# Docker Config & "ignored during build time: kc.spi-hostname-v2-hostname"

**URL:** <https://forum.keycloak.org/t/docker-config-ignored-during-build-time-kc-spi-hostname-v2-hostname/28346>\
**Category:** Configuring the server\
**Created:** [October 16, 2024, 9:45am UTC](https://forum.keycloak.org/t/docker-config-ignored-during-build-time-kc-spi-hostname-v2-hostname/28346 "2024-10-16T09:45:28Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![stanthewizzard](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/stanthewizzard/32/11445_2.png) [@stanthewizzard](https://forum.keycloak.org/u/stanthewizzard)\
**Post date:** [October 16, 2024, 9:45am UTC](https://forum.keycloak.org/t/docker-config-ignored-during-build-time-kc-spi-hostname-v2-hostname/28346/1 "2024-10-16T09:45:28Z")

</div>

Hello

I’m a full newbie to keycloak (still on authelia for prod)

I have this conf for Docker

```auto
services:
  keycloak:
      container_name: keycloak
      hostname: keycloak
      image: quay.io/keycloak/keycloak:latest
      restart: always
      environment:
        KC_FEATURES: "hostname:v2"
        KC_HOSTNAME: "https://keycloak.xxxx.com"
        KC_HTTP_ENABLED: "true"
        KC_HEALTH_ENABLED: "true"
        KC_BOOTSTRAP_ADMIN_USERNAME: admin
        KC_BOOTSTRAP_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
        PROXY_ADDRESS_FORWARDING: "true"

      ports:
        - "17080:8080"
      networks: 
        - default
        - caddy_ext
      command: start

networks:
  default:
    driver: bridge
  caddy_ext: 
    name: caddy_ext_default
    external: true

```

Keycloak is working and accessible through caddy with [https://keycloak.xxxx.com](https://keycloak.xxxx.com)

BUT  
Looking at container log I have this issue:  
2024-10-16 09:40:20,961 WARN [org.keycloak.quarkus.runtime.cli.Picocli] (main) The following run time options were found, but will be ignored during build time: kc.spi-hostname-v2-hostname

I can’t understand why.

Thanks for help

---

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [October 16, 2024, 12:04pm UTC](https://forum.keycloak.org/t/docker-config-ignored-during-build-time-kc-spi-hostname-v2-hostname/28346/2 "2024-10-16T12:04:06Z")

</div>

Because it’s a runtime option and with just using `start` as the command, the build step will automatically be executed before starting (running) the server, thus the log entry.  
Basically, you don’t have to configure explicitly the hostname-v2 feature, as this is default since KC25.

Additionally: NEVER use the `latest` tag on a Docker image. `latest` is a moving target and might yield into unexpected behavior when updated. Always use explicit versions, currently e.g. `26.0.0`.

Also: `PROXY_ADDRESS_FORWARDING` is not used at all by Keycloak. If you are running KC behind a reverse proxy, see [Using a reverse proxy - Keycloak](https://www.keycloak.org/server/reverseproxy)  
Always read the official docs, never use outdated blog posts and copy things without understanding.

---

<div class="post-metadata">

**Author:** ![stanthewizzard](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/stanthewizzard/32/11445_2.png) [@stanthewizzard](https://forum.keycloak.org/u/stanthewizzard)\
**Post date:** [October 16, 2024, 12:42pm UTC](https://forum.keycloak.org/t/docker-config-ignored-during-build-time-kc-spi-hostname-v2-hostname/28346/3 "2024-10-16T12:42:59Z")

</div>

Thanks for taking the time to answer

TBH I’m only learning through examples.  
Thus using blog post etc. to understand

The doc is kind of cryptic to me (I’m not a god of reverse proxy, but I have used a lot of it and the doc is hard to understand)

---

<div class="post-metadata">

**Author:** ![stanthewizzard](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/stanthewizzard/32/11445_2.png) [@stanthewizzard](https://forum.keycloak.org/u/stanthewizzard)\
**Post date:** [October 16, 2024, 1:21pm UTC](https://forum.keycloak.org/t/docker-config-ignored-during-build-time-kc-spi-hostname-v2-hostname/28346/4 "2024-10-16T13:21:56Z")

