Apache Tomcat: Download, Setup & Versions

This is a working reference on Apache Tomcat — the same material our Tomcat support engineers use when standing up new instances. It covers what Tomcat is, which versions are currently supported, where to download each one, Java prerequisites, install steps on Linux and Windows, the directory layout, ports, deploying applications, and baseline hardening.

What is Apache Tomcat

Apache Tomcat is an open-source servlet container and Java web server maintained by the Apache Software Foundation. It implements the Jakarta Servlet, Jakarta Server Pages (JSP), Jakarta Expression Language, and Jakarta WebSocket specifications — the runtime that Java web applications packaged as WAR files deploy into. Tomcat is not a full Jakarta EE application server (it omits EJB, JMS, and the full platform stack); for most Java web applications, including anything built on Spring Boot, the servlet container is all that is needed. The project home is tomcat.apache.org.

Tomcat runs as a single Java process (Catalina) on any operating system with a suitable JDK or JRE. It serves HTTP directly, so it can run standalone, or it can sit behind Apache httpd, nginx, or IIS in larger deployments.

Supported versions

Three release lines are currently supported. The authoritative matrix, including specification versions and minimum Java requirements, is on the project's Which Version page:

The key split is the package namespace: Tomcat 9 is the last line implementing Java EE (javax.* APIs); Tomcat 10.1 and 11 implement Jakarta EE (jakarta.* APIs). An application compiled against javax.servlet will not run unmodified on Tomcat 10.1 or 11. Older lines — 10.0.x, 8.5.x, and everything before — are end of life. A release-by-release history is in our Tomcat versions reference.

Tomcat download

Each major version has its own download page with checksums and PGP signatures:

• Tomcat 11 download — current line, use for new deployments
• Tomcat 10.1 download
• Tomcat 9 download — for applications still on the javax.* namespace

Two distribution formats matter in practice. The Core tar.gz / zip is the portable archive: unpack it anywhere a JDK exists and run the scripts in bin/. The 32-bit/64-bit Windows Service Installer (.exe) registers Tomcat as a Windows service with a bundled service wrapper and a configuration GUI. On Linux, distribution packages (apt, dnf) also exist but typically lag the current release; the upstream tarball is the standard choice for production.

Prerequisites: Java

Tomcat needs a JDK (or JRE) on the host — Java 17 or later for Tomcat 11, Java 11 or later for 10.1, Java 8 or later for 9. Install a current LTS build (Java 17 or 21 covers all three lines), then set JAVA_HOME so the startup scripts find it. Verify with java -version before touching Tomcat; a missing or too-old JVM is the most common first-start failure.

Install on Linux

The pattern below matches the project's own setup documentation: dedicated user, unpack under /opt, run under systemd.

# create a service account with no login shell
sudo useradd -m -d /opt/tomcat -U -s /bin/false tomcat

# unpack the Core tar.gz
sudo tar xzf apache-tomcat-11.0.24.tar.gz -C /opt/tomcat --strip-components=1
sudo chown -R tomcat: /opt/tomcat
sudo chmod +x /opt/tomcat/bin/*.sh

Then a systemd unit at /etc/systemd/system/tomcat.service:

[Unit]
Description=Apache Tomcat
After=network.target

[Service]
Type=forking
User=tomcat
Group=tomcat
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64"
Environment="CATALINA_HOME=/opt/tomcat"
Environment="CATALINA_BASE=/opt/tomcat"
Environment="CATALINA_OPTS=-Xms512m -Xmx1024m"
ExecStart=/opt/tomcat/bin/startup.sh
ExecStop=/opt/tomcat/bin/shutdown.sh
Restart=on-failure

[Install]
WantedBy=multi-user.target

Enable and start with sudo systemctl daemon-reload, sudo systemctl enable --now tomcat, then confirm the default page at http://server-ip:8080.

