From b374d93b20b1e27cea4d7be70eb13bff793d1cf2 Mon Sep 17 00:00:00 2001
From: Andre Henn <henn@terrestris.de>
Date: Wed, 7 Feb 2024 11:29:37 +0100
Subject: [PATCH 01/11] switch to official tomcat 9 - jre 11 base image

---
 Dockerfile | 161 ++++++++++++++++++++++-------------------------------
 README.md  |   1 -
 2 files changed, 67 insertions(+), 95 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index f465b0d..d1d756c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,21 +1,48 @@
-FROM ubuntu:22.04 as tomcat
+FROM tomcat:9.0.85-jre11-temurin-jammy
+LABEL vendor="osgeo.org"
 
-ARG TOMCAT_VERSION=9.0.84
-ARG CORS_ENABLED=false
-ARG CORS_ALLOWED_ORIGINS=*
-ARG CORS_ALLOWED_METHODS=GET,POST,PUT,DELETE,HEAD,OPTIONS
+# Build arguments
+ARG ADDITIONAL_FONTS_PATH=./additional_fonts/
+ARG ADDITIONAL_LIBS_PATH=./additional_libs/
+ARG COMMUNITY_PLUGIN_URL=''
 ARG CORS_ALLOWED_HEADERS=*
+ARG CORS_ALLOWED_METHODS=GET,POST,PUT,DELETE,HEAD,OPTIONS
+ARG CORS_ALLOWED_ORIGINS=*
 ARG CORS_ALLOW_CREDENTIALS=false
+ARG CORS_ENABLED=false
+ARG GS_BUILD=release
+ARG GS_DATA_PATH=./geoserver_data/
+ARG GS_VERSION=2.24.2
+ARG STABLE_PLUGIN_URL=https://downloads.sourceforge.net/project/geoserver/GeoServer/${GS_VERSION}/extensions
+ARG WAR_ZIP_URL=https://downloads.sourceforge.net/project/geoserver/GeoServer/${GS_VERSION}/geoserver-${GS_VERSION}-war.zip
 
 # Environment variables
-ENV CATALINA_HOME=/opt/apache-tomcat-${TOMCAT_VERSION}
-ENV EXTRA_JAVA_OPTS="-Xms256m -Xmx1g"
-ENV CORS_ENABLED=$CORS_ENABLED
-ENV CORS_ALLOWED_ORIGINS=$CORS_ALLOWED_ORIGINS
-ENV CORS_ALLOWED_METHODS=$CORS_ALLOWED_METHODS
+ENV ADDITIONAL_FONTS_DIR=/opt/additional_fonts/
+ENV ADDITIONAL_LIBS_DIR=/opt/additional_libs/
+ENV CATALINA_HOME=$CATALINA_HOME
+ENV COMMUNITY_EXTENSIONS=''
+ENV COMMUNITY_PLUGIN_URL=$COMMUNITY_PLUGIN_URL
+ENV CONFIG_DIR=/opt/config
+ENV CONFIG_OVERRIDES_DIR=/opt/config_overrides
 ENV CORS_ALLOWED_HEADERS=$CORS_ALLOWED_HEADERS
+ENV CORS_ALLOWED_METHODS=$CORS_ALLOWED_METHODS
+ENV CORS_ALLOWED_ORIGINS=$CORS_ALLOWED_ORIGINS
 ENV CORS_ALLOW_CREDENTIALS=$CORS_ALLOW_CREDENTIALS
-ENV DEBIAN_FRONTEND=noninteractive
+ENV CORS_ENABLED=$CORS_ENABLED
+ENV EXTRA_JAVA_OPTS="-Xms256m -Xmx1g"
+ENV GEOSERVER_BUILD=$GS_BUILD
+ENV GEOSERVER_DATA_DIR=/opt/geoserver_data/
+ENV GEOSERVER_LIB_DIR=$CATALINA_HOME/webapps/geoserver/WEB-INF/lib/
+ENV GEOSERVER_REQUIRE_FILE=$GEOSERVER_DATA_DIR/global.xml
+ENV GEOSERVER_VERSION=$GS_VERSION
+ENV HEALTHCHECK_URL=http://localhost:8080/geoserver/web/wicket/resource/org.geoserver.web.GeoServerBasePage/img/logo.png
+ENV INSTALL_EXTENSIONS=false
+ENV POSTGRES_JNDI_ENABLED=false
+ENV ROOT_WEBAPP_REDIRECT=false
+ENV SKIP_DEMO_DATA=false
+ENV STABLE_EXTENSIONS=''
+ENV STABLE_PLUGIN_URL=$STABLE_PLUGIN_URL
+ENV WAR_ZIP_URL=$WAR_ZIP_URL
 
