Recommended Free Tools
This guide installs the maintained Apache Tomcat 10.1.x branch on Ubuntu Server 24.04 LTS (Noble) or 22.04 LTS (Jammy). As of August 16, 2026, Apache lists 10.1.57 as the latest 10.1 release; confirm the current version at the official Tomcat 10 download page before you begin. Tomcat 10.0.x reached end of life on October 31, 2022, so it is not appropriate for a new deployment.
The procedure uses OpenJDK 21, a dedicated non-login tomcat account, an Apache binary archive under /opt/tomcat, and a foreground systemd service. At the end, Tomcat starts at boot and responds on port 8080.
As an Amazon Associate I earn from qualifying purchases.
Prerequisites
- Ubuntu Server 24.04 LTS or 22.04 LTS.
- A user with
sudoprivileges. - Network access to Ubuntu repositories and Apache download mirrors.
- Enough disk space for Tomcat, applications, logs, and backups.
- For remote testing, a server IP or DNS name. Open TCP 8080 in UFW and your cloud provider firewall only when required.
Tomcat should not run as root. For production, normally place it behind Nginx or Apache HTTP Server, terminate TLS on ports 80/443, and keep port 8080 private.
Choose a distribution method
| Method | Strengths | Trade-offs |
|---|---|---|
| Official Apache archive | Current upstream release, exact version pinning, predictable /opt/tomcat layout |
You maintain the service unit and upgrades |
Ubuntu apt package |
Distribution-managed updates and integration | Version, paths, and service details depend on the Ubuntu release |
| Container | Immutable application lifecycle and CI/CD integration | Different operational model from a host-managed systemd service |
The commands below use the official archive. Do not install both archive and package versions on one host unless you deliberately manage their separate services and ports.
#1 Best Overall
Install OpenJDK
Tomcat 10.1 requires Java 11 or later. Ubuntu documents OpenJDK 17 and 21 for both target releases; Java 21 is a sensible LTS default. Apache’s compatibility table is at tomcat.apache.org/whichversion.
sudo apt update
sudo apt install -y openjdk-21-jdk curl wget tar ca-certificates
java -versionThe patch number will change as Ubuntu updates Java. Derive the installation directory rather than hard-coding a patch version:
JAVA_HOME="$(dirname "$(dirname "$(readlink -f "$(command -v java)")")")"
echo "$JAVA_HOME"A typical amd64 result is /usr/lib/jvm/java-21-openjdk-amd64. Java 17 is also valid:
sudo apt install -y openjdk-17-jdkWith Java 17, JAVA_HOME is normally /usr/lib/jvm/java-17-openjdk-amd64. Ubuntu’s availability reference is ubuntu.com/developers/docs/reference/availability/java/.
Create the Tomcat account
sudo groupadd --system tomcat
sudo useradd --system --gid tomcat
--home-dir /opt/tomcat
--shell /usr/sbin/nologin
tomcat
sudo mkdir -p /opt/tomcat/opt is a conventional location for manually installed third-party software. The system account owns the runtime but has no interactive login shell; do not unpack Tomcat inside /root or a normal user’s home directory.
Download and verify Tomcat 10.1
Set the version to the release shown on Apache’s download page. The following uses 10.1.57 as the version listed on August 16, 2026:
TOMCAT_VERSION=10.1.57
cd /tmp
wget "https://downloads.apache.org/tomcat/tomcat-10/v${TOMCAT_VERSION}/bin/apache-tomcat-${TOMCAT_VERSION}.tar.gz"
wget "https://downloads.apache.org/tomcat/tomcat-10/v${TOMCAT_VERSION}/bin/apache-tomcat-${TOMCAT_VERSION}.tar.gz.sha512"Verify the SHA-512 checksum before extracting:
sha512sum -c "apache-tomcat-${TOMCAT_VERSION}.tar.gz.sha512"A successful check includes apache-tomcat-10.1.57.tar.gz: OK. A checksum proves the file was not accidentally corrupted, but OpenPGP verification provides stronger authenticity checking. Apache publishes release guidance at apache.org/dyn/closer.cgi/tomcat/:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
wget https://downloads.apache.org/tomcat/KEYS
wget "https://downloads.apache.org/tomcat/tomcat-10/v${TOMCAT_VERSION}/bin/apache-tomcat-${TOMCAT_VERSION}.tar.gz.asc"
gpg --import KEYS
gpg --verify
"apache-tomcat-${TOMCAT_VERSION}.tar.gz.asc"
"apache-tomcat-${TOMCAT_VERSION}.tar.gz"Inspect the signer and its trust status; do not treat any “Good signature” message as proof that you identified the expected release manager.
