Running Tika in Docker

The project publishes two images on Docker Hub: apache/tika (the REST server, port 9998) and apache/tika-grpc (the gRPC server, port 9090).

docker run -d -p 127.0.0.1:9998:9998 apache/tika:X.Y.Z
curl -T document.pdf http://localhost:9998/tika
Bind to 127.0.0.1 unless you mean otherwise. Docker writes its own iptables rules, so -p 9998:9998 can publish the server to the internet past a host firewall. Tika parses untrusted input by design — see Security.

Choosing an image

Variant Contents

apache/tika:<version>

Minimal. A JRE and the tika-server-standard distribution — every pure-Java parser, nothing external.

apache/tika:<version>-full

Adds the external tools some parsers shell out to: Tesseract OCR (with eng, ita, fra, spa, deu, jpn language packs), GDAL, ImageMagick, ffmpeg (for the audio and video segments of a MEDIA inference binding), and the Liberation, FreeFont, Noto CJK, IPA and WenQuanYi font sets. Considerably larger.

apache/tika-grpc:<version>

gRPC server on port 9090, with OCR, GDAL and fonts included.

Take -full if you OCR scanned documents, parse geospatial rasters, or embed audio and video with a MEDIA inference binding; otherwise take minimal.

Tags come in three forms: <version> rolls forward if the image is rebuilt for the same Tika release, <version>-<N> is immutable and is what to pin in production, and latest tracks the newest stable release. The apache/tika images — minimal and -full alike — are published for linux/amd64, linux/arm64 and linux/s390x; apache/tika-grpc is published for linux/amd64 and linux/arm64 only. docker pull picks the right one.

What is inside

Knowing the layout matters as soon as you mount anything.

Path or setting Value

/opt/tika-server

The unzipped distribution: the server jar, lib/, and plugins/. Also the working directory.

/tika-extras

On the classpath, empty by default. Mount a directory of extra jars here.

Process user

UID/GID 35002:35002, not root. Mounted files must be readable, and any directory the server writes to must be writable, by that UID.

Entry point

TikaServerCli -h 0.0.0.0, plus whatever you pass as the container command. The bind host is already set, so do not pass -h again.

Configuration

Mount a tika-config.json and point the server at it with -c. Anything after the image name is appended to the entry point.

docker run -d -p 127.0.0.1:9998:9998 \
  -v "$(pwd)/tika-config.json:/tika-config.json" \
  apache/tika:X.Y.Z-full -c /tika-config.json

For example, to keep the full image’s parsers but turn OCR off:

{ "text-recognizers": [] }

See Configuration for the file format.

A catalog preset needs no file: name it in TIKA_PRESETS (comma-separated) or with --preset, and its route is live:

docker run -d -p 127.0.0.1:9998:9998 -e TIKA_PRESETS=thumbnail apache/tika:X.Y.Z-full
curl -T document.pdf http://localhost:9998/unpack/preset/thumbnail

See Presets.

Extra jars

Mount a directory of jars at /tika-extras — it is already on the container’s classpath, and the jars are forwarded to the forked JVMs as well.

docker run -d -p 127.0.0.1:9998:9998 -v "$(pwd)/my-jars:/tika-extras" \
  apache/tika:X.Y.Z-full

Treat that directory as a trusted code location: whatever is in it runs with the full privileges of the Tika process. Outside Docker the equivalent is the tika.extras.dir system property.

Adding fonts

Fonts matter only when Tika renders a PDF page (OCR, page images for a vision model, thumbnails) and the PDF does not embed the font it uses. Text extraction does not need them. The -full image covers the common cases: Liberation for Arial, Times New Roman and Courier New, plus Noto CJK, IPA and WenQuanYi for Chinese and Japanese.

To render with other fonts, install them in an image of your own. For example, the Microsoft core fonts (Verdana, Georgia, Trebuchet and others), whose license you accept by installing them:

FROM apache/tika:X.Y.Z-full
USER root
RUN echo ttf-mscorefonts-installer msttcorefonts/accepted-mscorefonts-eula select true \
      | debconf-set-selections \
    && apt-get update \
    && DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends \
         ttf-mscorefonts-installer \
    && rm -rf /var/lib/apt/lists/*
USER 35002:35002

The installer downloads the fonts from SourceForge, so the build needs network access.

Pipes plugins

/tika, /rmeta, /meta and /unpack work out of the box. The pipes endpoints (/pipes, /async) need the fetcher and emitter plugins for whatever they talk to. The image ships tika-pipes-file-system under /opt/tika-server/plugins/; mount any other plugin into that directory, one subdirectory per plugin. Plugins publish as .zip, so unzip yours first and mount the resulting directory — the container cannot expand the zip in place, because /opt/tika-server is copied in root-owned while the server runs as UID 35002.

docker run -d -p 127.0.0.1:9998:9998 \
  -v "$(pwd)/tika-pipes-s3:/opt/tika-server/plugins/tika-pipes-s3" \
  -v "$(pwd)/tika-config.json:/tika-config.json" \
  apache/tika:X.Y.Z -c /tika-config.json

See Pipes Plugins.

Memory

The JVM sizes its heap from the container’s memory limit, so set the limit rather than passing -Xmx. Tika Pipes forks JVMs inside the same container, and each fork’s heap comes out of that same limit — size for the forks, not just the parent. See Forked-JVM CPU and Heap Sizing.

docker run -d -p 127.0.0.1:9998:9998 --memory 4g apache/tika:X.Y.Z

Docker Compose

Worked compositions live in tika-server/docker-build: docker-compose-tika-vision.yml (a VLM parser against a local Ollama server), docker-compose-tika-grobid.yml, and docker-compose-tika-customocr.yml. Their configs are under sample-configs/.

services:
  tika:
    image: apache/tika:latest-full
    command: -c /tika-config.json
    restart: on-failure
    ports:
      - "127.0.0.1:9998:9998"
    volumes:
      - ./tika-config.json:/tika-config.json

Building the images yourself

The Dockerfile`s are in the source tree under `tika-server/docker-build/ (minimal/ and full/) and tika-grpc/docker-build/. They download the signed release zip from an Apache mirror and verify it against the project KEYS file, so a build needs a released TIKA_VERSION — they do not build from your working tree. Maintainers publishing official images should follow Releasing Tika Docker Images.