 # see https://docs.geoserver.org/stable/en/user/production/container.html
 ENV CATALINA_OPTS="\$EXTRA_JAVA_OPTS \
@@ -28,98 +55,32 @@ ENV CATALINA_OPTS="\$EXTRA_JAVA_OPTS \
     -Dsun.java2d.renderer=sun.java2d.marlin.DMarlinRenderingEngine \
     -Dorg.geotools.coverage.jaiext.enabled=true"
 
-# init
-RUN apt update \
-    && apt -y upgrade \
-    && apt install -y --no-install-recommends openssl unzip gdal-bin wget curl openjdk-11-jdk gettext \
-    && apt clean \
-    && rm -rf /var/cache/apt/* \
-    && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /opt/
-
-RUN wget -q https://archive.apache.org/dist/tomcat/tomcat-9/v${TOMCAT_VERSION}/bin/apache-tomcat-${TOMCAT_VERSION}.tar.gz \
-    && tar xf apache-tomcat-${TOMCAT_VERSION}.tar.gz \
-    && rm apache-tomcat-${TOMCAT_VERSION}.tar.gz \
-    && rm -rf /opt/apache-tomcat-${TOMCAT_VERSION}/webapps/ROOT \
-    && rm -rf /opt/apache-tomcat-${TOMCAT_VERSION}/webapps/docs \
-    && rm -rf /opt/apache-tomcat-${TOMCAT_VERSION}/webapps/examples \
-    && rm -rf /opt/apache-tomcat-${TOMCAT_VERSION}/webapps/host-manager \
-    && rm -rf /opt/apache-tomcat-${TOMCAT_VERSION}/webapps/manager
-
-# cleanup
-RUN apt purge -y  \
-    && apt autoremove --purge -y \
-    && rm -rf /var/lib/apt/lists/* \
-    && rm -rf /tmp/*
-
-FROM tomcat as download
-
-ARG GS_VERSION=2.24.1
-ARG GS_BUILD=release
-ARG WAR_ZIP_URL=https://downloads.sourceforge.net/project/geoserver/GeoServer/${GS_VERSION}/geoserver-${GS_VERSION}-war.zip
-ENV GEOSERVER_VERSION=$GS_VERSION
-ENV GEOSERVER_BUILD=$GS_BUILD
-
 WORKDIR /tmp
 
