# Keycloak 17 docker container : How to export/import realm? (import must be done on container startup) **URL:** \ **Category:** Getting advice\ **Tags:** container\ **Created:** [February 15, 2022, 3:18pm UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619 "2022-02-15T15:18:46Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![omasseau](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/omasseau/32/4433_2.png) [@omasseau](https://forum.keycloak.org/u/omasseau)\ **Post date:** [February 15, 2022, 3:18pm UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619/1 "2022-02-15T15:18:46Z")
With Keycloak 17 running in a docker container, how can we now export/import a realm ? This was documented for the docker image based on Wildfly but it is no more documented for the docker imaged base on Quarkus. Previously it was possible to export a realm using this command : ```auto docker exec -it kc /opt/jboss/keycloak/bin/standalone.sh \ -Djboss.socket.binding.port-offset=100 -Dkeycloak.migration.action=export \ -Dkeycloak.migration.provider=singleFile \ -Dkeycloak.migration.realmName=my_realm \ -Dkeycloak.migration.usersExportStrategy=REALM_FILE \ -Dkeycloak.migration.file=/tmp/my_realm.json ``` which as you can see is very specific to the Wildfly implementation (call to the Wildfly standalone.sh script). And the import was done using this command when starting the container : ```auto docker run -e KEYCLOAK_USER= -e KEYCLOAK_PASSWORD= \ -e KEYCLOAK_IMPORT=/tmp/example-realm.json -v /tmp/example-realm.json:/tmp/example-realm.json jboss/keycloak ``` How can it now be achieved with the Quarkus based image ? ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [February 15, 2022, 3:44pm UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619/2 "2022-02-15T15:44:36Z")
There are `import` and `export` commands available for `kc.sh`. From the command line: ```auto $ ./kc.sh import --help Import data from a directory or a file. Usage: kc.sh import [OPTIONS] Import data from a directory or a file. Options: --dir Set the path to a directory where files will be created with the exported data. --file Set the path to a file that will be created with the exported data. -h, --help This help message. --override Set if existing data should be skipped or overridden. Default: true. --realm Set the name of the realm to export $ ./kc.sh export --help Export data from realms to a file or directory. Usage: kc.sh export [OPTIONS] Export data from realms to a file or directory. Options: --dir Set the path to a directory where files will be created with the exported data. --file Set the path to a file that will be created with the exported data. -h, --help This help message. --realm Set the name of the realm to export --users Set how users should be exported. Possible values are: skip, realm_file, same_file, different_files. Default: different_files. --users-per-file Set the number of users per file. It?s used only if --users=different_files. Default: 50. ``` I’m also wondering where (or why) the docs are gone and not being updated. FYI: I just created a discussion thread on the repo: [Export/Import of realm data (JSON) · Discussion #10229 · keycloak/keycloak · GitHub](https://github.com/keycloak/keycloak/discussions/10229) ---
**Author:** ![omasseau](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/omasseau/32/4433_2.png) [@omasseau](https://forum.keycloak.org/u/omasseau)\ **Post date:** [February 15, 2022, 5:31pm UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619/3 "2022-02-15T17:31:30Z")
Hello, thanks for the answer 😉 I understand how it will be possible to do the export once the container is running by calling kc.sh export through docker exec. But the import of the realm needs to be done automatically when the container is started (which was the case when passing KEYCLOAK\_IMPORT environment variable to the docker run command), so calling manually _kc.sh_ import through docker exec is not a solution ---
**Author:** ![edwint88](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/edwint88/32/1103_2.png) [@edwint88](https://forum.keycloak.org/u/edwint88)\ **Post date:** [April 20, 2022, 8:45am UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619/4 "2022-04-20T08:45:28Z")
is there any update on this? on 17.0.1 seems to not work ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [April 20, 2022, 9:01am UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619/5 "2022-04-20T09:01:15Z")
