Keycloak 17 docker container : How to export/import realm? (import must be done on container startup)

Getting advice
22

The following docker-compose works for me:

services:
  auth:
    image: quay.io/keycloak/keycloak:18.0
    ports:
      - "8080:8080"
    environment:
      KEYCLOAK_ADMIN: admin 
      KEYCLOAK_ADMIN_PASSWORD: admin
    command: 
      - start-dev 
      - --import-realm
    volumes:
      - ./docker/auth/realm.json:/opt/keycloak/data/import/realm.json
23

Hi,

We solved this with the following config :

Custom Dockerfile to automate import

FROM quay.io/keycloak/keycloak:18.0.2
# Must add json files before import, volume is not mounted yet
ADD ./realms /opt/keycloak/data/import/
# Import all files
RUN /opt/keycloak/bin/kc.sh import --dir=/opt/keycloak/data/import/ --override true; exit 0
# Start image
ENTRYPOINT ["/opt/keycloak/bin/kc.sh", "-v", "start-dev"]

  keycloak:
    build:
      ./keycloak/
    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
    container_name: my-keycloak
    volumes:
      - ./keycloak/conf:/opt/keycloak/conf
      - ./keycloak/realms:/opt/keycloak/data/import
      - ./keycloak/themes:/opt/keycloak/themes
    ports:

Be sure to use ‘docker-compose up --build -d’ to import realms.

++

24

Thanks for idea. I spent half of the day to reach test environment with prepared data.
This thread doesn’t have how to get data from docker. I share.
First we need to understand how to get data.

docker run -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin -p 127.0.0.1:8080:8080 --rm -it --entrypoint bash quay.io/keycloak/keycloak:20.0.1

this command start without running keycloak and you can run with bash
/opt/keycloak/bin/kc.sh start-dev
Now we can add client and users. Open link http://localhost:8080/admin/. After stop server and execute next command to import data to directory
/opt/keycloak/bin/kc.sh export --dir /tmp/import
copy from containter to localhost , execute from localhost where 4eb45b6c5063 - CONTAINER ID of the container , to find CONTAINER ID execute command docker ps
docker cp 4eb45b6c5063:/tmp/import/ ./
Now we can create docker file and build

FROM quay.io/keycloak/keycloak:20.0.1
ADD ./import /opt/keycloak/data/import
RUN /opt/keycloak/bin/kc.sh import --dir=/opt/keycloak/data/import/ --override true; exit 0
ENTRYPOINT ["/opt/keycloak/bin/kc.sh", "-v"]`

Build docker build -t gdev.by/keycloak:0.2 .
and run docker docker run -p 127.0.0.1:8080:8080 -t gdev.by/keycloak:0.2 start-dev

25

in Quay it is possible import without any problem. You need to select realm-settings and in right up corner click on actions and export.

26

For anyone messing with docker & bitnami/keycloak, I have a working solution to import both a custom master (/import/master) and a dev (/import/dev-realm) realm (dev-realm in my case):

.env:

COMPOSE_FILE_SEPARATOR=;
COMPOSE_FILE=keycloak-compose.yaml

KEYCLOAK_VERSION=19.0.3-debian-11-r15
KEYCLOAK_USER=dev
KEYCLOAK_PASSWORD=dev
KEYCLOAK_POSTGRES_VERSION=14.2.0
KEYCLOAK_POSTGRES_DATABASE=dev
KEYCLOAK_POSTGRES_USER=dev
KEYCLOAK_POSTGRES_PASSWORD=dev

keycloak-compose.yaml:

volumes:
  bitnami-keycloak-pg-data:
    name: bitnami-keycloak-pg-data
    driver: local
  bitnami-keycloak-pg-preinitdb:
    name: bitnami-keycloak-pg-preinitdb
    driver: local
  bitnami-keycloak-pg-initdb:
    name: bitnami-keycloak-pg-initdb
    driver: local

services:
  keycloak-x-pg:
    container_name: ws-keycloak-x-pg
    image: docker.io/bitnami/postgresql:${KEYCLOAK_POSTGRES_VERSION}
    restart: unless-stopped
    ports:
      - 8002:5432
    environment:
      POSTGRESQL_DATABASE: ${KEYCLOAK_POSTGRES_DATABASE}
      POSTGRESQL_USERNAME: ${KEYCLOAK_POSTGRES_USER}
      POSTGRESQL_PASSWORD: ${KEYCLOAK_POSTGRES_PASSWORD}
    networks:
      - bitnami
    volumes:
      - bitnami-keycloak-pg-data:/bitnami/postgresql
      - bitnami-keycloak-pg-preinitdb:/docker-entrypoint-preinitdb.d
      - bitnami-keycloak-pg-initdb:/docker-entrypoint-initdb.d

