Alfresco community edition with podman

R4L · ‎2 Feb 2021

Hello everybody,

Since RHEL 8 no longer supports Docker, I am trying to install Alfresco Community Edition with podman. Does anyone have any experience with this? How do I have to configure the individual components? Almost everything starts, only alfresco-content-repository-community does not.

I am grateful for any tips.

sufo · ‎9 Feb 2021

Maybe this will help you get started.

podman pod create --name dms --hostname dms --publish 8080:8080,8443:8443
podman create -d --pod dms --name postgres -v $HOME/volumes/db-volume-data:/var/lib/postgresql/data:Z -v $HOME/volumes/db-volume-logs:/var/log/postgresql:Z -e POSTGRES_PASSWORD=pass1234 -e POSTGRES_USER=alfresco -e POSTGRES_DB=alfresco docker.io/library/postgres:11.7 postgres -c max_connections=300 -c logging_collector=true -c log_directory=/var/log/postgresql
podman create -d --pod dms --name activemq -v $HOME/volumes/activemq-volume-data:/opt/activemq/data:Z docker.io/alfresco/alfresco-activemq:5.15.8
podman create -d --pod dms --name transform-core-aio docker.io/alfresco/alfresco-transform-core-aio:2.3.6
podman create -d --pod dms --name solr6 -v $HOME/volumes/solr-volume-data:/opt/alfresco-search-services/data:Z -v $HOME/volumes/solr-volume-logs:/opt/alfresco-search-services/logs:Z -v $HOME/volumes/solr-shared.properties:/opt/alfresco-search-services/solrhome/conf/shared.properties:Z,ro -v $HOME/volumes/solr-log4j.properties:/opt/alfresco-search-services/logs/log4j.properties:Z,ro -e SOLR_ALFRESCO_HOST=localhost -e SOLR_ALFRESCO_PORT=7080 -e SOLR_SOLR_HOST=localhost -e SOLR_SOLR_PORT=8983 -e SOLR_CREATE_ALFRESCO_DEFAULTS=alfresco,archive -e ALFRESCO_SECURE_COMMS=none docker.io/alfresco/alfresco-search-services:2.0.1
podman create -d --pod dms --name alfresco -v $HOME/volumes/alfresco-volume-data:/usr/local/tomcat/alf_data:Z -v $HOME/volumes/alfresco-volume-logs:/usr/local/tomcat/logs:Z -e JAVA_TOOL_OPTIONS=" -Dencryption.keystore.type=JCEKS -Dencryption.cipherAlgorithm=DESede/CBC/PKCS5Padding -Dencryption.keyAlgorithm=DESede -Dencryption.keystore.location=/usr/local/tomcat/shared/classes/alfresco/extension/keystore/keystore -Dmetadata-keystore.password=mp6yc0UD9e -Dmetadata-keystore.aliases=metadata -Dmetadata-keystore.metadata.password=oKIWzVdEdA -Dmetadata-keystore.metadata.algorithm=DESede" -e JAVA_OPTS=" -Ddb.driver=org.postgresql.Driver -Ddb.username=alfresco -Ddb.password=pass1234 -Ddb.url=jdbc:postgresql://localhost:5432/alfresco -Dsolr.host=localhost -Dsolr.port=8983 -Dsolr.secureComms=none -Dsolr.base.url=/solr -Dindex.subsystem.name=solr6 -Dshare.host=localhost -Dshare.port=8080 -Dalfresco.host=localhost -Dalfresco.port=7080 -Daos.baseUrlOverwrite=http://localhost:7080/alfresco/aos -Dmessaging.broker.url=\"failover:(nio://localhost:61616)?timeout=3000&jms.useCompression=true\" -Ddeployment.method=DEFAULT -DlocalTransform.core-aio.url=http://localhost:8090/ -Dalfresco-pdf-renderer.url=http://localhost:8090/ -Djodconverter.url=http://localhost:8090/ -Dimg.url=http://localhost:8090/ -Dtika.url=http://localhost:8090/ -Dtransform.misc.url=http://localhost:8090/ -Dcsrf.filter.enabled=false -Dgoogledocs.enabled=false -Dsample.site.disabled=true -XX:MinRAMPercentage=50 -XX:MaxRAMPercentage=80" docker.io/alfresco/alfresco-content-repository-community:6.2.2-RC1
podman create -d --pod dms --name share  -v $HOME/volumes/share-volume-logs:/usr/local/tomcat/logs:Z -e REPO_HOST=localhost -e REPO_PORT=7080 -e JAVA_OPTS=" -XX:MinRAMPercentage=50 -XX:MaxRAMPercentage=80 -Dalfresco.host=localhost -Dalfresco.port=7080 -Dalfresco.context=alfresco -Dalfresco.protocol=http" docker.io/alfresco/alfresco-share:6.2.2

