自定义Keycloak Docker镜像启用scripts等功能失败求助

我尝试在自定义Keycloak Docker镜像中启用scripts、impersonation和passkeys这几个预览功能，但按步骤操作后这些功能依然不可用。

已执行的操作 #

• 使用多阶段构建的Dockerfile
• 确保所有阶段使用相同的Keycloak版本
• 通过设置KC_FEATURES=scripts,impersonation,passkeys激活预览功能

简化版Dockerfile #

# Stage 1: Building Keycloak with features
FROM quay.io/keycloak/keycloak:${KEYCLOAK_VERSION} AS builder
ENV KC_FEATURES=scripts,impersonation,passkeys
RUN /opt/keycloak/bin/kc.sh build

# Stage 2: Final image
FROM quay.io/keycloak/keycloak:${KEYCLOAK_VERSION}
COPY --from=builder /opt/keycloak/providers/ /opt/keycloak/providers/

CMD ["/opt/keycloak/bin/kc.sh", "start", "--optimized", "--cache=ispn", "--verbose"]

遇到的问题 #

• 运行容器中/opt/keycloak/providers/目录仅包含README.md文件
• 执行/opt/keycloak/bin/kc.sh show-config显示功能已激活：kc.features = scripts,impersonation,passkeys (ENV)
• 容器启动日志里的已安装功能列表未包含这三个功能：Installed features: [agroal, cdi, hibernate-orm, jdbc-mysql, keycloak, logging-gelf, micrometer, narayana-jta, reactive-routes, resteasy-reactive, resteasy-reactive-jackson, smallrye-context-propagation, smallrye-health, vertx]
• 管理控制台中找不到“Script Mapper”选项

解决办法 #

问题根源 #

kc.sh build生成的优化构建产物不止在providers目录，还包括lib、quarkus等目录的依赖和配置变更。仅复制providers目录无法完整保留预览功能所需的文件。

方式一：复用builder阶段作为最终镜像基础（推荐） #

直接从builder阶段继承，完整保留构建后的所有产物：

# Stage 1: Building Keycloak with features
FROM quay.io/keycloak/keycloak:${KEYCLOAK_VERSION} AS builder
ENV KC_FEATURES=scripts,impersonation,passkeys
RUN /opt/keycloak/bin/kc.sh build

# Stage 2: Final image - 直接复用构建结果
FROM builder
CMD ["/opt/keycloak/bin/kc.sh", "start", "--optimized", "--cache=ispn", "--verbose"]

方式二：复制完整构建产物目录 #

若必须使用原始镜像作为最终阶段基础，需复制多个关键目录：

# Stage 1: Building Keycloak with features
FROM quay.io/keycloak/keycloak:${KEYCLOAK_VERSION} AS builder
ENV KC_FEATURES=scripts,impersonation,passkeys
RUN /opt/keycloak/bin/kc.sh build

# Stage 2: Final image
FROM quay.io/keycloak/keycloak:${KEYCLOAK_VERSION}
# 复制构建后的核心目录
COPY --from=builder /opt/keycloak/providers/ /opt/keycloak/providers/
COPY --from=builder /opt/keycloak/lib/ /opt/keycloak/lib/
COPY --from=builder /opt/keycloak/quarkus/ /opt/keycloak/quarkus/

CMD ["/opt/keycloak/bin/kc.sh", "start", "--optimized", "--cache=ispn", "--verbose"]

额外注意事项 #

• 确认KEYCLOAK_VERSION支持目标预览功能：scripts和impersonation在Keycloak 21+可用，passkeys在22+加入预览
• --optimized参数依赖之前的kc.sh build，必须配合使用才能生效
• scripts功能需在Realm设置的「Features」标签中手动启用

内容的提问来源于stack exchange，提问作者Selanas of Amber