Apache Tomcat

Apache Tomcat
Original: ™/®The Apache Software Foundation Vector: VulcanSphere and ReneeWrit · Public domain · source
Name	Apache Tomcat
Developer	Apache Software Foundation
Released	1999
Programming language	Java
Operating system	Cross-platform
License	Apache License 2.0

Apache Tomcat is an open-source implementation of Java-based server-side technologies primarily used to run Java Servlet and JavaServer Pages applications. It is developed and maintained by the Apache Software Foundation and is widely adopted for web application hosting in contexts ranging from enterprise deployments to cloud-native services. Tomcat integrates with numerous Java frameworks and tooling ecosystems and serves as both a reference implementation and production-grade servlet container.

Overview

Apache Tomcat is a servlet container and web server that implements the Java Servlet, JavaServer Pages, Java Expression Language, and Java WebSocket specifications from the Java Community Process. It serves Java web applications packaged as WAR files and interoperates with tools and frameworks such as Spring, Hibernate, Jakarta EE, Maven, and Gradle. Major users include enterprises running on platforms like Red Hat Enterprise Linux, Ubuntu, Microsoft Windows Server, and cloud providers such as Amazon Web Services, Google Cloud Platform, and Microsoft Azure. The project is stewarded by the Apache Software Foundation and integrates with ancillary projects like Apache HTTP Server, Apache Maven, and Apache Ant.

History and Development

Tomcat originated as an implementation of early Java Servlet and JSP specifications contributed by Sun Microsystems engineers and has evolved through collaboration between Sun, the Apache Software Foundation, and community contributors. Key milestones align with releases of Java Platform, Enterprise Edition specifications and initiatives from Oracle, the Java Community Process, and the Eclipse Foundation. The project has seen contributions from organizations such as IBM, Red Hat, Pivotal, and Google, and its roadmap interacts with standards work from the JCP and projects like Jakarta EE and GlassFish. Tomcat’s versioning and governance reflect interactions with software ecosystems including OpenJDK, AdoptOpenJDK, CentOS, Debian, and Fedora.

Architecture and Components

Tomcat’s core architecture centers on a Catalina servlet container, combined with connectors and components such as Coyote and Jasper. Catalina implements the servlet lifecycle and request processing pipeline; Coyote acts as the HTTP/1.1 and AJP protocol connector, interfacing with web servers such as Apache HTTP Server and proxy technologies like NGINX. Jasper compiles JSP pages into servlets and integrates with tools like Ant and Maven for build processes. The architecture supports clustering and session replication via components compatible with Memcached, Redis, and Hazelcast, and management features expose APIs consumable by Prometheus, Grafana, and Kubernetes operators.

Features and Standards Compliance

Tomcat implements specifications from the Java Community Process including Java Servlet, JavaServer Pages, Java Expression Language, and Java WebSocket, aligning with Jakarta EE transition efforts. It supports TLS/SSL via JSSE and implements security constraints defined by the specification sets that influence integration with OAuth providers, OpenID Connect implementations, and SAML identity providers such as Keycloak, Okta, and Shibboleth. Tomcat’s management interface and JMX integration expose metrics and operations compatible with JConsole and VisualVM, and its build and dependency model interoperates with Maven Central, JCenter, and Gradle Plugin ecosystems.

Performance, Scalability, and Security

Performance tuning in Tomcat involves connector configuration, thread pools, JDBC connection pooling with HikariCP or Apache DBCP, and JVM tuning for OpenJDK or Oracle JDK runtimes. Scalability patterns use load balancers like HAProxy, F5 BIG-IP, and cloud-native ingress controllers in Kubernetes, while session persistence leverages databases such as PostgreSQL, MySQL, and Oracle Database or in-memory datastores like Redis. Security hardening follows guidance from OWASP, Common Vulnerabilities and Exposures disclosures, and platform-specific advisories from Red Hat, Ubuntu, and Debian. Vulnerability mitigation includes updates coordinated via CVE processes, TLS configuration aligned with IETF recommendations, and integration with SIEM tools from Splunk and Elastic for audit trails.

Deployment and Configuration

Tomcat can be deployed as a standalone server, embedded in application frameworks such as Spring Boot, or fronted by Apache HTTP Server and NGINX in reverse-proxy setups. Configuration is performed via XML descriptors like server.xml and context.xml, with environment-specific overrides provided by systemd units, Docker images, and Kubernetes manifests managed with Helm charts and Kustomize. Continuous integration and delivery pipelines use Jenkins, GitLab CI, GitHub Actions, and Bamboo to build WARs and container images, while observability is achieved through exporters for Prometheus, tracing with Jaeger and Zipkin, and logs aggregated into Elasticsearch and Splunk.

Community and Licensing

The project is governed by the Apache Software Foundation under the Apache License 2.0 and is developed by a community of committers, contributors, and users spanning corporations and individual developers. Collaboration occurs on mailing lists, the Apache JIRA tracker, Git repositories, and at conferences and events such as ApacheCon, JavaOne, Devoxx, and KubeCon. Tomcat’s ecosystem includes distributions and integrations by vendors like Red Hat, Amazon, Google, and Microsoft, and it is packaged by Linux distributions including Debian, Fedora, and SUSE.

Category:Java (programming language) software