</div>

and for example

```auto
  keycloak:
      container_name: keycloak
      hostname: keycloak
      image: quay.io/keycloak/keycloak:26.0
      restart: always
      environment:
        KC_HOSTNAME_STRICT: "false"
        KC_HTTP_ENABLED: "true"
        KC_HEALTH_ENABLED: "true"
        KC_BOOTSTRAP_ADMIN_USERNAME: admin
        KC_BOOTSTRAP_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
        KC_PROXY_HEADERS: xforwarded
      ports:
        - "17080:8080"
        - "17090:9000"
      networks: 
        - default
        - caddy_ext
      command:
        - start

```

Same issue  
If you have a good and up to date tuto. Please send it 🙂  
Thanks again

---

<div class="post-metadata">

**Author:** ![thomasdarimont](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/thomasdarimont/32/37_2.png) [@thomasdarimont](https://forum.keycloak.org/u/thomasdarimont)\
**Post date:** [October 16, 2024, 3:08pm UTC](https://forum.keycloak.org/t/docker-config-ignored-during-build-time-kc-spi-hostname-v2-hostname/28346/5 "2024-10-16T15:08:10Z")

</div>

Hello Stan,

the following configuration works for me (example env with caddy, keycloak and postgresql).

In my example I expose caddy / keycloak via the local domain `id.acme.test`, which I mapped to 127.0.0.1 in my /etc/hosts file.

I used mkcert to generate local the certificate and key: [GitHub - FiloSottile/mkcert: A simple zero-config tool to make locally trusted development certificates with any names you'd like.](https://github.com/FiloSottile/mkcert)

docker-compose.yml

```yaml
services:
  caddy-keycloak-db:
    image: postgres:15
    volumes:
      - postgres_data_kc_caddy:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: password
    ports:
      - 5433:5432

    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U keycloak"]
      interval: 10s
      timeout: 5s
      retries: 5

  caddy-keycloak:
    image: quay.io/keycloak/keycloak:26.0.0
    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
      KC_DB: postgres
      KC_DB_SCHEMA: public
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: password
      KC_DB_URL: jdbc:postgresql://caddy-keycloak-db/keycloak
      KC_HOSTNAME_STRICT: "false"
      KC_HTTP_ENABLED: "true"
      KC_HTTP_HOSTNAME: "https://id.acme.test:5443"
      KC_PROXY_HEADERS: "xforwarded"
      KC_LOG_LEVEL: "INFO,org.infinispan:INFO,org.jgroups:DEBUG"
      KC_METRICS_ENABLED: "true"
      KC_HEALTH_ENABLED: "true"
      KC_FEATURES: preview
      JAVA_OPTS_APPEND: "-Djgroups.thread_dumps_threshold=1"

    ports:
      - 8080:8080
      - 9000:9000
      - 8443:8443

    command:
      - "--verbose"
      - "start"
      - "--spi-events-listener-jboss-logging-success-level=info"
      - "--spi-events-listener-jboss-logging-error-level=warn"

    depends_on:
      caddy-keycloak-db:
        condition: service_healthy

  caddy-lb:
    image: caddy:2.8-alpine
    volumes:
      - ./caddy.json:/etc/caddy/caddy.json:z
      - ./cert.pem:/etc/caddy/server.crt:z
      - ./cert-key.pem:/etc/caddy/server.key:z
    command: ["caddy", "run", "--config", "/etc/caddy/caddy.json"]
    ports:
      - "5443:443"
    depends_on:
      - caddy-keycloak

volumes:
  postgres_data_kc_caddy:
    driver: local

```

caddy.json:

```json
{
  "apps": {
    "http": {
      "servers": {
        "srv0": {
          "listen": [
            ":443"
          ],
          "routes": [
            {
              "match": [
                {
                  "host": [
                    "id.acme.test"
                  ]
                }
              ],
              "handle": [
                {
                  "handler": "reverse_proxy",
                  "transport": {
                    "protocol": "http"
                  },
                  "upstreams": [
                    {
                      "dial": "caddy-keycloak:8080"
                    }
                  ],
                  "load_balancing": {
                    "selection_policy": {
                      "policy": "ip_hash"
                    },
                    "try_duration": "1s",
                    "try_interval": "250ms"
                  },
                  "health_checks": {
                    "active": {
                      "uri": "/health",
                      "port": 9000,
                      "interval": "3s",
                      "timeout": "2s",
                      "expect_status": 200
                    }
                  }
                }
              ],
              "terminal": true
            }
          ]
        }
      }
    },
    "tls": {
      "certificates": {
        "load_files": [
          {
            "certificate": "/etc/caddy/server.crt",
            "key": "/etc/caddy/server.key",
            "tags": [
              "selfsigned"
            ]
          }
        ]
      }
    }
  }
}

