swissmakers/freeipa-server repository overview

⁠Swissmakers FreeIPA Server Fedora Rawhide with Java 21 Temurin

This container is a Swissmakers variant of the upstream container image:

• Base image: freeipa/freeipa-server:fedora-rawhide
• Change: force the JVM used by FreeIPA/Dogtag (Dogtag PKI / Tomcat) to Java 21 LTS (Eclipse Temurin) instead of Fedora Rawhide's default OpenJDK 25

The result is a FreeIPA server image that still tracks Fedora Rawhide for everything else, but runs the CA stack on a stable Java LTS baseline.

⁠Why this exists (the problem we are solving)

freeipa/freeipa-server:fedora-rawhide follows Fedora Rawhide closely. Rawhide can jump to a new major Java version early (here: OpenJDK 25). FreeIPA's CA stack (Dogtag PKI + Tomcat + JSS/NSS integration) is historically sensitive to Java major upgrades. When the JVM major version changes, the CA stack can exhibit failures ranging from functional regressions to hard crashes.

In our environment, the Rawhide OpenJDK 25 runtime triggered a JVM crash in Dogtag/Tomcat (SIGSEGV) during ACME Issuing, causing FreeIPA to fail.

Swissmakers chooses Java 21 LTS because it is long-term supported, widely deployed, and typically the safest baseline for Dogtag/Tomcat-based CA deployments while Rawhide continues to evolve.

This image therefore enforces Java 21 at runtime while still inheriting Rawhide updates for FreeIPA and system packages.

⁠What have we changed (high level)

1. Installed Temurin OpenJDK 21 into /opt/java/jdk21.

2. Ensured interactive/default java resolves to Temurin 21:

   • JAVA_HOME=/opt/java/jdk21
   • PATH prefixed with ${JAVA_HOME}/bin
   • alternatives for java points to Temurin 21

3. Ensured Dogtag/Tomcat uses Java 21 even if configs reference Rawhide's JRE paths:

   • Dogtag/Tomcat frequently sources JAVA_HOME from config files such as:

     • /usr/share/pki/etc/pki.conf
     • /etc/tomcat/tomcat.conf
     • /etc/sysconfig/pki-tomcat
     • /etc/pki/pki.conf

   • These can set JAVA_HOME to values like /usr/lib/jvm/jre-25-openjdk, which bypasses our shell PATH and alternatives --set java.

   • Therefore we also repointed the relevant JRE alternatives so that:

     • /usr/lib/jvm/jre-25-openjdk (and related jre* names) resolve to Temurin 21.

4. Fix CA trust during image build:

   • Some Rawhide-based images may have broken CA trust paths at build time, causing dnf/curl to fail with SSL errors.
   • We copy a known-good CA bundle from a Fedora Rawhide stage and wire it via SSL_CERT_FILE / CURL_CA_BUNDLE.

Important: we do not rely on dnf install java-21-openjdk because in Rawhide it is unavailable and was replaced by the newer major stream version 25.

⁠Run (example)

FreeIPA containers require specific privileges and persistent storage. A minimal example (adjust for your environment):

podman run --name freeipa \
  --hostname ipa.example.test \
  --read-only=false \
  --tmpfs /run --tmpfs /tmp \
  -v freeipa-data:/data \
  -p 80:80 -p 443:443 \
  -p 389:389 -p 636:636 \
  -p 88:88 -p 464:464 \
  -p 88:88/udp -p 464:464/udp \
  -p 53:53 -p 53:53/udp \
  freeipa-server:fedora-swissmakers

Use the upstream FreeIPA container documentation for production-grade settings, additional ports, and capability requirements.

⁠Verify the Java runtime for your own (interactive shell)

Exec into the container:

podman exec -it freeipa bash

Then verify which java is executed:

command -v java
type -a java
readlink -f "$(command -v java)"
java -version
echo "JAVA_HOME=$JAVA_HOME"
echo "PATH=$PATH"
alternatives --display java || true
readlink -f /etc/alternatives/java || true

Expected:

• command -v java → /opt/java/jdk21/bin/java
• java -version → Temurin 21.x LTS
• alternatives shows selection pointing to /opt/java/jdk21/bin/java

⁠Verify the Java runtime used by Dogtag/Tomcat

Even if the interactive shell runs Temurin 21, Dogtag/Tomcat may still use a different JVM if JAVA_HOME is overridden by config files.

1. You can test this by identify the PID and the real Java binary used by the PKI Tomcat service as following:

pid="$(systemctl show -p MainPID --value [email protected])"
echo "PID=$pid"

# What java binary is actually running?
runuser -u pkiuser -- readlink -f /proc/"$pid"/exe

Expected: a path under /opt/java/jdk-21.../bin/java (Temurin 21).

1. Confirm the environment seen by the service process (as the service user):

runuser -u pkiuser -- sh -c 'tr "\0" "\n" < /proc/'"$pid"'/environ | grep -E "JAVA_HOME|JRE_HOME|PATH"'

Expected: JAVA_HOME=/opt/java/jdk21 and PATH prefixed with /opt/java/jdk21/bin.

1. Confirm that the “legacy” Rawhide JRE path now resolves to Temurin 21:

readlink -f /usr/lib/jvm/jre-25-openjdk/bin/java
/usr/lib/jvm/jre-25-openjdk/bin/java -version

Expected: resolves into /opt/java/jdk-21... and reports Temurin 21.

⁠Troubleshooting

To find where Java is being forced back to a Rawhide JRE:

grep -R --line-number -E 'JAVA_HOME=|JRE_HOME=|/usr/lib/jvm/jre-|/usr/lib/jvm/java-' \
  /etc /usr/share /etc/sysconfig /etc/pki 2>/dev/null | head -n 200

If a service still runs Java 25, check:

• systemctl show -p Environment -p EnvironmentFiles [email protected]
• /usr/share/pki/etc/pki.conf, /etc/tomcat/tomcat.conf, /etc/sysconfig/pki-tomcat, /etc/pki/pki.conf
• The resolved target of /usr/lib/jvm/jre-25-openjdk

⁠License / upstream

This image derives from upstream FreeIPA container work and Fedora packages. Review upstream licenses and FreeIPA documentation as applicable.