On Debian 13:
sudo apt update
sudo apt install openjdk-21-jdk
On RHEL 10:
sudo dnf install java-21-openjdk-devel
Verify:
java -version
sudo useradd --system --home /opt/glassfish --shell /usr/sbin/nologin glassfish
Install unzip if needed.
On Debian 13:
sudo apt install unzip
On RHEL 10:
sudo dnf install unzip
cd /tmp
GLASSFISH_VERSION=8.0.0
curl -L -o "glassfish-${GLASSFISH_VERSION}.zip" "https://download.eclipse.org/ee4j/glassfish/glassfish-${GLASSFISH_VERSION}.zip"
sudo mkdir -p /opt/glassfish
sudo unzip "glassfish-${GLASSFISH_VERSION}.zip" -d /opt
EXTRACTED_DIR="$(find /opt -maxdepth 1 -type d -name 'glassfish*' ! -name 'glassfish' | head -n1)"
sudo mv "${EXTRACTED_DIR}"/* /opt/glassfish/
sudo chown -R glassfish:glassfish /opt/glassfish
Check the latest release before installation:
https://github.com/eclipse-ee4j/glassfish/releases
sudo tee /etc/systemd/system/glassfish.service >/dev/null <<'SERVICE'
[Unit]
Description=GlassFish Server
After=network.target
[Service]
Type=forking
User=glassfish
Group=glassfish
Environment=GLASSFISH_HOME=/opt/glassfish/glassfish
Environment=JAVA_HOME=/usr/lib/jvm/java-21-openjdk
ExecStart=/opt/glassfish/glassfish/bin/asadmin start-domain
ExecStop=/opt/glassfish/glassfish/bin/asadmin stop-domain
Restart=on-failure
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=full
ProtectHome=true
ProtectControlGroups=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
LockPersonality=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
RestrictNamespaces=yes
SystemCallArchitectures=native
CapabilityBoundingSet=
AmbientCapabilities=
[Install]
WantedBy=multi-user.target
SERVICE
Note: On Debian, you may need to set JAVA_HOME to /usr/lib/jvm/java-21-openjdk-amd64.
If your app needs write access outside /opt/glassfish, add ReadWritePaths= entries to the service.
Stronger hardening (optional). This narrows filesystem/device access and may need ReadWritePaths for domains, logs, or uploads. If GlassFish fails to start, remove or relax these:
ProtectSystem=strict
PrivateDevices=yes
ProtectClock=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectProc=invisible
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictFileSystems=ext4 xfs
UMask=0077
Enable and start:
sudo systemctl daemon-reload
sudo systemctl enable --now glassfish
On UFW:
sudo ufw allow 8080/tcp
sudo ufw allow 4848/tcp
On firewalld:
sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --permanent --add-port=4848/tcp
sudo firewall-cmd --reload
http://SERVER_IP:8080http://SERVER_IP:48484848/tcp to trusted IPs only.Do you need help or support for GlassFish? Feel free to contact us!
Prefer automation? Choose your deployment method:
| Method | Description | Playbook |
|---|---|---|
| Native Installation | Installs GlassFish directly on the host system | Eclipse GlassFish Ansible Setup |
| Docker Deployment | Deploys GlassFish using Docker Compose | Eclipse GlassFish Docker Ansible Setup |
Prefer manual container setup? See Eclipse GlassFish Docker Setup.
See GlassFish Configuration for configuration guidance.
See GlassFish Security for hardening and operational security controls.
Any questions?
Feel free to contact us. Find all contact information on our contact page.