```

After you created the certificate and key you should be able to do  
`docker compose up`  
and access the environment via [https://id.acme.test:5443/admin](https://id.acme.test:5443/admin)

Note, that if you want to use a custom context path like `/auth` you need to specify  
the env variable: `KC_HTTP_RELATIVE_PATH: "/auth"` for the Keycloak container AND  
adjust the health check uri in the proxy config: ` "uri": "/auth/health"`.

Cheers,  
Thomas

---

<div class="post-metadata">

**Author:** ![stanthewizzard](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/stanthewizzard/32/11445_2.png) [@stanthewizzard](https://forum.keycloak.org/u/stanthewizzard)\
**Post date:** [October 16, 2024, 3:25pm UTC](https://forum.keycloak.org/t/docker-config-ignored-during-build-time-kc-spi-hostname-v2-hostname/28346/6 "2024-10-16T15:25:27Z")

</div>

I’ll play with that  
Thank you very much  
Btw what I have is working  
Already add passkey for site (this is my homelab. Like to learn and understand. And passkeys also lol)

---

<div class="post-metadata">

**Author:** ![stanthewizzard](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/stanthewizzard/32/11445_2.png) [@stanthewizzard](https://forum.keycloak.org/u/stanthewizzard)\
**Post date:** [October 16, 2024, 4:26pm UTC](https://forum.keycloak.org/t/docker-config-ignored-during-build-time-kc-spi-hostname-v2-hostname/28346/7 "2024-10-16T16:26:41Z")