podman unshare
MOUNT_DIR=`podman mount alfresco`
TOMCAT_DIR=$MOUNT_DIR/usr/local/tomcat
cp ~/custom-model-context.xml $TOMCAT_DIR/shared/classes/alfresco/extension/
chown -R 33000 $TOMCAT_DIR
$MOUNT_DIR/usr/java/openjdk-11.0.7+10/bin/java -jar $TOMCAT_DIR/alfresco-mmt/alfresco-mmt*.jar uninstall org.alfresco.integrations.google.docs $TOMCAT_DIR/webapps/alfresco -nobackup -force
rm $TOMCAT_DIR/amps/alfresco-googledrive-repo-community-3.2.0.amp
cp $HOME/repo-amps/*.amp $TOMCAT_DIR/amps/
$MOUNT_DIR/usr/java/openjdk-11.0.7+10/bin/java -jar $TOMCAT_DIR/alfresco-mmt/alfresco-mmt*.jar install $TOMCAT_DIR/amps $TOMCAT_DIR/webapps/alfresco -directory -nobackup -force
sed -i "s/==/=/g" $TOMCAT_DIR/bin/catalina.sh
TOMCAT_SERVER_PORT=7005
TOMCAT_HTTP_PORT=7080
TOMCAT_SSL_PORT=7443
TOMCAT_AJP_PORT=7009
TOMCAT_JPDA_PORT=7000
sed -i "s/<Server\ port=\"8005\"\ shutdown=\"SHUTDOWN\">/<Server\ port=\"$TOMCAT_SERVER_PORT\"\ shutdown=\"SHUTDOWN\">/g" $TOMCAT_DIR/conf/server.xml
sed -i "s/port=\"8080\"\ protocol=\"HTTP\/1.1\"/port=\"$TOMCAT_HTTP_PORT\"\ protocol=\"HTTP\/1.1\"/g" $TOMCAT_DIR/conf/server.xml
sed -i "s/\ <Connector\ port=\"8443\"/\ <Connector port=\"$TOMCAT_SSL_PORT\"/g" $TOMCAT_DIR/conf/server.xml
sed -i "s/\ <Connector\ port=\"8009\"\ protocol=\"AJP\/1.3\"/\ <Connector\ port=\"$TOMCAT_AJP_PORT\"\ protocol=\"AJP\/1.3\"\ /g" $TOMCAT_DIR/conf/server.xml
sed -i "s/redirectPort=\"8443\"/redirectPort=\"$TOMCAT_SSL_PORT\"/g" $TOMCAT_DIR/conf/server.xml
podman umount alfresco
exit

I wanted to run under normal user, so created user dms. And did everything under that user. But you need cgroups v2 (try podman stats ) and other stuff solved (moved from CentOS to Debian and everything worked).

I placed everything in one pod so had to renumber conflicting ports as all the containers share "localhost".