-RUN echo "Downloading GeoServer ${GS_VERSION} ${GS_BUILD}" \
+# Install dependencies and download geoserver
+RUN set -eux \
+    && export DEBIAN_FRONTEND=noninteractive \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends openssl unzip curl gettext \
+    && apt-get clean \
+    && rm -rf /var/cache/apt/* \
+    && rm -rf /var/lib/apt/lists/* \
+    && echo "Downloading GeoServer ${GS_VERSION} ${GS_BUILD}" \
     && wget -q -O /tmp/geoserver.zip $WAR_ZIP_URL \
     && unzip geoserver.zip geoserver.war -d /tmp/ \
     && unzip -q /tmp/geoserver.war -d /tmp/geoserver \
-    && rm /tmp/geoserver.war
-
-FROM tomcat as install
-
-ARG GS_VERSION=2.24.1
-ARG GS_BUILD=release
-ARG STABLE_PLUGIN_URL=https://downloads.sourceforge.net/project/geoserver/GeoServer/${GS_VERSION}/extensions
-ARG COMMUNITY_PLUGIN_URL=''
-
-ARG GS_DATA_PATH=./geoserver_data/
-ARG ADDITIONAL_LIBS_PATH=./additional_libs/
-ARG ADDITIONAL_FONTS_PATH=./additional_fonts/
-
-ENV GEOSERVER_VERSION=$GS_VERSION
-ENV GEOSERVER_BUILD=$GS_BUILD
-ENV GEOSERVER_DATA_DIR=/opt/geoserver_data/
-ENV GEOSERVER_REQUIRE_FILE=$GEOSERVER_DATA_DIR/global.xml
-ENV GEOSERVER_LIB_DIR=$CATALINA_HOME/webapps/geoserver/WEB-INF/lib/
-ENV INSTALL_EXTENSIONS=false
-ENV WAR_ZIP_URL=$WAR_ZIP_URL
-ENV STABLE_EXTENSIONS=''
-ENV STABLE_PLUGIN_URL=$STABLE_PLUGIN_URL
-ENV COMMUNITY_EXTENSIONS=''
-ENV COMMUNITY_PLUGIN_URL=$COMMUNITY_PLUGIN_URL
-ENV ADDITIONAL_LIBS_DIR=/opt/additional_libs/
-ENV ADDITIONAL_FONTS_DIR=/opt/additional_fonts/
-ENV SKIP_DEMO_DATA=false
-ENV ROOT_WEBAPP_REDIRECT=false
-ENV POSTGRES_JNDI_ENABLED=false
-ENV CONFIG_DIR=/opt/config
-ENV CONFIG_OVERRIDES_DIR=/opt/config_overrides
-ENV HEALTHCHECK_URL=http://localhost:8080/geoserver/web/wicket/resource/org.geoserver.web.GeoServerBasePage/img/logo.png
-
-EXPOSE 8080
-
-WORKDIR /tmp
-
-RUN echo "Installing GeoServer $GS_VERSION $GS_BUILD"
-
-COPY --from=download /tmp/geoserver $CATALINA_HOME/webapps/geoserver
-
-RUN mv $CATALINA_HOME/webapps/geoserver/WEB-INF/lib/marlin-*.jar $CATALINA_HOME/lib/marlin.jar \
-&& mkdir -p $GEOSERVER_DATA_DIR
-
-RUN mv $CATALINA_HOME/webapps/geoserver/WEB-INF/lib/postgresql-*.jar $CATALINA_HOME/lib/
+    && rm /tmp/geoserver.war \
+    && echo "Installing GeoServer $GS_VERSION $GS_BUILD" \
+    && mv /tmp/geoserver $CATALINA_HOME/webapps/geoserver \
+    && mv $CATALINA_HOME/webapps/geoserver/WEB-INF/lib/marlin-*.jar $CATALINA_HOME/lib/marlin.jar \
+    && mv $CATALINA_HOME/webapps/geoserver/WEB-INF/lib/postgresql-*.jar $CATALINA_HOME/lib/ \
+    && mkdir -p $GEOSERVER_DATA_DIR
 
+# Copy data and additional libs / fonts
 COPY $GS_DATA_PATH $GEOSERVER_DATA_DIR
 COPY $ADDITIONAL_LIBS_PATH $GEOSERVER_LIB_DIR
 COPY $ADDITIONAL_FONTS_PATH /usr/share/fonts/truetype/
 
-# cleanup
-RUN rm -rf /tmp/*
-
 # Add default configs
 COPY config $CONFIG_DIR
 
@@ -151,9 +112,21 @@ RUN chmod +x /opt/*.sh \
 
 USER geoserver
 
-ENTRYPOINT ["/opt/startup.sh"]
+# cleanup
+RUN apt purge -y  \
+  && apt autoremove --purge -y \
+  && rm -rf /tmp/ \
+  && rm -rf $CATALINA_HOME/webapps/ROOT \
+  && rm -rf $CATALINA_HOME/webapps/docs \
+  && rm -rf $CATALINA_HOME/webapps/examples \
+  && rm -rf $CATALINA_HOME/webapps/host-manager \
+  && rm -rf $CATALINA_HOME/webapps/manager
 
 WORKDIR /opt
 
+ENTRYPOINT ["/opt/startup.sh"]
+
+EXPOSE 8080
+
 HEALTHCHECK --interval=1m --timeout=20s --retries=3 \
   CMD curl --fail $HEALTHCHECK_URL || exit 1
diff --git a/README.md b/README.md
index 01a809e..44bbbb5 100644
--- a/README.md
+++ b/README.md
@@ -179,7 +179,6 @@ Following is the list of the all the environment variables that can be passed do
 | VAR NAME | DESCRIPTION | SAMPLE VALUE |
 |--------------|-----------|------------|
 | PATH | Used by geoserver internally to find all the libs | `/usr/local/sbin:/usr/local/bin:` |
-| CATALINA_HOME | CATALINA home path | `/opt/apache-tomcat-9.0.75` |
 | EXTRA_JAVA_OPTS | Used to pass params to the JAVA environment. Check [ref](https://docs.oracle.com/en/java/javase/11/tools/java.html) | `-Xms256m -Xmx1g` |
 | CORS_ENABLED | CORS enabled configuration | `false` |
 | CORS_ALLOWED_ORIGINS | CORS origins configuration | `*` |

