For most Ubuntu servers, install Tomcat with the tomcat10 package: it integrates with systemd and is easier to update and remove. Use the Apache Tomcat binary archive instead when you need a specific upstream release, a custom directory layout, or an upgrade/rollback process independent of Ubuntu’s package cadence. Tomcat 10.1 requires Java 11 or later, and applications moving from Tomcat 9 may need code changes because Tomcat 10 replaces the javax.* APIs with jakarta.*.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Choose the installation method first
There are two sound ways to run Tomcat on Ubuntu. The packaged route is the default for a maintainable server. The upstream archive gives you control over the exact Apache release and filesystem layout, but you must own service integration, permissions, upgrades, and verification.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
| Decision point | Ubuntu tomcat10 package |
Apache binary archive |
|---|---|---|
| Release selection | Uses the version available in your Ubuntu repositories and their update cadence. | Lets you select an upstream Tomcat 10.1 release, such as 10.1.61 (the release identified in Apache documentation captured for 2026). |
| Security-update ownership | Ubuntu packaging and update tooling deliver updates through the normal system process. | You monitor Apache releases, download replacements, verify them, and perform upgrades yourself. |
| Filesystem layout | Ubuntu chooses the configuration, library, log, and web-application locations. | You choose locations such as a versioned directory under /opt and a stable symlink for upgrades. |
| Upgrade and rollback | Package upgrades are simple, but the repository version controls the change. | Keeping versioned directories makes it straightforward to switch a symlink back to a known release. |
| Service integration | The package supplies a systemd service and the usual enable/start workflow. | You create a systemd unit or use jsvc and must maintain that service definition. |
| Application compatibility | Still depends on your application’s Java and Jakarta requirements. | Still depends on your application’s Java and Jakarta requirements; choosing a release does not remove the Tomcat 10 migration work. |
If you do not have an Ubuntu host yet, provision an Ubuntu VPS for Tomcat with sudo access, then apply the steps below. Keep Tomcat’s HTTP connector private until you have tested the installation and decided how clients should reach it.
Prerequisites and planning
- An Ubuntu server with shell access and a sudo-capable account.
- Java 11 or later. Apache’s Tomcat 10.1 documentation states: “Tomcat 10.1 requires Java 11 or later.”
- A decision about whether Ubuntu’s
tomcat10package or an Apache archive better fits your update policy. - A service-account plan. Tomcat should run as a dedicated unprivileged user, not as
root. - A port plan. Tomcat commonly listens on an internal HTTP connector such as port 8080; expose it only when your architecture requires direct access.
- A compatibility plan if you are moving an existing application from Tomcat 9 or earlier.
Confirm the operating system and Java before installing anything:
cat /etc/os-release
java -versionIf Java is missing, install a Java 11 runtime from Ubuntu’s repositories. Package names can vary by Ubuntu release, so check the available packages with apt-cache search openjdk and install the Java 11 runtime offered by your release. After installation, run java -version again and make sure the reported major version is 11 or newer.
Install Tomcat with Ubuntu’s package manager
1. Refresh package metadata and install Tomcat
Update the package index, then install the main Tomcat 10 package:
sudo apt update
sudo apt install tomcat10The Ubuntu package supplies the files and systemd integration needed for a standard deployment. Let apt resolve dependencies rather than copying a second Java runtime into the server.
2. Enable Tomcat at boot and start it now
sudo systemctl enable --now tomcat10
sudo systemctl status tomcat10 --no-pagerenable --now both starts the service immediately and configures it to start during subsequent boots. A healthy service should show an active (running) state. If it does not, continue with the log check before changing ports or permissions.
3. Inspect the service definition and logs
Ubuntu’s exact paths can differ by release. Ask systemd which unit and process settings are in use instead of assuming a layout:
systemctl cat tomcat10
systemctl show tomcat10 -p User -p Group -p ExecStart
sudo journalctl -u tomcat10 -b --no-pagerThe journal is the first place to look for a missing Java runtime, a permission failure, a malformed configuration file, or a connector that could not bind to its port. The User and Group properties also let you confirm that the packaged service is not running as root.
4. Add only the optional packages you need
Ubuntu provides separate packages for administrative tools, documentation, examples, and user-instance deployments. Install them explicitly rather than adding every optional component to a production host:
Rank #2
sudo apt install tomcat10-admin
audo apt install tomcat10-docs
audo apt install tomcat10-examples
audo apt install tomcat10-userCorrect the command if your shell reports a typo: each line should begin with sudo. The package names are:
tomcat10-adminfor the administration web applications.tomcat10-docsfor local documentation.tomcat10-examplesfor example applications.tomcat10-userfor user-instance support where that model fits your deployment.
Do not expose an administration application to the public internet merely because it is installed. Restrict administrative access by network policy and credentials, and remove optional examples from a production instance if they are not required.
