files with keycloak as container ? #43962

Ptipoi-jf · 2025-11-05T09:51:15Z

Ptipoi-jf
Nov 5, 2025

How to change the default container user 1000 without rewrite the official image
The underline question is : How configure correctly TLS (.crt + .key) files with keycloak as container ?

It can be nice to have according documentation on keycloak website

Context :
I'm using docker (with docker compose)
i got multiple web server running in container on the same host machine and there are sharing the same certificate.
My actual user is running with ID 1001, so i'm writing TLS file permissions for this user (.key 600, .crt 644)

Experimentation :
When i'm running keycloak container, the container cannot read the key... obviously because the user is 1000.
Okay, i change my keycloak container to my user 1001. Now when i'm running my container, it cannot start because it can't build (insufisant permissions)

Changes detected in configuration. Updating the server image.
Updating the configuration and installing your custom providers, if any. Please wait.
2025-11-05 14:59:36,380 INFO  [org.key.com.Profile] (main) Preview features enabled: user-event-metrics:v1
2025-11-05 14:59:38,484 INFO  [org.key.com.Profile] (main) Preview features enabled: user-event-metrics:v1
2025-11-05 14:59:43,329 INFO  [io.qua.hib.orm.dep.HibernateOrmProcessor] (build-36) A legacy persistence.xml file is present in the classpath. This file will be used to configure JPA/Hibernate ORM persistence units, and any configuration of the Hibernate ORM extension will be ignored. To ignore persistence.xml files instead, set the configuration property 'quarkus.hibernate-orm.persistence-xml.ignore' to 'true'.
ERROR: Failed to run 'build' command.
ERROR: io.quarkus.builder.BuildException: Build failure: Build failed due to errors
        [error]: Build step io.quarkus.deployment.pkg.steps.JarResultBuildStep#buildRunnerJar threw an exception: java.nio.file.ReadOnlyFileSystemException
        at jdk.zipfs/jdk.nio.zipfs.ZipFileSystem.checkWritable(ZipFileSystem.java:370)
        at jdk.zipfs/jdk.nio.zipfs.ZipFileSystem.createDirectory(ZipFileSystem.java:708)
        at jdk.zipfs/jdk.nio.zipfs.ZipPath.createDirectory(ZipPath.java:742)
        at jdk.zipfs/jdk.nio.zipfs.ZipFileSystemProvider.createDirectory(ZipFileSystemProvider.java:186)
        at java.base/java.nio.file.Files.createDirectory(Files.java:700)
        at java.base/java.nio.file.Files.createAndCheckIsDirectory(Files.java:808)
        at java.base/java.nio.file.Files.createDirectories(Files.java:753)
        at io.quarkus.deployment.pkg.steps.JarResultBuildStep.buildThinJar(JarResultBuildStep.java:664)
        at io.quarkus.deployment.pkg.steps.JarResultBuildStep.buildRunnerJar(JarResultBuildStep.java:228)
        at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:733)
        at io.quarkus.deployment.ExtensionLoader$3.execute(ExtensionLoader.java:856)
        at io.quarkus.builder.BuildContext.run(BuildContext.java:256)
        at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
        at org.jboss.threads.EnhancedQueueExecutor$Task.doRunWith(EnhancedQueueExecutor.java:2516)
        at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2495)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1521)
        at java.base/java.lang.Thread.run(Thread.java:1583)
        at org.jboss.threads.JBossThread.run(JBossThread.java:483)

