Production Installation & Quickstart Guide

# Create dedicated unprivileged tomcat user & group
sudo useradd -r -m -U -d /opt/tomcat -s /bin/false tomcat

# Download and unpack Apache Tomcat 10.1.x
sudo mkdir -p /opt/tomcat
wget https://dlcdn.apache.org/tomcat/tomcat-10/v10.1.34/bin/apache-tomcat-10.1.34.tar.gz -O /tmp/tomcat.tar.gz
sudo tar -xzvf /tmp/tomcat.tar.gz -C /opt/tomcat --strip-components=1

# Restrict ownership and lock down execution privileges
sudo chown -R tomcat:tomcat /opt/tomcat
sudo chmod -R u+rwX,g+rX,o-rwx /opt/tomcat
sudo chmod -R u+x /opt/tomcat/bin/*.sh

# Create dedicated log and heap dump folders
sudo mkdir -p /opt/tomcat/logs/heapdumps
sudo chown -R tomcat:tomcat /opt/tomcat/logs/heapdumps
sudo chmod 750 /opt/tomcat/logs/heapdumps

[Unit]
Description=Apache Tomcat Web Application Container
After=network.target

[Service]
Type=forking
User=tomcat
Group=tomcat

Environment="JAVA_HOME=/opt/java/jdk-17"
Environment="CATALINA_HOME=/opt/tomcat"
Environment="CATALINA_BASE=/opt/tomcat"
Environment="CATALINA_PID=/opt/tomcat/temp/tomcat.pid"

ExecStart=/opt/tomcat/bin/startup.sh
ExecStop=/opt/tomcat/bin/shutdown.sh

Restart=on-failure
RestartSec=10

# Security Sandbox Hardening
ProtectSystem=strict
ProtectHome=true
NoNewPrivileges=true
ReadWritePaths=/opt/tomcat/logs /opt/tomcat/temp /opt/tomcat/webapps /opt/tomcat/work

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now tomcat
sudo systemctl status tomcat