From 022ddafb0906e9fdda970edd8d61a56f4bdaa93f Mon Sep 17 00:00:00 2001
From: Bitnami Bot <bitnami.bot@broadcom.com>
Date: Mon, 30 Mar 2026 20:04:33 +0200
Subject: [PATCH] [bitnami/tomcat] Release 11.0.21-debian-12-r0 (#91884)

Signed-off-by: Bitnami Bot <bitnami.bot@broadcom.com>
---
 bitnami/tomcat/11.0/debian-12/Dockerfile | 10 +++++-----
 bitnami/tomcat/README.md                 | 21 ++-------------------
 2 files changed, 7 insertions(+), 24 deletions(-)

diff --git a/bitnami/tomcat/11.0/debian-12/Dockerfile b/bitnami/tomcat/11.0/debian-12/Dockerfile
index 7d1809c53c46..bec4d09782a3 100644
--- a/bitnami/tomcat/11.0/debian-12/Dockerfile
+++ b/bitnami/tomcat/11.0/debian-12/Dockerfile
@@ -8,13 +8,13 @@ ARG JAVA_EXTRA_SECURITY_DIR="/bitnami/java/extra-security"
 ARG TARGETARCH
 
 LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \
-      org.opencontainers.image.created="2026-03-17T10:20:55Z" \
+      org.opencontainers.image.created="2026-03-30T17:44:55Z" \
       org.opencontainers.image.description="Application packaged by Broadcom, Inc." \
       org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/tomcat/README.md" \
       org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/tomcat" \
       org.opencontainers.image.title="tomcat" \
       org.opencontainers.image.vendor="Broadcom, Inc." \
-      org.opencontainers.image.version="11.0.20"
+      org.opencontainers.image.version="11.0.21"
 
 ENV HOME="/" \
     OS_ARCH="${TARGETARCH:-amd64}" \
@@ -31,7 +31,7 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \
     COMPONENTS=( \
       "render-template-1.0.9-163-linux-${OS_ARCH}-debian-12" \
       "jre-21.0.10-10-0-linux-${OS_ARCH}-debian-12" \
-      "tomcat-11.0.20-1-linux-${OS_ARCH}-debian-12" \
+      "tomcat-11.0.21-0-linux-${OS_ARCH}-debian-12" \
     ) ; \
     for COMPONENT in "${COMPONENTS[@]}"; do \
       if [ ! -f "${COMPONENT}.tar.gz" ]; then \
@@ -51,9 +51,9 @@ RUN uninstall_packages curl
 COPY rootfs /
 RUN /opt/bitnami/scripts/java/postunpack.sh
 RUN /opt/bitnami/scripts/tomcat/postunpack.sh
-ENV APP_VERSION="11.0.20" \
+ENV APP_VERSION="11.0.21" \
     BITNAMI_APP_NAME="tomcat" \
-    IMAGE_REVISION="1" \
+    IMAGE_REVISION="0" \
     JAVA_HOME="/opt/bitnami/java" \
     PATH="/opt/bitnami/common/bin:/opt/bitnami/java/bin:/opt/bitnami/tomcat/bin:$PATH"
 
diff --git a/bitnami/tomcat/README.md b/bitnami/tomcat/README.md
index 29c8ef0561f5..9faa4ffa5bc4 100644
--- a/bitnami/tomcat/README.md
+++ b/bitnami/tomcat/README.md
@@ -44,25 +44,7 @@ Learn more about the Bitnami tagging policy and the difference between rolling t
 
 ## Get this image
 
-The recommended way to get the Bitnami Apache Tomcat Docker Image is to pull the prebuilt image from the [Docker Hub Registry](https://hub.docker.com/r/bitnami/tomcat).
-
-```console
-docker pull bitnami/tomcat:latest
-```
-
-To use a specific version, you can pull a versioned tag. You can view the [list of available versions](https://hub.docker.com/r/bitnami/tomcat/tags/) in the Docker Hub Registry.
-
-```console
-docker pull bitnami/tomcat:[TAG]
-```
-
-If you wish, you can also build the image yourself by cloning the repository, changing to the directory containing the Dockerfile and executing the `docker build` command. Remember to replace the `APP`, `VERSION` and `OPERATING-SYSTEM` path placeholders in the example command below with the correct values.
-
-```console
-git clone https://github.com/bitnami/containers.git
-cd bitnami/APP/VERSION/OPERATING-SYSTEM
-docker build -t bitnami/APP:latest .
-```
+The Bitnami Apache Tomcat Docker image is only available to [Bitnami Secure Images](https://bitnami.com) customers.
 
 ## Using `docker-compose.yaml`
 
@@ -165,6 +147,7 @@ Refer to the [Apache Tomcat configuration](https://tomcat.apache.org/tomcat-11.0
 The Bitnami Apache Tomcat Docker image from the [Bitnami Secure Images](https://go-vmware.broadcom.com/contact-us) catalog includes extra features and settings to configure the container with FIPS capabilities. You can configure the next environment variables:
 
 - `OPENSSL_FIPS`: whether OpenSSL runs in FIPS mode or not. `yes` (default), `no`.
+- `JAVA_TOOL_OPTIONS`: controls Java FIPS mode. Use `-Djava.security.properties==/opt/bitnami/java/conf/security/java.security.restricted` (restricted), `-Djava.security.properties==/opt/bitnami/java/conf/security/java.security.relaxed` (relaxed), or `-Djava.security.properties==/opt/bitnami/java/conf/security/java.security.original` (off).
 
 ## Logging