-
Notifications
You must be signed in to change notification settings - Fork 17
Description
Problem
All docker-compose configurations in this repository currently use the bitnamilegacy/keycloak image (bitnamilegacy/keycloak:${KEYCLOAK_SERVER_VERSION}).
This image is no longer maintained by Bitnami and contains known CVEs, making it a security risk for anyone running these distributions.
This change is aligned with the official Camunda documentation, which has already been updated to remove references to Bitnami images and recommend the Camunda-maintained Keycloak images instead. See: https://docs.camunda.io/docs/self-managed/deployment/helm/configure/vendor-supported-infrastructure/ and https://docs.camunda.io/docs/self-managed/deployment/helm/configure/registry-and-images/install-bitnami-enterprise-images/#why-camunda-uses-bitnami-premium-images
Proposed solution
Replace the bitnamilegacy/keycloak image with the officially maintained Camunda Keycloak images:
- Keycloak image from Quay.io: use the Camunda-maintained Keycloak image available https://github.com/camunda/keycloak
Additional notes
- The
POSTGRES_DB=bitnami_keycloakandIDENTITY_DATABASE_NAME: bitnami_keycloakreferences should also be updated to reflect the new image naming. - Volume mount paths (
/opt/bitnami/keycloak/themes/identity) will need to be adjusted to match the directory structure of the new Keycloak images (likely/opt/keycloak/themes/identity). But with the images of camunda/keyclaok, this is not required anymore, it's embedded - Environment variables and entrypoint configuration may differ between the Bitnami image and the official Keycloak/Camunda images and should be verified.