anchor.diff:          start-dev
   ----
   
  -Invoking this command will spin up the Keycloak server in development mode.
  +Invoking this command starts the Keycloak server in development mode.
   
  -Keep in mind that this mode is by no means meant to be used in production environments, as it has insecure defaults. For more information about running Keycloak in production, see _todo_link_to_running_in_production_guide_.
  +This mode should be strictly avoided in production environments because it has insecure defaults.
  +For more information about running Keycloak in production, see _todo_link_to_running_in_production_guide_.
   
   == Use auto-build to run a standard keycloak container
  -Following concepts such as immutable infrastructure, containers need to be re-provisioned fairly often. In these environments, you want to have containers which start up fast by using an optimized image as described above.
  -
  -However, when your environment is different, you may want to run a standard Keycloak image using the `--auto-build` flag like below:
  +In keeping with concepts such as immutable infrastructure, containers need to be re-provisioned routinely.
  +In these environments, you need containers that start fast, therefore you need to create an optimized image as described in the preceding section.
  +However, if your environment has different requirements, you can run a standard Keycloak image using the `--auto-build` flag.
  +For example:
   
   [source, bash]
   ----
  
positive.code: ENV KC_HOSTNAME=localhost:8443
  ENTRYPOINT ["/opt/keycloak/bin/kc.sh", "start"]
  ----
  In the first stage of this multi-staged build, we're creating the optimized image using the `build` command to apply the build options. From the `builder`, we're copying the files generated by the `build` process into a new image. In this runner image, we apply the specific run configuration, containing e.g. a keystore, the environment-specific hostname configuration and database configuration. Then this image gets started in production mode by using the `start` command in the entrypoint.
  
  Note that this example uses a multi-staged build to explicitly showcase the build and run steps. It could also be run as a single-staged docker build.
  
  === Building the docker image
  To build the actual docker image, run the following command form the Directory containing your Dockerfile:
  [source,bash]
  ----
  podman|docker build . -t prebuilt_keycloak
  ----
  
  === Start the optimized Keycloak docker image:
  To start the image, run:
  [source, bash]
  ----
  podman|docker run --name optimized_keycloak -p 8443:8443 prebuilt_keycloak
  ----
  Keycloak starts up in production mode, using only secured HTTPS communication, and is available on `https://localhost:8443`.
  You'll notice that the startup log contains the following line:
  [source, bash]
  ----
  INFO  [org.key.com.Profile] (main) Preview feature enabled: token_exchange
  ----
  This shows the desired feature is enabled.
  
  Opening up `https://localhost:8443/metrics` leads to a page containing operational metrics which could be used by your monitoring solution.
  
  == Try Keycloak out in development mode
  The easiest way to try out Keycloak from a container for development or testing purposes is using the Development mode by using the `start-dev` command:
  
  [source,bash]
  ----
  
negative.code:         --https-key-store-file=<file> --https-key-store-password=<password>
  ----
  
  Running this command starts a Keycloak server that detects and applies the build options first.
  In the example, the line  `--db=postgres --features=token-exchange` sets the database vendor to PostgreSQL and enables the token exchange feature.
  
  Keycloak then starts up and applies the configuration for the specific environment.
  This approach significantly increases startup time and creates an image that is mutable, which is not the best practice.
  
  </@tmpl.guide>
  