From eeb400a0b1cc8e4c64fd5e12e57456a5d18410a9 Mon Sep 17 00:00:00 2001
From: Andre Henn <henn@terrestris.de>
Date: Wed, 7 Feb 2024 11:30:29 +0100
Subject: [PATCH 02/11] fix: typos

---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 44bbbb5..896f2c4 100644
--- a/README.md
+++ b/README.md
@@ -186,7 +186,7 @@ Following is the list of the all the environment variables that can be passed do
 | CORS_ALLOWED_HEADERS | CORS headers configuration | `*` |
 | DEBIAN_FRONTEND | Configures the Debian package manager frontend | `noninteractive`|
 | CATALINA_OPTS | Catalina options. Check [ref](https://www.baeldung.com/tomcat-catalina_opts-vs-java_opts) | `-Djava.awt.headless=true` |
-| GEOSERVER_DATA_DIR | Geosever data directory location | `/opt/geoserver_data/` |
+| GEOSERVER_DATA_DIR | Geoserver data directory location | `/opt/geoserver_data/` |
 | GEOSERVER_REQUIRE_FILE | Geoserver configuration used interally | `/opt/geoserver_data/global.xml` |
 | INSTALL_EXTENSIONS | Indicates whether additional GeoServer extensions should be installed | `false` |
 | WAR_ZIP_URL | Specifies the URL for a GeoServer Web Archive (WAR) file | |
@@ -204,7 +204,7 @@ The following values cannot really be safely changed (as they are used to downlo
 | VAR NAME | DESCRIPTION | SAMPLE VALUE |
 |--------------|-----------|------------|
 | GEOSERVER_VERSION | Geoserver version (used internally) | `2.24-SNAPSHOT`|
-| GEOSERVER_BUILD | Geosever build (used internally) | `1628` |
+| GEOSERVER_BUILD | Geoserver build (used internally) | `1628` |
 
 ## Troubleshooting
 

From 71ea072fd248ea2f0164c71cdb8a99aba102b174 Mon Sep 17 00:00:00 2001
From: Andre Henn <henn@terrestris.de>
Date: Wed, 7 Feb 2024 11:37:37 +0100
Subject: [PATCH 03/11] update readme regarding base image

---
 README.md | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/README.md b/README.md
index 896f2c4..0eca64f 100644
--- a/README.md
+++ b/README.md
@@ -1,15 +1,16 @@
-# A geoserver docker image
+# A GeoServer docker image
 
 This Dockerfile can be used to create images for all geoserver versions since 2.5.
 
-* Debian based Linux
-* OpenJDK 11
-* Tomcat 9
-* GeoServer
-  * Support of custom fonts (e.g. for SLD styling)
-  * CORS support
-  * Support extensions
-  * Support additional libraries
+* Based on the official [`tomcat` docker image](https://hub.docker.com/_/tomcat), in particular:
+  * Tomcat 9
+  * JRE11 (eclipse temurin)
+  * Ubuntu Jammy (22.04 LTS)
+* GeoServer installation is configurable and supports
+  * dynamic installation of extensions
+  * custom fonts (e.g. for SLD styling)
+  * CORS
+  * additional libraries
 
 This README.md file covers use of official docker image, additional [build](BUILD.md) and [release](RELEASE.md) instructions are available.
 

From ecda91baddaff45c60dee08aa1032cd1fbe53559 Mon Sep 17 00:00:00 2001
From: Andre Henn <henn@terrestris.de>
Date: Wed, 7 Feb 2024 11:38:13 +0100
Subject: [PATCH 04/11] bump version to current stable 2.24.2

---
 README.md               | 16 ++++++++--------
 RELEASE.md              | 10 +++++-----
 build/release.sh        |  2 +-
 docker-compose-demo.yml |  2 +-
 4 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/README.md b/README.md
index 0eca64f..f758390 100644
--- a/README.md
+++ b/README.md
@@ -19,20 +19,20 @@ This README.md file covers use of official docker image, additional [build](BUIL
 To pull an official image use ``docker.osgeo.org/geoserver:{{VERSION}}``, e.g.:
 
 ```shell
-docker pull docker.osgeo.org/geoserver:2.24.1
+docker pull docker.osgeo.org/geoserver:2.24.2
 ```
 All the images can be found at: [https://repo.osgeo.org](https://repo.osgeo.org)
 
 Afterwards you can run the pulled image locally with:
 
 ```shell
-docker run -it -p 80:8080 docker.osgeo.org/geoserver:2.24.1
+docker run -it -p 80:8080 docker.osgeo.org/geoserver:2.24.2
 ```
 