Install on Windows

Run the Windows Service Installer from the download page. It prompts for the install path, the JRE/JDK location, the HTTP port (8080 by default), and optional manager-app credentials, then registers the Apache Tomcat service set to manual start — switch it to Automatic in services.msc for servers. The bundled tomcat11w.exe utility edits JVM options, heap sizes, and service settings after install. The tar.gz/zip also works on Windows via binstartup.bat, but without service registration.

Directory layout

Three files in conf/ carry most of the configuration: server.xml defines connectors, ports, hosts, and engine settings; web.xml holds the default servlet and MIME mappings inherited by every application; context.xml sets defaults (such as JNDI resources and session persistence) applied to all contexts.

Ports

Defaults from server.xml: 8080 for HTTP, 8443 for HTTPS (the connector ships commented out until a certificate is configured), and 8005 for the shutdown command listener on localhost. Legacy AJP used 8009; the AJP connector is disabled by default in current releases and should stay off unless a fronting httpd actually uses it. Firewall everything except the ports clients need, and never expose 8005 beyond localhost.

Deploying applications

The simplest deployment is a WAR drop-in: copy myapp.war into webapps/ and Tomcat auto-deploys it at /myapp. A WAR named ROOT.war deploys at the site root.

The bundled Manager application handles remote deploys, undeploys, and reloads. It ships locked: enable it by adding a user with the right roles to conf/tomcat-users.xml, per the Manager App HOW-TO. The roles are manager-gui (web UI), manager-script (HTTP API, used by CI tools), manager-jmx, and manager-status. Grant only what is used — a CI pipeline needs manager-script, not manager-gui — and note the Manager also restricts access to localhost by default via a RemoteAddrValve in its context file, which must be widened deliberately, not removed.

Running behind a fronting server

Production Tomcat commonly sits behind Apache httpd, nginx, or IIS. The fronting server terminates TLS, serves static assets, and reverse-proxies application traffic to Tomcat over HTTP on 8080 (or AJP for httpd via mod_proxy_ajp). Tomcat then binds only to localhost, the proxy passes the original host and client IP through standard forwarding headers, and Tomcat's RemoteIpValve restores them for logging and application code. This split also allows load balancing across multiple Tomcat instances without touching the applications.

Basic hardening

Baseline items, consistent with the project's security considerations documentation:

• Remove the default webapps you do not use — docs, examples, and the default ROOT welcome app — from webapps/
• Keep the Manager and Host Manager apps IP-restricted (RemoteAddrValve) and give accounts only the specific manager roles they need
• Run Tomcat as a dedicated non-root user; never as root or LocalSystem
• Change or protect the shutdown port 8005; it accepts a plain-text shutdown command from localhost
• Disable the AJP connector unless a fronting httpd requires it, and bind it to localhost with a secret if it does
• Track releases and patch promptly — security fixes ship only in current releases of each supported line

Logs and catalina.out

Tomcat writes stdout/stderr to logs/catalina.out, which grows without bound — Tomcat itself never rotates it. Rotate it externally with logrotate (using copytruncate, since Tomcat keeps the file handle open), or eliminate it by sending stdout to journald under systemd. The dated files (catalina.YYYY-MM-DD.log, localhost.*.log, access logs) rotate daily by default via juli logging but are never deleted, so add cleanup for those too. Unrotated Tomcat logs filling a disk is one of the most frequent outage causes we see in application server estates.

FAQ

Which Tomcat version should I install?

Tomcat 11 for new applications on the jakarta.* namespace with Java 17+. Tomcat 9 only when the application still uses javax.servlet APIs and cannot be migrated yet.

Is Apache Tomcat free?

Yes. Tomcat is open source under the Apache License 2.0, with no paid edition. Commercial support comes from third parties, not the ASF.

Does Tomcat need a full JDK?

A JRE is sufficient to run Tomcat, but a JDK is the practical default — some diagnostics and build tooling expect it, and modern OpenJDK distributions ship as JDKs anyway.

What port does Tomcat run on?

8080 for HTTP by default, 8443 for HTTPS once a certificate is configured, and 8005 for the localhost shutdown listener. All are set in conf/server.xml.