Keycloak 17 docker container : How to export/import realm? (import must be done on container startup)

Getting advice
22

The following docker-compose works for me:

services:
  auth:
    image: quay.io/keycloak/keycloak:18.0
    ports:
      - "8080:8080"
    environment:
      KEYCLOAK_ADMIN: admin 
      KEYCLOAK_ADMIN_PASSWORD: admin
    command: 
      - start-dev 
      - --import-realm
    volumes:
      - ./docker/auth/realm.json:/opt/keycloak/data/import/realm.json
5 Likes
23

Hi,

We solved this with the following config :

Custom Dockerfile to automate import

FROM quay.io/keycloak/keycloak:18.0.2
# Must add json files before import, volume is not mounted yet
ADD ./realms /opt/keycloak/data/import/
# Import all files
RUN /opt/keycloak/bin/kc.sh import --dir=/opt/keycloak/data/import/ --override true; exit 0
# Start image
ENTRYPOINT ["/opt/keycloak/bin/kc.sh", "-v", "start-dev"]

  keycloak:
    build:
      ./keycloak/
    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
    container_name: my-keycloak
    volumes:
      - ./keycloak/conf:/opt/keycloak/conf
      - ./keycloak/realms:/opt/keycloak/data/import
      - ./keycloak/themes:/opt/keycloak/themes
    ports:

Be sure to use ‘docker-compose up --build -d’ to import realms.

++

1 Like
24

Thanks for idea. I spent half of the day to reach test environment with prepared data.
This thread doesn’t have how to get data from docker. I share.
First we need to understand how to get data.

docker run -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin -p 127.0.0.1:8080:8080 --rm -it --entrypoint bash quay.io/keycloak/keycloak:20.0.1

this command start without running keycloak and you can run with bash
/opt/keycloak/bin/kc.sh start-dev
Now we can add client and users. Open link http://localhost:8080/admin/. After stop server and execute next command to import data to directory
/opt/keycloak/bin/kc.sh export --dir /tmp/import
copy from containter to localhost , execute from localhost where 4eb45b6c5063 - CONTAINER ID of the container , to find CONTAINER ID execute command docker ps
docker cp 4eb45b6c5063:/tmp/import/ ./
Now we can create docker file and build

FROM quay.io/keycloak/keycloak:20.0.1
ADD ./import /opt/keycloak/data/import
RUN /opt/keycloak/bin/kc.sh import --dir=/opt/keycloak/data/import/ --override true; exit 0
ENTRYPOINT ["/opt/keycloak/bin/kc.sh", "-v"]`

Build docker build -t gdev.by/keycloak:0.2 .
and run docker docker run -p 127.0.0.1:8080:8080 -t gdev.by/keycloak:0.2 start-dev

1 Like
25

in Quay it is possible import without any problem. You need to select realm-settings and in right up corner click on actions and export.

26

For anyone messing with docker & bitnami/keycloak, I have a working solution to import both a custom master (/import/master) and a dev (/import/dev-realm) realm (dev-realm in my case):

.env:

COMPOSE_FILE_SEPARATOR=;
COMPOSE_FILE=keycloak-compose.yaml

KEYCLOAK_VERSION=19.0.3-debian-11-r15
KEYCLOAK_USER=dev
KEYCLOAK_PASSWORD=dev
KEYCLOAK_POSTGRES_VERSION=14.2.0
KEYCLOAK_POSTGRES_DATABASE=dev
KEYCLOAK_POSTGRES_USER=dev
KEYCLOAK_POSTGRES_PASSWORD=dev

keycloak-compose.yaml:

volumes:
  bitnami-keycloak-pg-data:
    name: bitnami-keycloak-pg-data
    driver: local
  bitnami-keycloak-pg-preinitdb:
    name: bitnami-keycloak-pg-preinitdb
    driver: local
  bitnami-keycloak-pg-initdb:
    name: bitnami-keycloak-pg-initdb
    driver: local

services:
  keycloak-x-pg:
    container_name: ws-keycloak-x-pg
    image: docker.io/bitnami/postgresql:${KEYCLOAK_POSTGRES_VERSION}
    restart: unless-stopped
    ports:
      - 8002:5432
    environment:
      POSTGRESQL_DATABASE: ${KEYCLOAK_POSTGRES_DATABASE}
      POSTGRESQL_USERNAME: ${KEYCLOAK_POSTGRES_USER}
      POSTGRESQL_PASSWORD: ${KEYCLOAK_POSTGRES_PASSWORD}
    networks:
      - bitnami
    volumes:
      - bitnami-keycloak-pg-data:/bitnami/postgresql
      - bitnami-keycloak-pg-preinitdb:/docker-entrypoint-preinitdb.d
      - bitnami-keycloak-pg-initdb:/docker-entrypoint-initdb.d