</div>

> [@thomasdarimont](#):
>
> Hello Stan,
> 
> the following configuration works for me (example env with caddy, keycloak and postgresql).
> 
> In my example I expose caddy / keycloak via the local domain `id.acme.test`, which I mapped to 127.0.0.1 in my /etc/hosts file.
> 
> I used mkcert to generate local the certificate and key: [GitHub - FiloSottile/mkcert: A simple zero-config tool to make locally trusted development certificates with any names you’d like.](https://github.com/FiloSottile/mkcert)
> 
> docker-compose.yml
> 
> ```auto
> services:
> caddy-keycloak-db:
> image: postgres:15
> volumes:
> - postgres_data_kc_caddy:/var/lib/postgresql/data
> environment:
> POSTGRES_DB: keycloak
> POSTGRES_USER: keycloak
> POSTGRES_PASSWORD: password
> ports:
> - 5433:5432
> 
> healthcheck:
> test: ["CMD-SHELL", "pg_isready -U keycloak"]
> interval: 10s
> timeout: 5s
> retries: 5
> 
> caddy-keycloak:
> image: quay.io/keycloak/keycloak:26.0.0
> environment:
> KEYCLOAK_ADMIN: admin
> KEYCLOAK_ADMIN_PASSWORD: admin
> KC_DB: postgres
> KC_DB_SCHEMA: public
> KC_DB_USERNAME: keycloak
> KC_DB_PASSWORD: password
> KC_DB_URL: jdbc:postgresql://caddy-keycloak-db/keycloak
> KC_HOSTNAME_STRICT: "false"
> KC_HTTP_ENABLED: "true"
> KC_HTTP_HOSTNAME: "https://id.acme.test:5443"
> KC_PROXY_HEADERS: "xforwarded"
> KC_LOG_LEVEL: "INFO,org.infinispan:INFO,org.jgroups:DEBUG"
> KC_METRICS_ENABLED: "true"
> KC_HEALTH_ENABLED: "true"
> KC_FEATURES: preview
> JAVA_OPTS_APPEND: "-Djgroups.thread_dumps_threshold=1"
> 
> ports:
> - 8080:8080
> - 9000:9000
> - 8443:8443
> 
> command:
> - "--verbose"
> - "start"
> - "--spi-events-listener-jboss-logging-success-level=info"
> - "--spi-events-listener-jboss-logging-error-level=warn"
> 
> depends_on:
> caddy-keycloak-db:
> condition: service_healthy
> 
> caddy-lb:
> image: caddy:2.8-alpine
> volumes:
> - ./caddy.json:/etc/caddy/caddy.json:z
> - ./cert.pem:/etc/caddy/server.crt:z
> - ./cert-key.pem:/etc/caddy/server.key:z
> command: ["caddy", "run", "--config", "/etc/caddy/caddy.json"]
> ports:
> - "5443:443"
> depends_on:
> - caddy-keycloak
> 
> volumes:
> postgres_data_kc_caddy:
> driver: local
> 
> ```
> 
> caddy.json:
> 
> ```auto
> {
> "apps": {
> "http": {
> "servers": {
> "srv0": {
> "listen": [
> ":443"
> ],
> "routes": [
> {
> "match": [
> {
> "host": [
> "id.acme.test"
> ]
> }
> ],
> "handle": [
> {
> "handler": "reverse_proxy",
> "transport": {
> "protocol": "http"
> },
> "upstreams": [
> {
> "dial": "caddy-keycloak:8080"
> }
> ],
> "load_balancing": {
> "selection_policy": {
> "policy": "ip_hash"
> },
> "try_duration": "1s",
> "try_interval": "250ms"
> },
> "health_checks": {
> "active": {
> "uri": "/health",
> "port": 9000,
> "interval": "3s",
> "timeout": "2s",
> "expect_status": 200
> }
> }
> }
> ],
> "terminal": true
> }
> ]
> }
> }
> },
> "tls": {
> "certificates": {
> "load_files": [
> {
> "certificate": "/etc/caddy/server.crt",
> "key": "/etc/caddy/server.key",
> "tags": [
> "selfsigned"
> ]
> }
> ]
> }
> }
> }
> }
> 
> ```
> 
> After you created the certificate and key you should be able to do  
> `docker compose up`  
> and access the environment via [https://id.acme.test:5443/admin](https://id.acme.test:5443/admin)
> 
> Note, that if you want to use a custom context path like `/auth` you need to specify  
> the env variable: `KC_HTTP_RELATIVE_PATH: "/auth"` for the Keycloak container AND  
> adjust the health check uri in the proxy config: ` "uri": "/auth/health"`.
> 
> Cheers,  
> Thomas

Working like a charm but still

```auto
2024-10-16 16:20:37,058 INFO [org.keycloak.common.Profile] (main) Preview features enabled: admin-fine-grained-authz:v1, client-secret-rotation:v1, dpop:v1, opentelemetry:v1, passkeys:v1, recovery-codes:v1, scripts:v1, token-exchange:v1, update-email:v1

18

2024-10-16 16:20:37,138 WARN [org.keycloak.quarkus.runtime.cli.Picocli] (main) The following run time options were found, but will be ignored during build time: kc.spi-events-listener-jboss-logging-success-level, kc.spi-hostname-v2-hostname-strict, kc.spi-events-listener-jboss-logging-error-level

```

Glad to use postgres

---

<div class="post-metadata">

**Author:** ![schuerg](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/schuerg/32/4351_2.png) [@schuerg](https://forum.keycloak.org/u/schuerg)\
**Post date:** [October 19, 2024, 7:51am UTC](https://forum.keycloak.org/t/docker-config-ignored-during-build-time-kc-spi-hostname-v2-hostname/28346/8 "2024-10-19T07:51:12Z")

</div>

> [@stanthewizzard](#):
>
> I’m a full newbie to keycloak (still on authelia for prod)

Hi Stan, I’m curious—what’s motivating you to switch to Keycloak instead of sticking with Authelia?  
Best regards

---

<div class="post-metadata">

**Author:** ![stanthewizzard](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/stanthewizzard/32/11445_2.png) [@stanthewizzard](https://forum.keycloak.org/u/stanthewizzard)\
**Post date:** [October 19, 2024, 8:33am UTC](https://forum.keycloak.org/t/docker-config-ignored-during-build-time-kc-spi-hostname-v2-hostname/28346/9 "2024-10-19T08:33:26Z")

</div>

To learn at first  
Website admin  
Realm  
Passkey 😉