anchor.diff:  <#import "/templates/links.adoc" as links>
   
   <@tmpl.guide
  -title="Running in a container"
  +title="Running Keycloak in a container"
   summary="Learn how to run Keycloak from a container image"
   includedOptions="db db-url db-username db-password features hostname https-key-store-file https-key-store-password metrics-enabled">
   
  -Keycloak is handling containerized environments like Kubernetes or OpenShift as first-class-citizens. In this guide you'll learn how to run and optimize the Keycloak container image to have the best experience running a Keycloak container.
  +Keycloak handles containerized environments such as Kubernetes or OpenShift as first-class citizens. This guide describes how to optimize and run the Keycloak container image to provide the best experience running a Keycloak container.
   
  -== Create an optimized container image
  -To get the best startup experience for your Keycloak container, we recommend building an optimized container image by running the `build` step explicitly before starting:
  +== Creating an optimized container image
  +For the best start up of your Keycloak container, build an optimized container image by running the `build` step before starting.
   
  -=== Build your optimized Keycloak docker image
  -The `Dockerfile` below creates a pre-configured Keycloak image which enables the metrics endpoint, the token exchange feature and uses a postgres database.
  +=== Building your optimized Keycloak docker image
  +The following `Dockerfile` creates a pre-configured Keycloak image that enables the metrics endpoint, enables the token exchange feature, and uses a PostgreSQL database.
   
   .Dockerfile:
   [source, dockerfile]
  
positive.code:         start-dev
  ----
  
  Invoking this command will spin up the Keycloak server in development mode.
  
  Keep in mind that this mode is by no means meant to be used in production environments, as it has insecure defaults. For more information about running Keycloak in production, see _todo_link_to_running_in_production_guide_.
  
  == Use auto-build to run a standard keycloak container
  Following concepts such as immutable infrastructure, containers need to be re-provisioned fairly often. In these environments, you want to have containers which start up fast by using an optimized image as described above.
  
  However, when your environment is different, you may want to run a standard Keycloak image using the `--auto-build` flag like below:
  
  [source, bash]
  ----
  
negative.code:         --https-key-store-file=<file> --https-key-store-password=<password>
  ----
  
  Running this command starts a Keycloak server that detects and applies the build options first.
  In the example, the line  `--db=postgres --features=token-exchange` sets the database vendor to PostgreSQL and enables the token exchange feature.
  
  Keycloak then starts up and applies the configuration for the specific environment.
  This approach significantly increases startup time and creates an image that is mutable, which is not the best practice.
  
  </@tmpl.guide>
  