 Or if you want to start the container daemonized, use e.g.:
 
 ```shell
-docker run -d -p 80:8080 docker.osgeo.org/geoserver:2.24.1
+docker run -d -p 80:8080 docker.osgeo.org/geoserver:2.24.2
 ```
 
 Check <http://localhost/geoserver> to see the geoserver page,
@@ -49,7 +49,7 @@ To use an external folder as your geoserver data directory.
 ```shell
 docker run -it -p 80:8080 \
   --mount src="/absolute/path/on/host",target=/opt/geoserver_data/,type=bind \
-  docker.osgeo.org/geoserver:2.24.1
+  docker.osgeo.org/geoserver:2.24.2
 ```
 
 An empty data directory will be populated on first use. You can easily update GeoServer while
@@ -64,7 +64,7 @@ The environment variable `SKIP_DEMO_DATA` can be set to `true` to create an empt
 ```shell
 docker run -it -p 80:8080 \
   --env SKIP_DEMO_DATA=true \
-  docker.osgeo.org/geoserver:2.24.1
+  docker.osgeo.org/geoserver:2.24.2
 ```
 
 ## How to issue a redirect from the root ("/") to GeoServer web interface ("/geoserver/web")?
@@ -90,7 +90,7 @@ Example installing wps and ysld extensions:
 ```shell
 docker run -it -p 80:8080 \
   --env INSTALL_EXTENSIONS=true --env STABLE_EXTENSIONS="wps,ysld" \
-  docker.osgeo.org/geoserver:2.24.1
+  docker.osgeo.org/geoserver:2.24.2
 ```
 
 The list of extensions (taken from SourceForge download page):
@@ -115,7 +115,7 @@ If you want to add geoserver extensions/libs, place the respective jar files in
 ```shell
 docker run -it -p 80:8080 \
   --mount src="/dir/with/libs/on/host",target=/opt/additional_libs,type=bind \
-  docker.osgeo.org/geoserver:2.24.1
+  docker.osgeo.org/geoserver:2.24.2
 ```
 
 ## How to add additional fonts to the docker image (e.g. for SLD styling)?
@@ -125,7 +125,7 @@ If you want to add custom fonts (the base image only contains 26 fonts) by using
 ```shell
 docker run -it -p 80:8080 \
   --mount src="/dir/with/fonts/on/host",target=/opt/additional_fonts,type=bind \
-  docker.osgeo.org/geoserver:2.24.1
+  docker.osgeo.org/geoserver:2.24.2
 ```
 
 **Note:** Do not change the target value!
diff --git a/RELEASE.md b/RELEASE.md
index ec50fa8..5acf0ec 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -7,7 +7,7 @@ OSGeo maintains geoserver-docker.osgeo.org repository for publishing. The result
 Build locally:
 
 ```shell
-docker build -t geoserver-docker.osgeo.org/geoserver:2.24.1 .
+docker build -t geoserver-docker.osgeo.org/geoserver:2.24.2 .
 ```
 
 Login using with osgeo user id:
@@ -19,7 +19,7 @@ docker login geoserver-docker.osgeo.org
 Push to osgeo repository:
 
 ```shell
-docker push geoserver-docker.osgeo.org/geoserver:2.24.1
+docker push geoserver-docker.osgeo.org/geoserver:2.24.2
 ```
 
 ## How to automate release?
@@ -34,10 +34,10 @@ The third, optional, is used to supply the jenkins build number - triggering a n
 
 Examples:
 
-`./release.sh build 2.24.1`
+`./release.sh build 2.24.2`
 
-`./release.sh publish 2.24.1`
+`./release.sh publish 2.24.2`
 
-`./release.sh buildandpublish 2.24.1`
+`./release.sh buildandpublish 2.24.2`
 
 `./release.sh buildandpublish 2.24-SNAPSHOT 1234`
diff --git a/build/release.sh b/build/release.sh
index 99a5c5e..1dedb0d 100755
--- a/build/release.sh
+++ b/build/release.sh
@@ -9,7 +9,7 @@ function usage() {
   echo "$0 <mode> <version> [<build>]"
   echo ""
   echo " mode : The mode. Choose one of 'build', 'publish' or 'buildandpublish'"
-  echo " version : The released version to build an docker image for (eg: 2.24.1, ${MAIN}-SNAPSHOT, ${MAIN}-RC)"
+  echo " version : The released version to build an docker image for (eg: 2.24.2, ${MAIN}-SNAPSHOT, ${MAIN}-RC)"
   echo " build : Build number (optional)"
 }
 
diff --git a/docker-compose-demo.yml b/docker-compose-demo.yml
index 8de1fc4..c7cf0f8 100644
--- a/docker-compose-demo.yml
+++ b/docker-compose-demo.yml
@@ -4,7 +4,7 @@ services:
     build:
       context: .
       args:
-        - GEOSERVER_VERSION=2.24.1
+        - GEOSERVER_VERSION=2.24.2
         - CORS_ENABLED=true
         - CORS_ALLOWED_METHODS=GET,POST,PUT,HEAD,OPTIONS
     ports:

From 2de74a9bd1fff67b8c5d2a030938b7255b4536b1 Mon Sep 17 00:00:00 2001
From: Andre Henn <henn@terrestris.de>
Date: Fri, 9 Feb 2024 09:59:56 +0100
Subject: [PATCH 05/11] use JDK rather than JRE

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index d1d756c..b95317e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM tomcat:9.0.85-jre11-temurin-jammy
+FROM tomcat:9.0.85-jdk11-temurin-jammy
 LABEL vendor="osgeo.org"
 
 # Build arguments

From 577a428c9c4f6fc544e9d078c238345173ef269a Mon Sep 17 00:00:00 2001
From: Andre Henn <henn@terrestris.de>
Date: Fri, 9 Feb 2024 10:00:28 +0100
Subject: [PATCH 06/11] perform cleanup before geoserver user is set as current
 user

---
 Dockerfile | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index b95317e..6917c0d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -100,6 +100,18 @@ COPY *.sh /opt/
 # CIS Docker benchmark: Remove setuid and setgid permissions in the images to prevent privilege escalation attacks within containers.
 RUN find / -perm /6000 -type f -exec chmod a-s {} \; || true
 
+
+# cleanup
+RUN apt purge -y  \
+  && apt autoremove --purge -y \
+  && rm -rf /tmp/ \
+  && rm -rf $CATALINA_HOME/webapps/ROOT \
+  && rm -rf $CATALINA_HOME/webapps/docs \
+  && rm -rf $CATALINA_HOME/webapps/examples \
+  && rm -rf $CATALINA_HOME/webapps/host-manager \
+  && rm -rf $CATALINA_HOME/webapps/manager
+
+
 # GeoServer user => restrict access to $CATALINA_HOME and GeoServer directories
 # See also CIS Docker benchmark and docker best practices
 RUN chmod +x /opt/*.sh \
@@ -112,16 +124,6 @@ RUN chmod +x /opt/*.sh \
 
 USER geoserver
 
-# cleanup
-RUN apt purge -y  \
-  && apt autoremove --purge -y \
-  && rm -rf /tmp/ \
-  && rm -rf $CATALINA_HOME/webapps/ROOT \
-  && rm -rf $CATALINA_HOME/webapps/docs \
-  && rm -rf $CATALINA_HOME/webapps/examples \
-  && rm -rf $CATALINA_HOME/webapps/host-manager \
-  && rm -rf $CATALINA_HOME/webapps/manager
-
 WORKDIR /opt
 
 ENTRYPOINT ["/opt/startup.sh"]

From bba764fe9af363d2470a14f12c46df3bd718cbcb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Henn?= <henn@terrestris.de>
Date: Tue, 20 Feb 2024 14:23:45 +0100
Subject: [PATCH 07/11] Update Dockerfile

Co-authored-by: Mark Prins <1165786+mprins@users.noreply.github.com>
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 6917c0d..970d367 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM tomcat:9.0.85-jdk11-temurin-jammy
+FROM tomcat:9.0.86-jdk11-temurin-jammy
 LABEL vendor="osgeo.org"
 
 # Build arguments

From f22cb29910f77b31c36970e26b58a19b1afe7c5d Mon Sep 17 00:00:00 2001
From: Andre Henn <henn@terrestris.de>
Date: Thu, 27 Jun 2024 14:53:54 +0200
Subject: [PATCH 08/11] adds newline

---
 update_credentials.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/update_credentials.sh b/update_credentials.sh
index 599ae9f..2f22081 100644
--- a/update_credentials.sh
+++ b/update_credentials.sh
@@ -68,4 +68,4 @@ else
     exit
 fi
 
-echo "... DONE updating GeoServer Credentials ..."
\ No newline at end of file
+echo "... DONE updating GeoServer Credentials ..."

