Tomcat 9 on Ubuntu 20.04: Install, Configure, and Start

Apache Tomcat is an open-source web server and Java servlet container. It is one of the most widely used tools for hosting Java web applications, trusted by developers and teams for its reliability and straightforward setup.

This guide shows you how to install Tomcat 9 on Ubuntu 20.04, run it as a system service, and set up the web management panel.

Install Java on Your System

Tomcat 9 needs Java 8 or later to run. Install OpenJDK 11, the open-source Java runtime recommended for Ubuntu:

bashsudo apt updatesudo apt install openjdk-11-jdk

Verify the install:

bashjava -version

You should see a version string like openjdk version "11.0.7". If you see a version number, Java is ready.

Install Tomcat 9 on Ubuntu 20.04

Do not run Tomcat as the root user. Create a dedicated system account first. This keeps Tomcat isolated from the rest of the system:

bashsudo useradd -m -U -d /opt/tomcat -s /bin/false tomcat

Check the Tomcat 9 downloads page for the latest version number. Then download and extract the archive:

bashVERSION=9.0.35wget https://www-eu.apache.org/dist/tomcat/tomcat-9/v${VERSION}/bin/apache-tomcat-${VERSION}.tar.gz -P /tmpsudo tar -xf /tmp/apache-tomcat-${VERSION}.tar.gz -C /opt/tomcat/

Create a symlink called latest. When you upgrade Tomcat later, you just point this symlink to the new version instead of updating every path:

bashsudo ln -s /opt/tomcat/apache-tomcat-${VERSION} /opt/tomcat/latest

Set the correct file ownership and make the startup scripts runnable:

bashsudo chown -R tomcat: /opt/tomcatsudo sh -c 'chmod +x /opt/tomcat/latest/bin/*.sh'

Set Up a Systemd Service

Running Tomcat as a service means it starts on boot and you can manage it with systemctl. Create the service file:

bashsudo nano /etc/systemd/system/tomcat.service

Paste this content:

ini[Unit]Description=Tomcat 9 servlet containerAfter=network.target[Service]Type=forkingUser=tomcatGroup=tomcatEnvironment="JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64"Environment="JAVA_OPTS=-Djava.security.egd=file:///dev/urandom -Djava.awt.headless=true"Environment="CATALINA_BASE=/opt/tomcat/latest"Environment="CATALINA_HOME=/opt/tomcat/latest"Environment="CATALINA_PID=/opt/tomcat/latest/temp/tomcat.pid"Environment="CATALINA_OPTS=-Xms512M -Xmx1024M -server -XX:+UseParallelGC"ExecStart=/opt/tomcat/latest/bin/startup.shExecStop=/opt/tomcat/latest/bin/shutdown.sh[Install]WantedBy=multi-user.target

<strong>Note:</strong>&nbsp;If Java is installed at a different path on your system, update&nbsp;<code>JAVA_HOME</code>&nbsp;to match.

Save the file. Then reload systemd and start Tomcat:

bashsudo systemctl daemon-reloadsudo systemctl enable --now tomcatsudo systemctl status tomcat

Look for active (running) in the output. That confirms Tomcat started correctly.

Open the Firewall and Set Up the Web Panel

Open port 8080 so the server is reachable from your browser:

bashsudo ufw allow 8080/tcp

Create an admin user in the Tomcat users file. Open it with:

bashsudo nano /opt/tomcat/latest/conf/tomcat-users.xml

Add these lines inside the <tomcat-users> block. Use a strong password:

xml<role rolename="admin-gui"/><role rolename="manager-gui"/><user username="admin" password="your_secure_password" roles="admin-gui,manager-gui"/>

By default, the Manager and Host Manager apps only allow access from localhost. To connect from a remote machine, edit the context.xml file for each app and comment out the IP restriction block:

bashsudo nano /opt/tomcat/latest/webapps/manager/META-INF/context.xmlsudo nano /opt/tomcat/latest/webapps/host-manager/META-INF/context.xml

Restart Tomcat to apply all changes:

bashsudo systemctl restart tomcat

Open http://your_server_ip:8080 in a browser. The Tomcat welcome page will load. The Manager app is at /manager/html and the Host Manager is at /host-manager/html.

<strong>Security tip:</strong>&nbsp;In production, limit Manager and Host Manager access to trusted IP addresses only.

Tomcat 9 is now installed and running as a service on Ubuntu. Use systemctl start, stop, or restart to manage it any time. If you run Tomcat in production, put it behind an Nginx reverse proxy for SSL and better performance. Questions about your setup? Leave a comment below.