Apache Karaf, the enterprise modulith runtime https://karaf.apache.org
  • Java 96.6%
  • Shell 1.3%
  • Batchfile 0.7%
  • JavaScript 0.5%
  • SCSS 0.3%
  • Other 0.5%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
JB Onofré f0bd4a1ddb
docs: clarify how SECURITY.md treats commands of optional features (#3063)
* docs: clarify how SECURITY.md treats commands of optional features

The shipped command ACLs cover the features that Karaf installs at
startup. A feature that an admin installs later can add commands with no
ACL, including commands that run code (for example groovy:exec before
the groovy scope got an ACL).

Say so in the "Roles and ACLs" section, limit the viewer vulnerability
case to a Karaf with only its boot features, and list a missing ACL on a
command added by an optional feature as hardening.

* docs: reword SECURITY.md for commands added by features

Say that the command ACL rules apply to the commands a feature adds,
scope the viewer vulnerability to the default installation (featuresBoot)
and to what the shipped ACLs open to viewer, and say in the hardening
section that only an admin can install a feature, that the admin should
check the commands it adds, and that we ship a default ACL when we find
such a command.
2026-11-05 17:36:26 +01:00
.github build(deps): bump dawidd6/action-download-artifact from 27 to 28 (#3055) 2026-11-04 16:50:32 +01:00
.mvn
archetypes
assemblies
audit
bom
bundle
client
config
deployer
diagnostic
docker
etc/appended-resources
event
examples
features
http
instance
itests fix(itests): remove stale karaf-jpa-example-provider-api dependency (#3059) 2026-11-04 14:30:32 +01:00
jaas
jdbc
jms
jndi
kar
log
main
management
manual docs: explain enableGeneration configuration (#3029) 2026-10-31 05:53:00 +01:00
maven
obr
package
profile
scheduler
scr
service
services
shell
subsystem
system
tooling
util
web
webconsole
wrapper
.asf.yaml
.gitignore
.gitpod.yml
BUILDING.md
create-tracker.script
LICENSE
NOTICE
pom.xml build(deps): bump org.apache.felix:org.apache.felix.http.jetty12 (#3061) 2026-11-05 05:32:02 +01:00
README.md
SECURITY.md docs: clarify how SECURITY.md treats commands of optional features (#3063) 2026-11-05 17:36:26 +01:00

Apache Karaf

Apache Karaf is a modulith runtime, supporting several frameworks and programming model (REST/API, web, spring boot, ...). It provides turnkey features that you can directly leverage without effort, packaged as mutable or immutable application.

Overview

  • Hot deployment: Karaf supports hot deployment of applications (in the deploy directory).
  • Dynamic configuration: Karaf uses a central location (etc directory) for configuration (in different format, properties, json) and can be plug on existing configuration backend.
  • Logging System: using a centralized logging back end supported by Log4J, Karaf supports a number of different APIs (JDK 1.4, JCL, SLF4J, Avalon, Tomcat, ...)
  • Provisioning: Provisioning of libraries or applications can be done through a number of different ways, by which they will be downloaded locally, installed and started. It interacts with the resolver to automatically install the required components.
  • Extensible Shell console: Karaf features a nice text console where you can manage the services, install new applications or libraries and manage their state. This shell is easily extensible by deploying new commands dynamically along with new features or applications.
  • Remote access: use any SSH client to connect to the kernel and issue commands in the console
  • Security & ACL framework based on JAAS providing complete RBAC solution.
  • Managing instances: Karaf provides simple commands for managing instances of Karaf. You can easily create, delete, start and stop instances of Karaf through the console.
  • Enterprise features: Karaf provides a bunch of enterprise features that you can use in your applications (JDBC, JPA, JTA, JMS, ...).
  • HTTP Service: Karaf provides a full features web container, allowing you to deploy your web applications.
  • REST & Services: Karaf supports different service frameworks as Apache CXF allowing you to easily implements your services.
  • Karaf Extensions: Karaf project is a complete ecosystem. The runtime can be extended by other Karaf subprojects such as Karaf Decanter, Karaf Cellar, Karaf Cave, ...
  • Third Party Extensions: Karaf is a supported runtime for a lot of other projects as Apache Camel, and much more.

Getting Started

For an Apache Karaf source distribution, please read BUILDING.md for instructions on building Apache Karaf.

The PDF manual is the right place to find any information about Karaf.

The examples provide a bunch of turnkey minimal applications that you can deploy in Apache Karaf and extend/template as you want.

[NOTE]

Windows users should use 7zip or other unzip tool to support files longer than 255 characters.

Contact Us

To get involved in Apache Karaf:

We also have a contributor's guide.

More Information

Many thanks for using Apache Karaf.

The Apache Karaf Team