Install a specific Apache Tomcat release from an archive
Choose the archive route when Ubuntu’s packaged version does not meet your release, layout, or rollback requirements. Apache publishes binary archives and instructs users to verify downloads with an OpenPGP signature or a SHA-512 checksum before use. The release number below is an example of the documented Tomcat 10.1.61 release; check the Apache download page immediately before installation for the release you actually intend to run.
1. Create a working directory and obtain the files
mkdir -p "$HOME/src/tomcat"
cd "$HOME/src/tomcat"
# Download the tar.gz archive and either its .asc signature or its SHA-512 file
# from the Apache Tomcat 10.1 download page.Use the exact filename shown by Apache. Do not silently substitute a file from a mirror or rename it before verification. Keep the archive and its accompanying signature or checksum file together.
2. Verify the archive before extracting it
Apache’s download guidance says: “After you download the file, you should calculate a checksum for your download, and make sure it is the same as ours.” You can use either of the following methods, depending on which verification file you downloaded.
For an OpenPGP signature, import the Apache signing key through your organization’s established key-verification process, then verify the detached signature:
gpg --verify apache-tomcat-10.1.61.tar.gz.asc apache-tomcat-10.1.61.tar.gzA successful verification reports a good signature. Treat an unknown, expired, or otherwise untrusted key as a verification failure until you have validated the key fingerprint from a trusted Apache channel.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsFor a SHA-512 file, calculate the digest locally:
sha512sum apache-tomcat-10.1.61.tar.gzCompare the complete hexadecimal output with the value published by Apache for that exact archive. Do not continue if even one character differs. A checksum proves that the bytes match the published value; it does not by itself authenticate a checksum file obtained from an untrusted location, which is why signature verification and trusted key handling matter.
3. Extract into a versioned directory
Install under a directory that includes the release number. A stable symlink can then point applications and service definitions at the active version:
sudo mkdir -p /opt
sudo tar -xzf apache-tomcat-10.1.61.tar.gz -C /opt
sudo mv /opt/apache-tomcat-10.1.61 /opt/tomcat-10.1.61
sudo ln -sfn /opt/tomcat-10.1.61 /opt/tomcatBefore running the service, check that the expected startup scripts exist:
ls -l /opt/tomcat/bin/catalina.sh /opt/tomcat/bin/startup.shFor a later upgrade, extract the new release beside the old one, verify it, test it, and change the symlink only when you are ready. Retain the previous directory until the new instance has passed its checks so that rollback is a pointer change rather than a hurried re-download.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
4. Create a dedicated account and set ownership
sudo groupadd --system tomcat
sudo useradd --system --gid tomcat --home-dir /opt/tomcat --shell /usr/sbin/nologin tomcat
sudo chown -R tomcat:tomcat /opt/tomcat-10.1.61
sudo chown -h tomcat:tomcat /opt/tomcatIf the group or user already exists on a server you are converting, do not create a duplicate identity. Inspect it first with getent passwd tomcat and getent group tomcat, then adjust ownership for the account you intend to use.
5. Define Java and Tomcat environment variables
Manual Unix installations need a reliable Java path and explicit Tomcat home variables. Find the Java executable and derive its installation directory:
readlink -f "$(command -v java)"
readlink -f "$(dirname "$(command -v java)")/.."Use the resulting directory as JAVA_HOME. CATALINA_HOME identifies the Tomcat installation, while CATALINA_BASE identifies the instance configuration, logs, temporary files, and deployed applications. A single-instance layout can use the same value for both:
Rank #4
JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64
CATALINA_HOME=/opt/tomcat
CATALINA_BASE=/opt/tomcatReplace the example JAVA_HOME with the path installed on your Ubuntu release. Keep these variables in the service definition or another root-owned environment file so an interactive user’s shell settings cannot change how the daemon starts.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRun the archive installation as a service
Systemd unit for a manual installation
A carefully written systemd unit is usually easier to inspect and operate than ad-hoc background processes. Create /etc/systemd/system/tomcat.service with root privileges:
[Unit]
Description=Apache Tomcat 10.1
After=network.target
[Service]
Type=simple
User=tomcat
Group=tomcat
Environment=JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64
Environment=CATALINA_HOME=/opt/tomcat
Environment=CATALINA_BASE=/opt/tomcat
ExecStart=/opt/tomcat/bin/catalina.sh run
ExecStop=/bin/kill -TERM $MAINPID
Restart=on-failure
SuccessExitStatus=143
NoNewPrivileges=true
PrivateTmp=true
[Install]
WantedBy=multi-user.targetUse the actual Java directory from your host. Then load, enable, and start the unit:
sudo systemctl daemon-reload
sudo systemctl enable --now tomcat
sudo systemctl status tomcat --no-pager
sudo journalctl -u tomcat -b --no-pagerThe catalina.sh run mode keeps the Java process attached to systemd, allowing systemd to track its PID and collect output. Keep the unit root-owned and review changes whenever you upgrade the archive.