ERROR: Build failure: Build failed due to errors
        [error]: Build step io.quarkus.deployment.pkg.steps.JarResultBuildStep#buildRunnerJar threw an exception: java.nio.file.ReadOnlyFileSystemException
        at jdk.zipfs/jdk.nio.zipfs.ZipFileSystem.checkWritable(ZipFileSystem.java:370)
        at jdk.zipfs/jdk.nio.zipfs.ZipFileSystem.createDirectory(ZipFileSystem.java:708)
        at jdk.zipfs/jdk.nio.zipfs.ZipPath.createDirectory(ZipPath.java:742)
        at jdk.zipfs/jdk.nio.zipfs.ZipFileSystemProvider.createDirectory(ZipFileSystemProvider.java:186)
        at java.base/java.nio.file.Files.createDirectory(Files.java:700)
        at java.base/java.nio.file.Files.createAndCheckIsDirectory(Files.java:808)
        at java.base/java.nio.file.Files.createDirectories(Files.java:753)
        at io.quarkus.deployment.pkg.steps.JarResultBuildStep.buildThinJar(JarResultBuildStep.java:664)
        at io.quarkus.deployment.pkg.steps.JarResultBuildStep.buildRunnerJar(JarResultBuildStep.java:228)
        at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:733)
        at io.quarkus.deployment.ExtensionLoader$3.execute(ExtensionLoader.java:856)
        at io.quarkus.builder.BuildContext.run(BuildContext.java:256)
        at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
        at org.jboss.threads.EnhancedQueueExecutor$Task.doRunWith(EnhancedQueueExecutor.java:2516)
        at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2495)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1521)
        at java.base/java.lang.Thread.run(Thread.java:1583)
        at org.jboss.threads.JBossThread.run(JBossThread.java:483)

For more details run the same command passing the '--verbose' option. Also you can use '--help' to see the details about the usage of the particular command.

Then :
How can must configure correctly my keycloak container using the default image to access to my TLS files ?

Note :
We do not want to add additionnal certificate only for keycloak
testing with container image quay.io/keycloak/keycloak:26.1.0

Related :
#15936

shawkins · 2025-11-06T19:47:22Z

shawkins
Nov 6, 2025
Collaborator

How to change the default container user 1000 without rewrite the official image

What do you mean by rewrite?

I think you are going to have to create your own Dockerfile in this situation, but you will use the official image as the base image.

When i'm running keycloak container, the container cannot read the key... obviously because the user is 1000.

That seems to be answered here https://stackoverflow.com/questions/63602211/how-to-specify-userid-and-groupid-for-volume-mount-point-on-docker-host

Okay, i change my keycloak container to my user 1001. Now when i'm running my container, it cannot start because it can't build (insufisant permissions)

Those are happening because augmentation is running. If you take this approach you'll need a Dockerfile that changes the file permissions under /opt/keycloak

0 replies

Ptipoi-jf · 2025-11-07T16:06:06Z

Ptipoi-jf
Nov 7, 2025
Author

What do you mean by rewrite?

by rewrite i mean re-build the official image

all 3 points of your comment is to re-build the image, i don't understand why i need to re-build the image when i want to use it as it with no customisation
i guess, if we need to rewrite the image to change the user, it look like the image is not built in the right way, no ?

1 reply

shawkins Nov 7, 2025
Collaborator

i guess, if we need to rewrite the image to change the user, it look like the image is not built in the right way, no ?

This is likely a Docker specific problem. There is no issue with reading mounted Secrets / ConfigMaps when running in Kubernetes for example. And at first glance it appears possible to do without creating a custom image using Podman https://www.reddit.com/r/podman/comments/103ut7z/explain_it_like_im_5_whats_the_recommended_way_of/

Navigation Menu

Repository navigation

How configure correctly TLS (.crt + .key) files with keycloak as container ? #43962

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments 1 reply

Uh oh!

There was an error while loading. Please reload this page.

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

How configure correctly TLS (.crt + .key) files with keycloak as container ? #43962

Uh oh!

Uh oh!

Ptipoi-jf Nov 5, 2025

Replies: 2 comments · 1 reply

Uh oh! There was an error while loading. Please reload this page.

shawkins Nov 6, 2025 Collaborator

Uh oh!

Ptipoi-jf Nov 7, 2025 Author

Uh oh!

shawkins Nov 7, 2025 Collaborator

Ptipoi-jf
Nov 5, 2025

Replies: 2 comments 1 reply

Uh oh!

There was an error while loading. Please reload this page.

shawkins
Nov 6, 2025
Collaborator

Ptipoi-jf
Nov 7, 2025
Author

shawkins Nov 7, 2025
Collaborator