Install under a versioned directory
A versioned directory plus a stable symlink makes upgrades and rollback straightforward:
sudo tar -xzf
"/tmp/apache-tomcat-${TOMCAT_VERSION}.tar.gz"
-C /opt
sudo ln -sfn
"/opt/apache-tomcat-${TOMCAT_VERSION}"
/opt/tomcat
sudo chown -R tomcat:tomcat "/opt/apache-tomcat-${TOMCAT_VERSION}"
sudo chown -h tomcat:tomcat /opt/tomcat
sudo chmod +x /opt/tomcat/bin/*.sh
sudo -u tomcat mkdir -p /opt/tomcat/{logs,temp,work}The archive includes the default ROOT, docs, examples, and, where installed, administrative applications. Review them before production exposure.
Create the systemd service
Create /etc/systemd/system/tomcat.service:
[Unit]
Description=Apache Tomcat 10.1
After=network.target
[Service]
Type=simple
User=tomcat
Group=tomcat
Environment="JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64"
Environment="CATALINA_HOME=/opt/tomcat"
Environment="CATALINA_BASE=/opt/tomcat"
Environment="CATALINA_PID=/opt/tomcat/temp/tomcat.pid"
ExecStart=/opt/tomcat/bin/catalina.sh run
ExecStop=/bin/kill -15 $MAINPID
Restart=on-failure
RestartSec=10
SuccessExitStatus=143
UMask=0027
[Install]
WantedBy=multi-user.targetIf you installed Java 17, change JAVA_HOME to its directory. catalina.sh run keeps Tomcat in the foreground, allowing systemd to supervise the real process and place output in the journal. Apache’s Unix setup documentation is tomcat.apache.org/tomcat-10.1-doc/setup.html.
sudo systemctl daemon-reload
sudo systemctl enable --now tomcat
sudo systemctl status tomcat --no-pagerFollow service output with:
sudo journalctl -u tomcat -fTest port 8080
curl -I http://127.0.0.1:8080/Look for an HTTP success status such as HTTP/1.1 200; headers vary by release. From another machine, open http://SERVER_IP:8080. If UFW is enabled and direct access is intentional:
sudo ufw allow 8080/tcp
sudo ufw statusCloud security groups and provider firewalls must also allow the connection. For production, prefer a reverse proxy with HTTPS and restrict Tomcat to loopback or an internal network.
Verify service and process state
systemctl is-enabled tomcat
systemctl is-active tomcat
sudo ss -ltnp | grep ':8080'
ps -fu tomcat
sudo -u tomcat /opt/tomcat/bin/version.sh
sudo journalctl -u tomcat -n 100 --no-pager
tail -f /opt/tomcat/logs/catalina.outHarden the installation
Remove unnecessary applications
ls -la /opt/tomcat/webapps
sudo rm -rf /opt/tomcat/webapps/docs
sudo rm -rf /opt/tomcat/webapps/examplesRemove only applications you do not need. Never expose Manager or Host Manager publicly without source-IP restrictions, HTTPS, strong unique credentials, and preferably VPN or firewall access. Authentication and the applications’ IP restrictions are separate controls.
