Install Tomcat 8.5 on Ubuntu 18.04: Java Servlet Container Setup

Apache Tomcat is an open-source Java servlet container that implements Java Servlet, JavaServer Pages (JSP), Java Expression Language, and WebSocket specifications. It is one of the most widely deployed Java application servers in the world, used by development teams and large enterprise environments alike.

This guide covers how to install Tomcat 8.5 on Ubuntu 18.04 by downloading the binary from the Apache archives and running it as a managed systemd service. The same steps apply to Ubuntu 16.04, Linux Mint, and Elementary OS.

<strong>Prerequisite:</strong>&nbsp;You need sudo access.

Install Tomcat 8.5 on Ubuntu: System User, OpenJDK, and Download

Install the default Java Development Kit. Tomcat requires a Java runtime. On Ubuntu 18.04, default-jdk installs OpenJDK 11:

bashsudo apt install default-jdk

Create a dedicated system user. Running Tomcat under a separate account limits what the process can access on the server. Setting the shell to /bin/false prevents interactive logins for this account entirely:

bashsudo useradd -m -U -d /opt/tomcat -s /bin/false tomcat

Download and extract Tomcat. Check the Tomcat downloads page for the latest 8.5.x version before running these commands:

bashsudo apt install unzip wgetcd /tmpwget https://archive.apache.org/dist/tomcat/tomcat-8/v8.5.37/bin/apache-tomcat-8.5.37.zipunzip apache-tomcat-*.zipsudo mkdir -p /opt/tomcatsudo mv apache-tomcat-8.5.37 /opt/tomcat/

Create a latest symlink pointing to the Tomcat installation directory. When you upgrade to a newer Tomcat version later, you simply update this symlink rather than editing the systemd unit file:

bashsudo ln -s /opt/tomcat/apache-tomcat-8.5.37 /opt/tomcat/latestsudo chown -R tomcat: /opt/tomcatsudo sh -c 'chmod +x /opt/tomcat/latest/bin/*.sh'

Configure the systemd Service and Open the UFW Firewall Port

Create a unit file at /etc/systemd/system/tomcat.service. The key directives to include are:

• User=tomcat and Group=tomcat to run under the service account
• JAVA_HOME=/usr/lib/jvm/default-java to point Tomcat to the JDK installation
• CATALINA_OPTS=-Xms512M -Xmx1024M -server -XX:+UseParallelGC — Xms sets the initial JVM heap size and Xmx sets the maximum. Tune these based on your server’s available RAM
• ExecStart and ExecStop pointing to startup.sh and shutdown.sh in the latest/bin/ directory

Reload systemd and start the service:

bashsudo systemctl daemon-reloadsudo systemctl start tomcatsudo systemctl enable tomcat

Check the status with sudo systemctl status tomcat. The output should show Active: active (running).

Open the firewall. Tomcat listens on port 8080:

bashsudo ufw allow 8080/tcp

In production, do not expose port 8080 directly. Place Tomcat behind an Nginx or Apache reverse proxy and restrict access to ports 80 and 443 only.

Set Up the Tomcat Web Management Interface and Test

Open /opt/tomcat/latest/conf/tomcat-users.xml and add a user with access to both management GUI interfaces:

xml<tomcat-users>  <role rolename="admin-gui"/>  <role rolename="manager-gui"/>  <user username="admin" password="strong_password" roles="admin-gui,manager-gui"/></tomcat-users>

Use a strong password here. The Manager and Host Manager interfaces have access to application deployment controls.

By default, both management interfaces only allow connections from localhost. This is enforced by a RemoteAddrValve in webapps/manager/META-INF/context.xml and webapps/host-manager/META-INF/context.xml. To allow access from a specific remote IP, add that IP to the allow regex pattern. Removing the valve entirely is not recommended — it exposes the management interface to anyone who can reach port 8080.

Restart Tomcat to apply the user changes:

bashsudo systemctl restart tomcat

Open http://your_domain_or_ip:8080 in a browser. The Tomcat welcome page confirms a successful installation. The Web Application Manager is at :8080/manager/html and the Virtual Host Manager is at :8080/host-manager/html.

Tomcat 8.5 is now installed and running on Ubuntu 18.04 as a managed systemd service. Deploy your Java web applications through the Manager interface or by placing WAR files in the webapps/ directory. Leave a comment below if you run into any issues.