Repository not starting: Basically what I found out was that when you start repository image, it runs under userid (33000) that doesn't own tomcat directory so you have to fix this (chown -R 33000 $TOMCAT_DIR).
In podman you can do nice tricks with existing containers (podman unshare, podman mount), but remember, if you recreate the container, you will loose all the changes. So when you are OK with the changes, it's best to make your own image from that container (podman commit) and use that image instead of original repository image.

I also made changes to the share and also then you need to add proxy (Apache HTTPD or nginx) to handle ports 8080/8443.

podman unshare
MOUNT_DIR=`podman mount share`
TOMCAT_DIR=$MOUNT_DIR/usr/local/tomcat
chown -R 33000 $TOMCAT_DIR
$MOUNT_DIR/usr/java/openjdk-11.0.7+10/bin/java -jar $TOMCAT_DIR/alfresco-mmt/alfresco-mmt*.jar uninstall org.alfresco.integrations.share.google.docs $TOMCAT_DIR/webapps/share -nobackup -force
rm $TOMCAT_DIR/amps_share/alfresco-googledrive-share-3.2.0.amp
cp $HOME/share-amps/*.amp $TOMCAT_DIR/amps_share/
$MOUNT_DIR/usr/java/openjdk-11.0.7+10/bin/java -jar $TOMCAT_DIR/alfresco-mmt/alfresco-mmt*.jar install $TOMCAT_DIR/amps_share $TOMCAT_DIR/webapps/share -directory -nobackup -force
sed -i 's@<show-authorization-status>true</show-authorization-status>@<show-authorization-status>false</show-authorization-status>@' $TOMCAT_DIR/shared/classes/alfresco/web-extension/share-config-custom.xml
TOMCAT_SERVER_PORT=6005
TOMCAT_HTTP_PORT=6080
TOMCAT_SSL_PORT=6443
TOMCAT_AJP_PORT=6009
TOMCAT_JPDA_PORT=6000
sed -i "s/<Server\ port=\"8005\"\ shutdown=\"SHUTDOWN\">/<Server\ port=\"$TOMCAT_SERVER_PORT\"\ shutdown=\"SHUTDOWN\">/g" $TOMCAT_DIR/conf/server.xml
sed -i "s/port=\"8080\"\ protocol=\"HTTP\/1.1\"/port=\"$TOMCAT_HTTP_PORT\"\ protocol=\"HTTP\/1.1\"/g" $TOMCAT_DIR/conf/server.xml
sed -i "s/\ <Connector\ port=\"8443\"/\ <Connector port=\"$TOMCAT_SSL_PORT\"/g" $TOMCAT_DIR/conf/server.xml
sed -i "s/\ <Connector\ port=\"8009\"\ protocol=\"AJP\/1.3\"/\  <Connector\ port=\"$TOMCAT_AJP_PORT\"\ protocol=\"AJP\/1.3\"\ /g" $TOMCAT_DIR/conf/server.xml
sed -i "s/redirectPort=\"8443\"/redirectPort=\"$TOMCAT_SSL_PORT\"/g" $TOMCAT_DIR/conf/server.xml
podman umount share

First sed with show-authorization-status fixes nasty bug in official docker image, which prevents admin from user management in Share.

podman pod start dms
podman stats # to see the resource usage
podman pod stop dms

dms or DMS is Document Management System in case anyone wonders why I used that

Inspiration taken from https://github.com/abhinavmishra14/change-acs-share-port-demo

sufo · ‎9 Feb 2021

I forgot to mention that:

if you plan for production use, put resource limits on the containers (and there is far more work to be done)
you have to create volumes for the mounts used in the commands
you can export kubernetes like config http://docs.podman.io/en/latest/markdown/podman-generate-kube.1.html to load it elsewhere http://docs.podman.io/en/latest/markdown/podman-play-kube.1.html (didn't have time to try it)
you can create systemd units (services) http://docs.podman.io/en/latest/markdown/podman-generate-systemd.1.html - but I was unable to make it work root-less (under dms user)