Review permissions
sudo chown -R tomcat:tomcat /opt/tomcat
sudo find /opt/tomcat -type d -exec chmod 750 {} ;
sudo find /opt/tomcat -type f -exec chmod 640 {} ;
sudo chmod 750 /opt/tomcat/bin/*.shAdjust this policy for applications that need writable uploads, external configuration, or log-collector access.
Disable the shutdown listener
If the TCP shutdown port is unnecessary, edit /opt/tomcat/conf/server.xml:
<Server port="-1" shutdown="SHUTDOWN">Systemd then handles service shutdown instead of Tomcat’s default port 8005.
Set workload-appropriate JVM options
Create /opt/tomcat/bin/setenv.sh:
#!/bin/sh
export CATALINA_OPTS="$CATALINA_OPTS \
-Xms512m \
-Xmx1024m \
-XX:+UseG1GC"sudo chown tomcat:tomcat /opt/tomcat/bin/setenv.sh
sudo chmod 750 /opt/tomcat/bin/setenv.sh
sudo systemctl restart tomcatThe values are examples, not a capacity recommendation. Size the heap from available RAM and application workload.
Upgrade safely
- Download and verify the new archive.
- Extract it beside the current version in
/opt. - Copy only intentionally customized configuration and application files after reviewing release notes.
- Stop Tomcat, switch the
/opt/tomcatsymlink, repair ownership, and start the service. - Test the application and retain the previous directory for rollback until validation is complete.
Do not blindly replace a new conf directory with the old one; configuration changes between releases require review.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Ubuntu package alternative
Inspect the repository for your exact Ubuntu release first:
Best Value
apt-cache policy tomcat10
apt-cache show tomcat10sudo apt update
sudo apt install -y tomcat10
systemctl status tomcat10
systemctl cat tomcat10Ubuntu packages may use paths such as /etc/tomcat10, /var/lib/tomcat10, and /var/log/tomcat10, and may not contain the newest upstream release. Package metadata is available at packages.ubuntu.com. Do not apply the /opt/tomcat service instructions to that layout.
Troubleshooting
Java is missing or JAVA_HOME is wrong
java -version
command -v java
readlink -f "$(command -v java)"
echo "$JAVA_HOME"JAVA_HOME must name the Java directory, not bin/java. Install Java with sudo apt install -y openjdk-21-jdk, correct the unit, then run sudo systemctl daemon-reload and sudo systemctl restart tomcat.
Checksum verification fails
Do not extract the file. Recheck that the archive and checksum use the same version, inspect whether a proxy returned HTML, and download both files again from Apache.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11sha512sum "apache-tomcat-${TOMCAT_VERSION}.tar.gz"
cat "apache-tomcat-${TOMCAT_VERSION}.tar.gz.sha512"systemd cannot start Tomcat
sudo systemctl status tomcat --no-pager
sudo journalctl -u tomcat -b --no-pager
sudo systemctl cat tomcat
sudo -u tomcat test -r /opt/tomcat/bin/catalina.sh
sudo -u tomcat test -w /opt/tomcat/logs
sudo -u tomcat test -w /opt/tomcat/temp
sudo -u tomcat test -w /opt/tomcat/workPort 8080 is occupied
sudo ss -ltnp | grep ':8080'Stop the conflicting service or change Tomcat’s connector in /opt/tomcat/conf/server.xml, then restart Tomcat.
The browser cannot connect
Check service state, listening address, UFW, cloud firewall rules, security groups, and the destination IP. A listener bound only to loopback is intentionally unreachable from other machines.
The application fails after deployment
sudo journalctl -u tomcat -n 200 --no-pager
sudo tail -n 200 /opt/tomcat/logs/catalina.outApplications migrated from Tomcat 9 may require changes because Tomcat 10 uses the jakarta.* namespace instead of javax.*. Confirm framework, dependency, servlet descriptor, and deployment compatibility before switching production servers; see Tomcat’s download and migration information.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
