In principle, this depends on the application (war) being deployed and maybe even the runtime configuration of that application (if it is database-agnostic).

The Connector's connectionTimeout and keepAliveTimeout could be made configurable.

tomcat interrupts an incoming transfer (PUT) byte stream exceeds content-length, leading to poor error message and logging

The base tomcat:xxx images from Apache will shrink the Dockerfiles significantly.

The pgdg-centos10-10-2.noarch.rpm file is no longer available for download. It needs to be updated or the default postgres image would be a good fix.

This is for base container cadc-tomcat.

In kubernetes, the 'runAsUser' directive requires the uid of the user. It does not accept 'tomcat'. If the cadc-tomcat image were to explicitly set (and document) the uid of user tomcat kubernetes could refer to that uid.

In kubernetes, these two config items should be configured as secrets so as to (somewhat) protect them. This means that they cannot go in /config because one is not allowed to mount secrets and config maps to the same location (or a subdir).

The base openjdk image is smaller and will shrink the Dockerfile significantly.

The cadc-tomcat and cadc-java Docker images are built on top of Fedora 34

Fedora 34 reached end-of-life on 7th June 2022 (https://docs.fedoraproject.org/en-US/releases/eol/). This means that it no longer receives updates and fixes, including security related ones.

It is suggested that these Docker images be based on a supported version of Fedora, or ideally a long supported release of an OS, like AlmaLinux, Rocky Linux or Ubuntu, so that they remain current.

native component requirements that are currently supported:

1. network diagnostic tools for operators: openssl, curl, ncat
2. native libs to go with OpenCADC JNI binding libs: erfa, wcs

Without judging the merits of using each of these - just enumerating what could be needed... native component requirements that could be added:

1. native tools that get exec'ed by OpenCADC java code (cavern): acl
2. native components to integrate users at o/s level for science platform (cavern): sssd-client (vos.git/cavern)
3. native component to support OIDC token renewal: oidc-agent

The $JAVA_HOME variable must be set with a valid JDK.

Needlessly confusing for developers trying to use it with cadc-tomcat based images