  keycloak-x:
    container_name: ws-keycloak-x
    image: docker.io/bitnami/keycloak:${KEYCLOAK_VERSION}
    restart: unless-stopped
    ports:
      - 8003:8080
    environment:
      KEYCLOAK_CREATE_ADMIN_USER: true
      KEYCLOAK_ADMIN_USER: ${KEYCLOAK_USER}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_PASSWORD}
      KEYCLOAK_DATABASE_HOST: ws-keycloak-x-pg
      KEYCLOAK_DATABASE_PORT: 5432
      KEYCLOAK_DATABASE_NAME: ${KEYCLOAK_POSTGRES_DATABASE}
      KEYCLOAK_DATABASE_USER: ${KEYCLOAK_POSTGRES_USER}
      KEYCLOAK_DATABASE_PASSWORD: ${KEYCLOAK_POSTGRES_PASSWORD}
    command: [ "/scripts/run_import.sh" ]
    networks:
      - bitnami
    volumes:
      - ./keycloak/scripts:/scripts
      - ./keycloak/import:/import
      - ./keycloak/export:/export
    depends_on:
      - keycloak-x-pg

run_import.sh:

#!/bin/sh

echo "Importing master.."
/opt/bitnami/keycloak/bin/kc.sh import --dir=/import/master --override true 2>/dev/null 

echo "Importing dev-realm.."
/opt/bitnami/keycloak/bin/kc.sh import --dir=/import/dev-realm --override true 2>/dev/null

### Resume normal execution
/opt/bitnami/scripts/keycloak/run.sh
  • Stderr output shown below is handled by 2>/dev/null 
2022-12-26 04:03:28 2022-12-25 23:03:28,260 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Failed to start server in (import_export) mode
2022-12-26 04:03:28 2022-12-25 23:03:28,261 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Script upload is disabled
2022-12-26 04:03:28 2022-12-25 23:03:28,261 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) For more details run the same command passing the '--verbose' option. Also you can use '--help' to see the details abou
  • After that it will start as normal
2022-12-26 04:03:51 2022-12-25 23:03:51,798 INFO  [io.quarkus] (main) Keycloak 19.0.3 on JVM (powered by Quarkus 2.7.6.Final) started in 4.766s. Listening on: http://0.0.0.0:8080

Start with

docker compose up -d

Stop with

docker compose down -v
27

Hello, tested with docker compose:

  keycloak:
    image: 'keycloak/keycloak:21.1.1'
    container_name: keycloak
    entrypoint: ["/bin/bash", "-c"]
    command:
      - /opt/keycloak/bin/kc.sh import --dir /opt/keycloak/data/import --override true && /opt/keycloak/bin/kc.sh start-dev
28

Keycloak 23.0.4 is not starting
using docker image and EC2 container.

Here is my Docker:

FROM public.ecr.aws/docker/library/maven:3.8.4-openjdk-17-slim as maven-builder

COPY native-s3-pom.xml ./

RUN mvn package -f native-s3-pom.xml

FROM Quay as keycloak-builder

ENV KC_HEALTH_ENABLED=true
ENV KC_METRICS_ENABLED=true
ENV KC_DB=mysql
ENV KC_FEATURES=preview,token-exchange,admin-fine-grained-authz
ENV KC_CACHE_STACK=ec2
ENV KC_HTTP_RELATIVE_PATH=/auth
ENV PROXY_ADDRESS_FORWARDING=true
ENV KC_HTTP_ENABLED=true
ENV KC_PROXY=edge

ENV KC_HOSTNAME_STRICT_HTTPS: false

COPY APM/.jar /opt/keycloak/providers/
COPY --from=maven-builder --chown=s3-native-ping-bundle--jar-with-dependencies.jar /opt/keycloak/providers/

RUN /opt/keycloak/bin/kc.sh build

FROM Quay
COPY --from=keycloak-builder /opt/keycloak/lib/quarkus/ /opt/keycloak/lib/quarkus/
COPY --from=keycloak-builder /opt/keycloak/providers/* /opt/keycloak/providers/
COPY themes /opt/keycloak/themes/
COPY keycloak.conf /opt/keycloak/conf/
WORKDIR /opt/keycloak

RUN /opt/keycloak/bin/kc.sh show-config

ENTRYPOINT [“/opt/keycloak/bin/kc.sh” , “start”]

EXPOSE 22 8080 8443 9990 9993 7800

29

Why are you hijacking this thread? This seems entirely unrelated to the export/import situation.

Please create a new topic, and describe the issue you are facing including logs.

Bonus points will be awarded for using the preformatted text feature to increase readability.

30

Sighing and point to this documentation actually isn’t helpful at all, as only says that the export/import can’t be done while the server is running, but it offers no exaplantion as to how to stop a running server.