ilum/hive repository overview

⁠Ilum Hive Metastore

⁠Overview

The ilum/hive image provides a robust implementation of Apache Hive 3.1.3, configured to run as a standalone Metastore or HiveServer2 (HS2). It is specifically designed for cloud-native environments with built-in support for major cloud storage providers.

• Cloud-Ready — pre-installed connectors for AWS S3, Google Cloud Storage (GCS), and Azure Blob Storage
• Database Support — includes PostgreSQL drivers for external metastore databases
• Security — runs as a non-root user (hive with UID 1001)
• Multi-arch support — built for linux/amd64 and linux/arm64

⁠TL;DR / Quick Start

# Run Hive Metastore with local Derby database
docker run -d \
  --name ilum-hive-metastore \
  -e SERVICE_NAME=metastore \
  -p 9083:9083 \
  ilum/hive:<version>

For production deployments, use the official Ilum Hive Metastore Helm Chart⁠.

⁠Supported Tags

• <version>: Apache Hive 3.1.3 + Hadoop 3.3.6 + Tez 0.9.2

TIP: Choosing a version: Always use a version that matches your Hadoop/Spark ecosystem requirements (Hadoop 3.x is standard for Ilum).

⁠Environment Variables

⁠Required for Production

⁠Optional & Tuning

Variables can also be defined with hyphens if required by your configuration management.

⁠Data Persistence (Volumes)

# docker-compose example
volumes:
  - ./hive-site.xml:/opt/hive/conf/hive-site.xml
  - ./warehouse:/opt/hive/data/warehouse

TIP: Use HIVE_CUSTOM_CONF_DIR env to point to a folder with custom hive-site.xml and core-site.xml. They will be automatically linked at startup.

⁠Network Configuration

⁠Security

⁠Non-root Architecture

The image runs as user hive (UID 1001). When mounting host volumes, ensure directories have appropriate permissions:

# On host
sudo chown -R 1001:1001 /path/to/warehouse /path/to/conf

⁠Secret Hygiene

CAUTION: Never pass passwords or cloud keys directly in environment variables!

Recommended methods:

1. IAM Roles (IRSA) — use Kubernetes Service Accounts for S3/GCS access.
2. Kubernetes Secrets — mount configuration files containing sensitive data.

⁠Vulnerability Scanning

Before production deployment, scan the image:

# Trivy
trivy image ilum/hive:<version>

⁠Building the Image

Run command from the docker/ilum-hive-metastore directory:

docker buildx build \
  --platform linux/amd64,linux/arm64 \
  -t ilum/hive:<version> \
  --push .

⁠Image Verification

⁠Layer Analysis (Dive)

dive ilum/hive:<version>

⁠Software Bill of Materials (SBOM)

# Syft
syft ilum/hive:<version> -o spdx-json > sbom.json

⁠Image Contents — Details

⁠Dockerfile Components

• Base: Eclipse Temurin 8 JRE
• Hive: Apache Hive 3.1.3
• Hadoop: Apache Hadoop 3.3.6
• Tez: Apache Tez 0.9.2
• Connectors:
  • AWS SDK (S3 support)
  • GCS Connector
  • Azure Storage SDK
  • PostgreSQL JDBC Driver

⁠Support and Feedback

• Issues: Bug Tracker⁠
• Documentation: Ilum Docs⁠
• Slack: Join our Community⁠