anchor.diff:  <#import "/templates/links.adoc" as links>
   
   <@tmpl.guide
  -title="Running in a container"
  +title="Running Keycloak in a container"
   summary="Learn how to run Keycloak from a container image"
   includedOptions="db db-url db-username db-password features hostname https-key-store-file https-key-store-password metrics-enabled">
   
  -Keycloak is handling containerized environments like Kubernetes or OpenShift as first-class-citizens. In this guide you'll learn how to run and optimize the Keycloak container image to have the best experience running a Keycloak container.
  +Keycloak handles containerized environments such as Kubernetes or OpenShift as first-class citizens. This guide describes how to optimize and run the Keycloak container image to provide the best experience running a Keycloak container.
   
  -== Create an optimized container image
  -To get the best startup experience for your Keycloak container, we recommend building an optimized container image by running the `build` step explicitly before starting:
  +== Creating an optimized container image
  +For the best start up of your Keycloak container, build an optimized container image by running the `build` step before starting.
   
  -=== Build your optimized Keycloak docker image
  -The `Dockerfile` below creates a pre-configured Keycloak image which enables the metrics endpoint, the token exchange feature and uses a postgres database.
  +=== Building your optimized Keycloak docker image
  +The following `Dockerfile` creates a pre-configured Keycloak image that enables the metrics endpoint, enables the token exchange feature, and uses a PostgreSQL database.
   
   .Dockerfile:
   [source, dockerfile]
  
positive.code:         --https-key-store-file=<file> --https-key-store-password=<password>
  ----
  
  Running the above will spin up a Keycloak server which detects and applies the build configuration first. In the example, it's  `--db=postgres --features=token-exchange` to set the used database vendor to postgres and enable the token exchange feature.
  
  Keycloak will then start up and apply the configuration for the specific environment. This approach results in a significantly bigger startup time, and an image that is mutable, and is therefor not the best practice.
  
  </@tmpl.guide>
  
negative.code: ENV KC_HOSTNAME=localhost:8443
  ENTRYPOINT ["/opt/keycloak/bin/kc.sh", "start"]
  ----
  The build process includes multiple stages:
  
  * The `build` command applies options that create an optimized image.
  * The files generated by the `build` process are copied into a new image.
  * In this runner image, the specific run configuration is applied. That configuration contains a keystore, the environment-specific hostname configuration, and database configuration.
  * In the entrypoint, the `start` command starts the image in production mode.
  
  This example uses a multi-staged build to demonstrate the build and run steps.  However, you can also run this process as a single-staged docker build.
  
  === Building the docker image
  To build the actual docker image, run the following command from the directory containing your Dockerfile:
  
  [source,bash]
  ----
  podman|docker build . -t prebuilt_keycloak
  ----
  
  === Starting the optimized Keycloak docker image
  To start the image, run:
  [source, bash]
  ----
  podman|docker run --name optimized_keycloak -p 8443:8443 prebuilt_keycloak
  ----
  Keycloak starts in production mode, using only secured HTTPS communication, and is available on `https://localhost:8443`.
  Notice that the startup log contains the following line:
  [source, bash]
  ----
  INFO  [org.key.com.Profile] (main) Preview feature enabled: token_exchange
  ----
  This message shows the desired feature is enabled.
  
  Opening up `https://localhost:8443/metrics` leads to a page containing operational metrics that could be used by your monitoring solution.
  
  == Trying Keycloak in development mode
  The easiest way to try Keycloak from a container for development or testing purposes is to use the Development mode.
  You use the `start-dev` command:
  
  [source,bash]
  ----
  