  keycloak-x:
    container_name: ws-keycloak-x
    image: docker.io/bitnami/keycloak:${KEYCLOAK_VERSION}
    restart: unless-stopped
    ports:
      - 8003:8080
    environment:
      KEYCLOAK_CREATE_ADMIN_USER: true
      KEYCLOAK_ADMIN_USER: ${KEYCLOAK_USER}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_PASSWORD}
      KEYCLOAK_DATABASE_HOST: ws-keycloak-x-pg
      KEYCLOAK_DATABASE_PORT: 5432
      KEYCLOAK_DATABASE_NAME: ${KEYCLOAK_POSTGRES_DATABASE}
      KEYCLOAK_DATABASE_USER: ${KEYCLOAK_POSTGRES_USER}
      KEYCLOAK_DATABASE_PASSWORD: ${KEYCLOAK_POSTGRES_PASSWORD}
    command: [ "/scripts/run_import.sh" ]
    networks:
      - bitnami
    volumes:
      - ./keycloak/scripts:/scripts
      - ./keycloak/import:/import
      - ./keycloak/export:/export
    depends_on:
      - keycloak-x-pg

run_import.sh:

#!/bin/sh

echo "Importing master.."
/opt/bitnami/keycloak/bin/kc.sh import --dir=/import/master --override true 2>/dev/null 

echo "Importing dev-realm.."
/opt/bitnami/keycloak/bin/kc.sh import --dir=/import/dev-realm --override true 2>/dev/null

### Resume normal execution
/opt/bitnami/scripts/keycloak/run.sh
  • Stderr output shown below is handled by 2>/dev/null 
2022-12-26 04:03:28 2022-12-25 23:03:28,260 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Failed to start server in (import_export) mode
2022-12-26 04:03:28 2022-12-25 23:03:28,261 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Script upload is disabled
2022-12-26 04:03:28 2022-12-25 23:03:28,261 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) For more details run the same command passing the '--verbose' option. Also you can use '--help' to see the details abou
  • After that it will start as normal
2022-12-26 04:03:51 2022-12-25 23:03:51,798 INFO  [io.quarkus] (main) Keycloak 19.0.3 on JVM (powered by Quarkus 2.7.6.Final) started in 4.766s. Listening on: http://0.0.0.0:8080

Start with

docker compose up -d

Stop with

docker compose down -v
27

Hello, tested with docker compose:

  keycloak:
    image: 'keycloak/keycloak:21.1.1'
    container_name: keycloak
    entrypoint: ["/bin/bash", "-c"]
    command:
      - /opt/keycloak/bin/kc.sh import --dir /opt/keycloak/data/import --override true && /opt/keycloak/bin/kc.sh start-dev
28

Keycloak 23.0.4 is not starting
using docker image and EC2 container.

Here is my Docker:

FROM public.ecr.aws/docker/library/maven:3.8.4-openjdk-17-slim as maven-builder

COPY native-s3-pom.xml ./

RUN mvn package -f native-s3-pom.xml

FROM Quay as keycloak-builder

ENV KC_HEALTH_ENABLED=true
ENV KC_METRICS_ENABLED=true
ENV KC_DB=mysql
ENV KC_FEATURES=preview,token-exchange,admin-fine-grained-authz
ENV KC_CACHE_STACK=ec2
ENV KC_HTTP_RELATIVE_PATH=/auth
ENV PROXY_ADDRESS_FORWARDING=true
ENV KC_HTTP_ENABLED=true
ENV KC_PROXY=edge

ENV KC_HOSTNAME_STRICT_HTTPS: false

COPY APM/.jar /opt/keycloak/providers/
COPY --from=maven-builder --chown=s3-native-ping-bundle--jar-with-dependencies.jar /opt/keycloak/providers/

RUN /opt/keycloak/bin/kc.sh build

FROM Quay
COPY --from=keycloak-builder /opt/keycloak/lib/quarkus/ /opt/keycloak/lib/quarkus/
COPY --from=keycloak-builder /opt/keycloak/providers/* /opt/keycloak/providers/
COPY themes /opt/keycloak/themes/
COPY keycloak.conf /opt/keycloak/conf/
WORKDIR /opt/keycloak

RUN /opt/keycloak/bin/kc.sh show-config

ENTRYPOINT [“/opt/keycloak/bin/kc.sh” , “start”]

EXPOSE 22 8080 8443 9990 9993 7800

29

Why are you hijacking this thread? This seems entirely unrelated to the export/import situation.

Please create a new topic, and describe the issue you are facing including logs.

Bonus points will be awarded for using the preformatted text feature to increase readability.

1 Like