In order to pull the JBoss EAP base image for containers, registry.access.redhat.com/jboss-eap-7-tech-preview/eap70, from the Red Hat Docker Registry, you must have at least one Red Hat Middleware entitlement associated with your subscription.

To view your current subscriptions:

$ subscription-manager list --consumed

If you do not have the appropriate entitlements, you can check if any of them are available to you

$ subscription-manager list --available --all

and attach to the appropriate subscription:

$ subscription-manager attach --pool=POOL_ID

Once you have attached to a subscription with the appropriate entitlements, a key and a certificate for those entitlements are created in /etc/pki/entitlement for each subscription you have attached. The key files are named SUBSCRIPTION_SERIAL-key.pem and the certificate files are named SUBSCRIPTION_SERIAL.pem. For example, if you had the following subscription:

$ subscription-manager list --consumed
+-------------------------------------------+
   Consumed Subscriptions
+-------------------------------------------+
Subscription Name:  ....
....
Serial:              1122334455667788990
....

You would see the following files:

$ ls /etc/pki/entitlement
1122334455667788990-key.pem 1122334455667788990.pem

To use your entitlements when pulling from the Red Hat Docker Registry, you need to ensure the corresponding keys and certificates are added to /etc/docker/certs.d/. This is accomplished using rhsmcertd-worker to refresh the local certificate store, which is part of the RHSM plugin: subscription-manager-plugin-container.

To install the RHSM plugin subscription-manager-plugin-container:

$ sudo yum install subscription-manager-plugin-container

To run rhsmcertd-worker to refresh the local certificate store:

$ sudo /usr/libexec/rhsmcertd-worker

You also need to restart Docker:

$ systemctl restart docker

To verify that the certificates and keys were added to /etc/docker/certs.d/, ensure the following files are now present in /etc/docker/certs.d/:

$ ls -l /etc/docker/certs.d/ | grep access.redhat.com
drwxr-xr-x. 2 root root   67 Jun 01 10:30 access.redhat.com
drwxr-xr-x. 2 root root   67 Jun 01 10:30 registry.access.redhat.com

To verify you can access the JBoss EAP images in the Red Hat Docker Registry, a search for the image using docker search should return at least one result from the Red Hat Docker Registry:

$ docker search registry.access.redhat.com/jboss-eap-7-tech-preview/eap70
INDEX        NAME                                               DESCRIPTION                                     STARS     OFFICIAL   AUTOMATED
redhat.com   registry.access.redhat.com/jboss-eap-7-tech-preview/eap70   ...   0

To add a management user, you can use the RUN command in your Dockerfile to execute the add-user.sh script.

FROM registry.access.redhat.com/jboss-eap-7-tech-preview/eap70
RUN $JBOSS_HOME/bin/add-user.sh adminUser StrongPassword#1 --silent

The above example adds a user adminUser with a password of StrongPassword#1 to the image.

If you want to modify the configuration of your JBoss EAP instance in your container, for example adding a security realm or data source, you can do one of the following:

To modify the configuration of a running container, simply access the management console or management CLI of your JBoss EAP instance and make your desired configuration updates. If the appropriate ports are published, you should be able to access the desired management interface using the host machine’s address, for example http://localhost:9990.

To modify the image using a Dockerfile, you can use the RUN command and invoke the jboss-cli.sh.

FROM registry.access.redhat.com/jboss-eap-7-tech-preview/eap70
COPY my-commands.txt $JBOSS_HOME
USER root
RUN chown jboss:jboss $JBOSS_HOME/my-commands.txt
USER jboss
RUN $JBOSS_HOME/bin/jboss-cli.sh --commands=embed-server,run-batch\ --file=$JBOSS_HOME/my-commands.txt,stop-embedded-server

The above example invokes the jboss-cli.sh script and uses the --commands= flag to pass in a set of commands to modify the configuration. The embed-server and stop-embedded-server commands starts and stops the server, which allows you to modify the configuration. The run-batch\ --file=$JBOSS_HOME/my-commands.txt command runs a batched set of commands from the $JBOSS_HOME/my-commands.txt file. The my-commands.txt file exists on the host’s file system and was added to the container’s $JBOSS_HOME using the COPY command in the Dockerfile and is updated to the proper permissions using the RUN command.

To deploy an application to a JBoss EAP instance running inside a container, you can do one of the following:

To deploy an application a running container, simply access the management console or management CLI of your JBoss EAP instance and deploy your application. If you the appropriate ports published you should be able to access the desired management interface using the host machine’s address, for example http://localhost:9990.

To use the deployment scanner to deploy an application when the container starts, you can use the COPY command in the Dockerfile.

FROM registry.access.redhat.com/jboss-eap-7-tech-preview/eap70
COPY app.war $JBOSS_HOME/standalone/deployments/
USER root
RUN chown jboss:jboss $JBOSS_HOME/standalone/deployments/app.war
USER jboss

The above example copies the app.war file to a location which is scanned by the deployment scanner and updates the file to have the appropriate permissions. This will cause app.war to be deployed when the JBoss EAP instance is started as the container is started.

In addition to using a Dockerfile to build a new image with a modified configuration, you can also modify a running container and persist those changes. To do so, you need to ensure that the management ports have been published so you can access the management interface. From there, you can make any desired changes as you normally would, for example deploying an application or adding a security domain. To persist those changes, you can use the docker commit command.

$ docker commit -m "commit message" -a "commit author" running-container-id new-image-name

This creates a new image based on the container with the additional changes. It will appear in your list of images, using docker images, and you use that image as you would any other, for example docker run new-image-name.

Revised on 2018-02-08 10:20:17 EST