Daemonizing with jsvc
Apache’s Unix setup guidance also describes jsvc for daemonizing a manual installation. Install the jsvc package available for your Ubuntu release, create the dedicated service account, and set JAVA_HOME, CATALINA_HOME, and CATALINA_BASE before invoking it. A typical invocation must provide the Java home, the account to drop privileges to, a PID file, output and error files, Tomcat’s bootstrap class path, and the Catalina system properties:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo jsvc
-home "$JAVA_HOME"
-user tomcat
-pidfile /run/tomcat.pid
-outfile /var/log/tomcat/out.log
-errfile /var/log/tomcat/err.log
-Dcatalina.home="$CATALINA_HOME"
-Dcatalina.base="$CATALINA_BASE"
-cp "$CATALINA_HOME/bin/bootstrap.jar:$CATALINA_HOME/bin/tomcat-juli.jar"
org.apache.catalina.startup.BootstrapPaths, runtime directories, and the exact jsvc lifecycle options must match the jsvc and Ubuntu versions on your server. If you do not already operate jsvc, the systemd unit above is generally simpler to audit; do not run both supervisors for the same Tomcat instance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Network access and least privilege
Keep the connector bound to localhost while you test, or place Tomcat behind a reverse proxy or load balancer. If clients must connect directly, permit only the required port in the host firewall and in any cloud security group. For a UFW-managed host, an example rule is:
Best Value
sudo ufw allow 8080/tcp
sudo ufw statusOpen the port only after confirming that the service is listening and that the source networks are appropriate. A public Tomcat manager or documentation application increases the attack surface; install and expose those components only when they serve a defined operational need.
Verify the installation end to end
Check service state and the listening socket
sudo systemctl status tomcat10 --no-pager # packaged install
sudo systemctl status tomcat --no-pager # archive unit
sudo ss -ltnp | grep 8080Use the unit name that matches your installation. The socket check confirms that a process is listening; it does not prove that your application deployed successfully.
Request the local HTTP endpoint
curl -I http://127.0.0.1:8080/A response from the Tomcat default application confirms that the HTTP connector answered locally. A connection refusal usually means the service is stopped, the connector uses another port, or startup failed. A timeout points more often to firewall or network policy.
Confirm the deployed context
For an application deployed as sample, request its context explicitly:
curl -I http://127.0.0.1:8080/sample/Use your real context path, not the example. Check the service journal and the instance’s configured application directory when the context returns an error. A successful Tomcat root response does not guarantee that every application has compatible libraries or completed startup.
Tomcat 10 compatibility before you migrate an application
Tomcat 10 changed the Java web API namespace from javax.* to jakarta.*. An application written for Tomcat 9 or earlier may therefore require source changes, dependency updates, descriptor changes, and a rebuild before it can run on Tomcat 10.1.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Inventory imports and dependencies using
javax.servletand related Java EE namespaces. - Check whether your framework and libraries provide Jakarta-compatible releases.
- Build and deploy the application in a staging Tomcat 10.1 instance before changing production.
- Exercise authentication, session handling, uploads, scheduled jobs, database access, and error pages rather than checking only the landing page.
- Keep the previous Tomcat installation and application artifact available until the migration has passed its acceptance checks.
Java 11 is the minimum for Tomcat 10.1; a newer Java runtime may be appropriate for your application, but raising the Java version does not automatically convert javax.* code to jakarta.*.
Upgrades, rollback, and routine maintenance
Packaged installation
For the Ubuntu route, apply normal package updates and review the service after each Tomcat change:
sudo apt update
sudo apt install --only-upgrade tomcat10
sudo systemctl status tomcat10 --no-pager
sudo journalctl -u tomcat10 -b --no-pagerTest the deployed contexts after an upgrade, especially when the Ubuntu package changes the Tomcat major or minor line available to your release.
Archive installation
For an archive, repeat the download verification for every new release. Extract it into a new versioned directory, apply ownership, copy or generate the intended CATALINA_BASE configuration, and test it without destroying the old directory. Change /opt/tomcat to the new directory only after local HTTP and application checks succeed. If the new release fails, stop the service, point the symlink back to the previous verified directory, and start the service again.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Troubleshooting checklist
- Service exits immediately: run
journalctl -u tomcat10 -bor the archive unit’s journal and look for Java-path, permission, or configuration errors. - Java version error: run
java -version, verifyJAVA_HOMEin the service environment, and ensure it points to Java 11 or newer. - Port already in use: identify the process with
sudo ss -ltnp | grep 8080, then choose a deliberate connector port or stop the conflicting service. - Permission denied: confirm that the dedicated account can read the Tomcat installation and write the configured logs, temporary directory, and application deployment directory.
- Archive signature or checksum mismatch: delete the archive, download it again from Apache, and repeat verification; never extract a mismatched file.
- Root page works but the application fails: inspect the application logs and validate Jakarta namespace compatibility, dependencies, configuration, and context path.
- Remote clients cannot connect: verify the bind address, host firewall, cloud firewall, and any reverse-proxy routing separately from Tomcat’s local response.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