Auto-import of realms will be available again with 18.x ---
**Author:** ![omasseau](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/omasseau/32/4433_2.png) [@omasseau](https://forum.keycloak.org/u/omasseau)\ **Post date:** [April 24, 2022, 8:42pm UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619/7 "2022-04-24T20:42:02Z")
Does it still use the KEYCLOAK\_IMPORT environnement variable ? I don’t see it listed in the documentation ([Running Keycloak in a container - Keycloak](https://www.keycloak.org/server/containers)) Note: Would be great to have an “Updated on” date on the documentation pages 😉 ---
**Author:** ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)\ **Post date:** [April 24, 2022, 9:32pm UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619/8 "2022-04-24T21:32:48Z")
No. There is option `--import-realm` for `start` command. See `Importing a Realm during Startup` in [Importing and Exporting Realms - Keycloak](https://www.keycloak.org/server/importExport) ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [April 25, 2022, 6:15am UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619/9 "2022-04-25T06:15:01Z")
Please, if you crosspost your questions in [various forums/boards](https://github.com/keycloak/keycloak/issues/10216#issuecomment-1107914072), add a link to the initial post/question. ---
**Author:** ![ederparaiso](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ederparaiso/32/5663_2.png) [@ederparaiso](https://forum.keycloak.org/u/ederparaiso)\ **Post date:** [May 12, 2022, 10:39pm UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619/10 "2022-05-12T22:39:29Z")
Since `--import-realm` skips import operation if realm already exists, what is the recommended way to do incremental updates to an existing realm (Specially using a container distribution mode)? ---
**Author:** ![ederparaiso](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ederparaiso/32/5663_2.png) [@ederparaiso](https://forum.keycloak.org/u/ederparaiso)\ **Post date:** [May 23, 2022, 9:27pm UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619/11 "2022-05-23T21:27:51Z")
Hi, any thoughts about previous question? ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [May 24, 2022, 5:32am UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619/12 "2022-05-24T05:32:57Z")
There‘s no tooling ootb from the Keycloak project. Community provides something useful here: [GitHub - adorsys/keycloak-config-cli: Import YAML/JSON-formatted configuration files into Keycloak - Configuration as Code for Keycloak.](https://github.com/adorsys/keycloak-config-cli) ---
**Author:** ![ederparaiso](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ederparaiso/32/5663_2.png) [@ederparaiso](https://forum.keycloak.org/u/ederparaiso)\ **Post date:** [May 24, 2022, 11:57am UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619/13 "2022-05-24T11:57:26Z")
Thanks, I’ll check this! ---
**Author:** ![arnault](https://avatars.discourse-cdn.com/v4/letter/a/e9c0ed/32.png) [@arnault](https://forum.keycloak.org/u/arnault)\ **Post date:** [June 1, 2022, 4:04pm UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619/14 "2022-06-01T16:04:19Z")
Hi, what about export, it seems that export is no more supported, we used to export data with a command-line similar to this: docker run -it --rm –name authenticate –net keycloak-network –entrypoint=’’ -v “${NEW\_CONFIGURATION}”:/config.json -e KC\_DB\_URL=jdbc:postgresql://postgres:5432/keycloak -e KC\_DB\_USERNAME=keycloak -e KC\_DB\_PASSWORD=password /busybox/sh /opt/keycloak/bin/kc.sh start --hostname-strict=false --http-enabled=true -Dkeycloak.migration.action=export -Dkeycloak.migration.provider=singleFile -Dkeycloak.migration.file=/config.json -Dkeycloak.migration.realmName=${REALM\_NAME} Is it still supposed to work ? ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [June 1, 2022, 4:17pm UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619/15 "2022-06-01T16:17:20Z")
As mentioned several times before, trying to search and read the guides/docs seems to be hard… _sigh_ > **[Importing and Exporting Realms - Keycloak](https://www.keycloak.org/server/importExport)** > > Keycloak is an open source identity and access management solution ---
