Skip to content

Run ActiveMQ container as a non-root user #1648

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pradeep85841 wants to merge 5 commits into
base: main
Choose a base branch
from
+104 −1
Open

Run ActiveMQ container as a non-root user #1648

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
77eb289
Add test for VM transport behavior on broker restart
Jan 26, 2026
dbc3ece
Add Jolokia-based healthcheck for ActiveMQ container
Jan 31, 2026
cef7da9
Simplify Dockerfile healthcheck using HTTP endpoint
Feb 1, 2026
0daefb9
Run ActiveMQ as a non-root user
Feb 3, 2026
a8be7eb
Ensure entrypoint.sh is owned by activemq user
Feb 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
82 changes: 82 additions & 0 deletions activemq-unit-tests/src/test/java/org/apache/activemq/VmTransportBrokerRestartTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,82 @@
/**
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.apache.activemq;

import jakarta.jms.TextMessage;
import org.apache.activemq.broker.BrokerService;
import org.apache.activemq.test.annotations.ParallelTest;
import org.junit.After;
import org.junit.Test;
import org.junit.experimental.categories.Category;

@Category(ParallelTest.class)
public class VmTransportBrokerRestartTest extends EmbeddedBrokerTestSupport {

@Override
protected BrokerService createBroker() throws Exception {
BrokerService broker = new BrokerService();

broker.setBrokerName("localhost");
broker.setPersistent(false);
broker.setUseJmx(false);
broker.addConnector("vm://localhost");

return broker;
}

@Test
public void testSendReceiveAfterBrokerRestart() throws Exception {

String firstMessage = "message-before-restart";
template.convertAndSend(firstMessage);

TextMessage receivedBefore =
(TextMessage) template.receive(destination);

assertNotNull(receivedBefore);
assertEquals(firstMessage, receivedBefore.getText());

broker.stop();
broker.waitUntilStopped();

broker = createBroker();
startBroker();
broker.waitUntilStarted();

connectionFactory = createConnectionFactory();
template = createJmsTemplate();
template.setDefaultDestination(destination);
template.afterPropertiesSet();

String secondMessage = "message-after-restart";
template.convertAndSend(secondMessage);

TextMessage receivedAfter =
(TextMessage) template.receive(destination);

assertNotNull(receivedAfter);
assertEquals(secondMessage, receivedAfter.getText());
}

@After
public void cleanup() throws Exception {
if (broker != null) {
broker.stop();
broker.waitUntilStopped();
}
}
}
13 changes: 12 additions & 1 deletion assembly/src/docker/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,14 +32,25 @@ ENV ACTIVEMQ_OPTS $ACTIVEMQ_OPTS_MEMORY -Djava.util.logging.config.file=logging.
# activemq_dist can point to a directory or a tarball on the local system
ARG activemq_dist=NOT_SET

COPY entrypoint.sh /usr/local/bin/entrypoint.sh
RUN groupadd -r activemq && useradd -r -g activemq -m activemq

COPY src/docker/entrypoint.sh /usr/local/bin/entrypoint.sh
RUN chmod +x /usr/local/bin/entrypoint.sh && chown activemq:activemq /usr/local/bin/entrypoint.sh

# Install build dependencies and activemq
ADD $activemq_dist $ACTIVEMQ_INSTALL_PATH
RUN set -x && \
cp -r $ACTIVEMQ_INSTALL_PATH/apache-activemq-* $ACTIVEMQ_HOME && \
rm -r $ACTIVEMQ_INSTALL_PATH/apache-activemq-*

RUN ls -l $ACTIVEMQ_HOME && \
chown -R activemq:activemq $ACTIVEMQ_HOME

EXPOSE 8161 61616 5672 61613 1883 61614 1099

STOPSIGNAL SIGTERM

USER activemq

ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
CMD ["activemq", "console"]
10 changes: 10 additions & 0 deletions assembly/src/docker/entrypoint.sh
100755 → 100644
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@
# limitations under the License.
################################################################################

set -e

# Transport/connection security
if [ -n "${ACTIVEMQ_CONNECTION_USER}" ]; then
if [ -f "${ACTIVEMQ_HOME}/conf/connection.security.enabled" ]; then
Expand Down Expand Up @@ -78,4 +80,12 @@ if [ -n "${ACTIVEMQ_WEB_USER}" ]; then
fi
fi

_term() {
echo "Received SIGTERM, stopping ActiveMQ..."
activemq stop
sleep 2
}

trap _term TERM INT

exec "$@"