From 9abb0c62dd963c04828f87bc0c48d02136ac5fce Mon Sep 17 00:00:00 2001
From: Andre Henn <henn@terrestris.de>
Date: Thu, 11 Jul 2024 11:16:12 +0200
Subject: [PATCH 09/11] update geoserver version

---
 BUILD.md   | 18 +++++++++---------
 Dockerfile |  2 +-
 README.md  |  4 ++--
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/BUILD.md b/BUILD.md
index a711ff9..d952e89 100644
--- a/BUILD.md
+++ b/BUILD.md
@@ -65,14 +65,14 @@ Override these arguments to make use of build.geoserver.org nightly releases:
 * ``--build-arg STABLE_PLUGIN_URL=https://build.geoserver.org/geoserver/${GS_VERSION}/ext-latest/``
 * ``--build-arg COMMUNITY_PLUGIN_URL=https://build.geoserver.org/geoserver/${GS_VERSION}/community-latest/``
 
-Here is a working example for building 2.24.x nightly build::
+Here is a working example for building 2.25.x nightly build::
 ```
 docker build --no-cache-filter download,install \
-  --build-arg WAR_ZIP_URL=https://build.geoserver.org/geoserver/2.24.x/geoserver-2.24.x-latest-war.zip \
-  --build-arg STABLE_PLUGIN_URL=https://build.geoserver.org/geoserver/2.24.x/ext-latest/ \
-  --build-arg COMMUNITY_PLUGIN_URL=https://build.geoserver.org/geoserver/2.24.x/community-latest/ \
+  --build-arg WAR_ZIP_URL=https://build.geoserver.org/geoserver/2.25.x/geoserver-2.25.x-latest-war.zip \
+  --build-arg STABLE_PLUGIN_URL=https://build.geoserver.org/geoserver/2.25.x/ext-latest/ \
+  --build-arg COMMUNITY_PLUGIN_URL=https://build.geoserver.org/geoserver/2.25.x/community-latest/ \
   --build-arg GS_VERSION=2.24-SNAPSHOT \
-  -t 2.24.x .
+  -t 2.25.x .
 ```
 
 When running both stable extensions and community modules can be included:
@@ -82,7 +82,7 @@ docker run -it -p 80:8080 \
   --env INSTALL_EXTENSIONS=true \
   --env STABLE_EXTENSIONS="ysld" \
   --env COMMUNITY_EXTENSIONS="ogcapi" \
-  -t 2.24.x
+  -t 2.25.x
 ```
 
 Community modules are only available for nightly builds as they have not yet met the requirements for production use. Developers have shared these to attract participation, feedback and funding.
@@ -96,7 +96,7 @@ The build.geoserver.org output for the ``main`` branch requires the following:
 * ``--build-arg COMMUNITY_PLUGIN_URL=https://build.geoserver.org/geoserver/main/community-latest/``
 
 
-Here is a working example for building main branch as 2.24.x build:
+Here is a working example for building main branch as 2.25.x build:
 
 ```
 docker build --no-cache-filter download,install \
@@ -104,7 +104,7 @@ docker build --no-cache-filter download,install \
   --build-arg STABLE_PLUGIN_URL=https://build.geoserver.org/geoserver/main/ext-latest/ \
   --build-arg COMMUNITY_PLUGIN_URL=https://build.geoserver.org/geoserver/main/community-latest/ \
   --build-arg GS_VERSION=2.24-SNAPSHOT \
-  -t 2.24.x .
+  -t 2.25.x .
 ```
 
 When running both [stable extensions](https://build.geoserver.org/geoserver/main/ext-latest/) and [community modules](https://build.geoserver.org/geoserver/main/community-latest/) can be included:
@@ -114,6 +114,6 @@ docker run -it -p 80:8080 \
   --env INSTALL_EXTENSIONS=true \
   --env STABLE_EXTENSIONS="wps,css" \
   --env COMMUNITY_EXTENSIONS="ogcapi-coverages,ogcapi-dggs,ogcapi-features,ogcapi-images,ogcapi-maps,ogcapi-styles,ogcapi-tiled-features,ogcapi-tiles" \
-  -t 2.24.x
+  -t 2.25.x
 ```
 
diff --git a/Dockerfile b/Dockerfile
index fa3aa7b..fed3695 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,7 +12,7 @@ ARG CORS_ALLOW_CREDENTIALS=false
 ARG CORS_ENABLED=false
 ARG GS_BUILD=release
 ARG GS_DATA_PATH=./geoserver_data/
-ARG GS_VERSION=2.24.2
+ARG GS_VERSION=2.25.2
 ARG STABLE_PLUGIN_URL=https://downloads.sourceforge.net/project/geoserver/GeoServer/${GS_VERSION}/extensions
 ARG WAR_ZIP_URL=https://downloads.sourceforge.net/project/geoserver/GeoServer/${GS_VERSION}/geoserver-${GS_VERSION}-war.zip
 