**Author:** ![arnault](https://avatars.discourse-cdn.com/v4/letter/a/e9c0ed/32.png) [@arnault](https://forum.keycloak.org/u/arnault)\ **Post date:** [June 2, 2022, 12:29pm UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619/16 "2022-06-02T12:29:31Z")
Hi Dasniko, thank you for pointing out the documentation, unfortunately for me it is not working, in fact keycloak tries to connect to the database with user “sa” despite the KC\_DB\_USERNAME environment variable: HHH000342: Could not obtain connection to query metadata: org.postgresql.util.PSQLException: FATAL: password authentication failed for user “sa” Is this a known issue or am I missing something ? ---
**Author:** ![arnault](https://avatars.discourse-cdn.com/v4/letter/a/e9c0ed/32.png) [@arnault](https://forum.keycloak.org/u/arnault)\ **Post date:** [June 2, 2022, 1:38pm UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619/17 "2022-06-02T13:38:31Z")
I finally managed to make it work, sorry for the disturbing. ---
**Author:** ![sushant](https://avatars.discourse-cdn.com/v4/letter/s/f08c70/32.png) [@sushant](https://forum.keycloak.org/u/sushant)\ **Post date:** [June 4, 2022, 9:08pm UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619/18 "2022-06-04T21:08:03Z")
how did you do it can you please share. I am facing a similar issue while importing. ---
**Author:** ![arnault](https://avatars.discourse-cdn.com/v4/letter/a/e9c0ed/32.png) [@arnault](https://forum.keycloak.org/u/arnault)\ **Post date:** [June 7, 2022, 8:20am UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619/19 "2022-06-07T08:20:44Z")
Hi, the main issue I believe was that the admin account was needed to import and was not created (fresh install + import). All you need to do is carefully review your script making sure that all variables don’t have any typo and that KEYCLOAK\_ADMIN and KEYCLOAK\_ADMIN\_PASSWORD have correct values. For example for import this can be: docker run -it --rm \ –entrypoint=’’ \ -v “$KEYCLOAK\_CONFIGURATION\_JSON”:/config.json \ -e LOG\_LEVEL=INFO \ -e HOST\_IP=127.0.0.1 \ -e KC\_DB\_URL=jdbc:postgresql://postgres:5432/keycloak \ -e KC\_DB\_USERNAME=sa \ -e KC\_DB\_PASSWORD=password \ -e KEYCLOAK\_ADMIN=${ADMNIN} \ -e KEYCLOAK\_ADMIN\_PASSWORD=${ADMIN\_PWD} \ myimageofkeycloak \ /busybox/sh /opt/keycloak/bin/kc.sh \ import --file /config.json HTH. ---
**Author:** ![arnault](https://avatars.discourse-cdn.com/v4/letter/a/e9c0ed/32.png) [@arnault](https://forum.keycloak.org/u/arnault)\ **Post date:** [July 6, 2022, 10:03am UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619/20 "2022-07-06T10:03:29Z")
Hi, Sorry to come back and bother you, but the solution I found is not satisfying as it uses well-known login/password for the database connection. I’m using keycloak in cluster environment, so I first build the docker image specifying --db=postgres option. But when I want to run the “import” command, it does not allow me to specify the db command line option, it complains about unsupported options. When I run the “import” command without db command line option it complains about: ‘Could not obtain connection to query metadata: org.postgresql.util.PSQLException: FATAL: password authentication failed for user “sa”’ Is this a bug in keycloak ? I have to mention that i am using clustered keycloak in a distroless environment, so I can’t use shell commands, I have to launch java with its full list of arguments. Also the admin UI is not bundled in the application which leaves me with the only option to import realms from the command line. Any help appreciated. ---
**Author:** ![weltonrodrigo](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/weltonrodrigo/32/3104_2.png) [@weltonrodrigo](https://forum.keycloak.org/u/weltonrodrigo)\ **Post date:** [July 6, 2022, 10:59pm UTC](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619/21 "2022-07-06T22:59:32Z")
I have been using the import feature with Keycloak 18. You either: - prepare a custom image where you ran the `kc.sh build` as a dockerfile step and set `ENTRYPOINT ["/opt/keycloak/bin/kc.sh","start", "--import-realm"]` Your realm files should be at `/opt/keycloak/data/import/` - Use the official image with a custom entrypoint script where you `kc.sh build` and them `kc.sh start --import-realm` [Next page](https://forum.keycloak.org/t/keycloak-17-docker-container-how-to-export-import-realm-import-must-be-done-on-container-startup/13619.md?page=2)