nuxeo-2025

packaged by Chainguard

Chainguard Container for nuxeo-2025

Nuxeo is an open source content management platform for building modern business applications.

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/nuxeo-2025:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Compatibility Notes

The Chainguard nuxeo-2025 container image is comparable to the upstream Nuxeo LTS 2025 Docker image, which is built from Oracle Linux 9 with Zulu JDK 21. As with other Chainguard Containers, this image uses Wolfi as the base OS and OpenJDK 21 instead of Zulu JDK.

The image runs as the non-root user nuxeo (UID 900) and keeps the upstream layout, so NUXEO_HOME is /opt/nuxeo/server, configuration is read from /etc/nuxeo/nuxeo.conf, and drop-in scripts in /docker-entrypoint-initnuxeo.d run at startup.

Two differences from the upstream image are worth noting:

• WordPerfect conversion is not available. Upstream installs libwpd-tools to provide the wpd2text command behind Nuxeo's application/wordperfect converter. That tool's last upstream release was in 2018, so it is deliberately omitted. Nuxeo logs the converter as unavailable and starts normally; every other converter, including the LibreOffice, ImageMagick, Ghostscript, Poppler, ExifTool, and FFmpeg integrations, is present.
• The vim editor is not included, so EDITOR is left unset. Upstream installs vim-enhanced and points EDITOR at it for interactive use inside the container; Nuxeo itself never invokes an editor.

Unlike the nuxeo-2023 image, this image does not set LAUNCHER_DEBUG. OpenJDK 21 reports a version string that Nuxeo's launcher parses correctly, so its JVM version check runs normally rather than being disabled.

Getting Started

Nuxeo LTS 2025 runs without any external services in its default configuration. The repository is backed by an embedded H2 database, and search is served by the repository itself through the nuxeo.search.client.default.name setting, which defaults to repository.

To verify the image, run the nuxeoctl management command:

docker run --rm cgr.dev/ORGANIZATION/nuxeo-2025:latest nuxeoctl help

To start the server and expose it on port 8080:

docker run --rm --name nuxeo -p 8080:8080 cgr.dev/ORGANIZATION/nuxeo-2025:latest

Startup takes a short while. Once the log reports Nuxeo Platform Started, confirm every health probe passes:

curl -sf http://localhost:8080/nuxeo/runningstatus

The endpoint returns HTTP 500 until every probe is healthy, so curl -sf succeeding is itself the check. The response reports one field per probe, for example:

{"runtimeStatus":"ok","ldapDirectories":"ok","repositoryStatus":"ok","streamStatus":"ok"}

The REST API is then ready for use. This creates a workspace, reads it back, and removes it, using the default Administrator credentials:

curl -sf -u Administrator:Administrator \
  -X POST -H 'Content-Type: application/json' \
  -d '{"entity-type":"document","name":"example","type":"Workspace","properties":{"dc:title":"Example Workspace"}}' \
  http://localhost:8080/nuxeo/api/v1/path/default-domain/workspaces
curl -sf -u Administrator:Administrator \
  http://localhost:8080/nuxeo/api/v1/path/default-domain/workspaces/example
curl -sf -u Administrator:Administrator \
  -X DELETE http://localhost:8080/nuxeo/api/v1/path/default-domain/workspaces/example

This distribution is API-only and ships no user interface. Opening localhost:8080/nuxeo in a browser serves a landing page that says so and points at the packages that add one:

nuxeoctl mp-install nuxeo-web-ui

Those packages come from Nuxeo Connect and need a registered instance, so they are not installed here.

The embedded H2 database is intended for evaluation. Configure MongoDB or PostgreSQL for any real deployment, as described below.

Configuration

Nuxeo reads /etc/nuxeo/nuxeo.conf, and the entrypoint appends every file it finds in /etc/nuxeo/conf.d to that file before starting. Mounting a file into conf.d is therefore the way to configure the container, because it composes with the settings the entrypoint writes itself.

A production deployment typically replaces the embedded database with MongoDB and moves search to OpenSearch. Create a configuration fragment:

cat > 10-backends.conf <<EOF
nuxeo.templates=default,mongodb
nuxeo.mongodb.server=mongodb://mongo:27017
nuxeo.mongodb.dbname=nuxeo
nuxeo.search.client.default.name=opensearch
nuxeo.wizard.done=true
EOF

Then mount it into conf.d:

docker run --rm --name nuxeo -p 8080:8080 \
  -v "$(pwd)/10-backends.conf:/etc/nuxeo/conf.d/10-backends.conf" \
  cgr.dev/ORGANIZATION/nuxeo-2025:latest

The numeric prefix matters because the entrypoint applies conf.d files in sorted order, so a later file can override an earlier one. Setting nuxeo.wizard.done skips the interactive setup wizard, which is appropriate for an unattended container.

Persist repository data and logs by mounting volumes over /var/lib/nuxeo and /var/log/nuxeo. Both directories are owned by UID 900, so a mounted volume must be writable by that user.

Documentation and Resources

• Nuxeo Platform documentation
• Nuxeo Docker image documentation
• Nuxeo REST API documentation
• Nuxeo GitHub repository, 2025 branch

What are Chainguard Containers?

Chainguard's free tier of Starter container images are built with Wolfi, our minimal Linux undistro.

All other Chainguard Containers are built with Chainguard OS, Chainguard's minimal Linux operating system designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a development, or -dev, variant.

In all other cases, including Chainguard Containers tagged as :latest or with a specific version number, the container images include only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager.

Although the -dev container image variants have similar security features as their more minimal versions, they include additional software that is typically not necessary in production environments. We recommend using multi-stage builds to copy artifacts from the -dev variant into a more minimal production image.

Need additional packages?

To improve security, Chainguard Containers include only essential dependencies. Need more packages? Chainguard customers can use Custom Assembly to add packages, either through the Console, chainctl, or API.

To use Custom Assembly in the Chainguard Console: navigate to the image you'd like to customize in your Organization's list of images, and click on the Customize image button at the top of the page.

Learn More

Refer to our Chainguard Containers documentation on Chainguard Academy. Chainguard also offers VMs and Libraries — contact us for access.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.