Running Tomcat as a Systemd Service

Why Systemd

Running Tomcat via systemd gives you auto-start on boot, automatic restarts, logs in the journal and clean privilege dropping for ports 80/443.

Create the Service

sudo useradd -r -s /usr/sbin/nologin tomcat
sudo chown -R tomcat:tomcat /opt/tomcat

cat > /etc/systemd/system/tomcat.service <<EOF
[Unit]
Description=Apache Tomcat
After=network.target

[Service]
Type=forking
User=tomcat
Group=tomcat
Environment="JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64"
Environment="CATALINA_HOME=/opt/tomcat"
Environment="CATALINA_BASE=/opt/tomcat"
ExecStart=/opt/tomcat/bin/catalina.sh start
ExecStop=/opt/tomcat/bin/catalina.sh stop
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOF

Enable and Start

sudo systemctl daemon-reload
sudo systemctl enable --now tomcat
sudo systemctl status tomcat
journalctl -u tomcat -f

Binding Ports 80/443 Without Root

Grant the tomcat user permission to bind low ports, then change the connector to 80:

sudo setcap CAP_NET_BIND_SERVICE=+ep /usr/lib/jvm/java-21-openjdk-amd64/bin/java
# in server.xml: port="80" scheme="http"

Alternatively reverse-proxy behind nginx - recommended for production.

Clean Shutdown

sudo systemctl stop tomcat   # runs catalina.sh stop; waits for cleanup

Key Points

• Systemd = boot persistence + crash restart + unified logs.
• Run as a dedicated non-root user, never root.
• Use setcap or nginx for low ports instead of running as root.