diff --git a/README.md b/README.md
index 843d589..75471f4 100644
--- a/README.md
+++ b/README.md
@@ -209,9 +209,9 @@ Following is the list of the all the environment variables that can be passed do
 | INSTALL_EXTENSIONS | Indicates whether additional GeoServer extensions should be installed | `false` |
 | WAR_ZIP_URL | Specifies the URL for a GeoServer Web Archive (WAR) file | |
 | STABLE_EXTENSIONS | Specifies stable GeoServer extensions | |
-| STABLE_PLUGIN_URL | Specifies the URL for downloading the latest stable GeoServer plugins | `https://build.geoserver.org/geoserver/2.24.x/ext-latest` |
+| STABLE_PLUGIN_URL | Specifies the URL for downloading the latest stable GeoServer plugins | `https://build.geoserver.org/geoserver/2.25.x/ext-latest` |
 | COMMUNITY_EXTENSIONS | Specifies community-contributed GeoServer extensions | |
-| COMMUNITY_PLUGIN_URL | Specifies the URL for downloading the latest community-contributed GeoServer plugins | `https://build.geoserver.org/geoserver/2.24.x/community-latest` |
+| COMMUNITY_PLUGIN_URL | Specifies the URL for downloading the latest community-contributed GeoServer plugins | `https://build.geoserver.org/geoserver/2.25.x/community-latest` |
 | ADDITIONAL_LIBS_DIR | Sets the directory for additional libraries used by GeoServer | `/opt/additional_libs/` |
 | ADDITIONAL_FONTS_DIR | Sets the directory for additional fonts used by GeoServer | `/opt/additional_fonts/` |
 | SKIP_DEMO_DATA | Indicates whether to skip the installation of demo data provided by GeoServer | `false` |

From 97ea9096074cfc0c02744d383435e365e00e771d Mon Sep 17 00:00:00 2001
From: Andre Henn <henn@terrestris.de>
Date: Thu, 11 Jul 2024 11:16:44 +0200
Subject: [PATCH 10/11] use tomcat 9.0.91

---
 Dockerfile | 2 +-
 README.md  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index fed3695..f01a0d5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM tomcat:9.0.90-jdk11-temurin-jammy
+FROM tomcat:9.0.91-jdk11-temurin-jammy
 LABEL vendor="osgeo.org"
 
 # Build arguments
diff --git a/README.md b/README.md
index 75471f4..9b68807 100644
--- a/README.md
+++ b/README.md
@@ -196,7 +196,7 @@ Following is the list of the all the environment variables that can be passed do
 | VAR NAME | DESCRIPTION | SAMPLE VALUE |
 |--------------|-----------|------------|
 | PATH | Used by geoserver internally to find all the libs | `/usr/local/sbin:/usr/local/bin:` |
-| CATALINA_HOME | CATALINA home path | `/usr/local/tomcat` (see also [here](https://github.com/docker-library/tomcat/blob/master/9.0/jdk17/temurin-jammy/Dockerfile)) |
+| CATALINA_HOME | CATALINA home path | `/usr/local/tomcat` (see also [here](https://github.com/docker-library/tomcat/blob/master/9.0/jdk11/temurin-jammy/Dockerfile)) |
 | EXTRA_JAVA_OPTS | Used to pass params to the JAVA environment. Check [ref](https://docs.oracle.com/en/java/javase/11/tools/java.html) | `-Xms256m -Xmx1g` |
 | CORS_ENABLED | CORS enabled configuration | `false` |
 | CORS_ALLOWED_ORIGINS | CORS origins configuration | `*` |

From 257c96a98b14bdccdc9f694337efa46187628c08 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Henn?= <henn@terrestris.de>
Date: Thu, 18 Jul 2024 17:19:06 +0200
Subject: [PATCH 11/11] replace JRE by JDK in Readme
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Nils Bühner <buehner@terrestris.de>
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 9b68807..8e7fb14 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@ This Dockerfile can be used to create images for all geoserver versions since 2.
 
 * Based on the official [`tomcat` docker image](https://hub.docker.com/_/tomcat), in particular:
   * Tomcat 9
-  * JRE11 (eclipse temurin)
+  * JDK11 (eclipse temurin)
   * Ubuntu Jammy (22.04 LTS)
 * GeoServer installation is configurable and supports
   * Dynamic installation of extensions