# apache/tomee architecture

> Architecture diagram of the GitHub repository apache/tomee, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/apache/tomee
- Repository: https://github.com/apache/tomee

## Overview

TomEE is a Jakarta EE/MicroProfile application server built on Tomcat. Its principal workflow is deploying an application, assembling its deployment metadata and components, then serving application requests through container and web-service runtimes. The graph also reflects persistence, CDI, transaction, and security capabilities visible in the tree. Several connections are documented only at the product level; the sampled excerpts establish specific REST, web-service, persistence, and security behaviors but do not expose the full deployment wiring.

Main entry points: [`container/openejb-core/src/main/java/org/apache/openejb/Container.java`](https://github.com/apache/tomee/blob/main/container/openejb-core/src/main/java/org/apache/openejb/Container.java) (EJB container), [`container/openejb-core/src/main/java/org/apache/openejb/assembler/classic/Assembler.java`](https://github.com/apache/tomee/blob/main/container/openejb-core/src/main/java/org/apache/openejb/assembler/classic/Assembler.java) (Deployment assembler), [`server/openejb-rest/src/main/java/org/apache/openejb/server/rest/RESTService.java`](https://github.com/apache/tomee/blob/main/server/openejb-rest/src/main/java/org/apache/openejb/server/rest/RESTService.java) (REST deployment), [`server/openejb-webservices/src/main/java/org/apache/openejb/server/webservices/WsService.java`](https://github.com/apache/tomee/blob/main/server/openejb-webservices/src/main/java/org/apache/openejb/server/webservices/WsService.java) (Web services)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_deploy["Application deployment"]
  node_assembler["Deployment assembler<br/>[Assembler.java]"]
  node_deployment_model["Deployment metadata<br/>[AppInfo.java]"]
end

subgraph group_runtime["Enterprise runtime"]
  node_ejb_runtime["EJB container<br/>[Container.java]"]
  node_cdi["CDI contexts"]
  node_persistence["JPA persistence<br/>[JpaCmpEngine.java]"]
  node_transactions["Transactions"]
  node_security["Security service"]
end

subgraph group_web["Web services"]
  node_rest["REST deployment<br/>[RESTService.java]"]
  node_web_services["Web services<br/>[WsService.java]"]
  node_web_service_registry["Endpoint registry"]
end

subgraph group_integration["Platform integrations"]
  node_tomcat_security["Tomcat realm auth"]
  node_hsql["HSQL service<br/>[HsqlService.java]"]
  node_openid_session["OpenID session storage"]
end

node_app_developer(("Application deployer"))
node_application["Jakarta EE app"]

node_app_developer -->|"provides"| node_application
node_application -->|"deploys to"| node_assembler
node_assembler -->|"assembles"| node_deployment_model
node_assembler -->|"deploys components"| node_ejb_runtime
node_assembler -->|"deploys REST"| node_rest
node_assembler -->|"deploys endpoints"| node_web_services
node_rest -->|"deploys EJB resources"| node_ejb_runtime
node_web_services -->|"registers endpoints"| node_web_service_registry
node_ejb_runtime -->|"uses persistence"| node_persistence
node_ejb_runtime -->|"uses transactions"| node_transactions
node_ejb_runtime -->|"uses security"| node_security
node_cdi -->|"fires lifecycle events"| node_application
node_tomcat_security -->|"authenticates identities"| node_security
node_hsql -->|"hosts configured databases"| node_ejb_runtime
node_openid_session -.->|"stores session state"| node_tomcat_security

click node_assembler "https://github.com/apache/tomee/blob/main/container/openejb-core/src/main/java/org/apache/openejb/assembler/classic/Assembler.java"
click node_deployment_model "https://github.com/apache/tomee/blob/main/container/openejb-core/src/main/java/org/apache/openejb/assembler/classic/AppInfo.java"
click node_ejb_runtime "https://github.com/apache/tomee/blob/main/container/openejb-core/src/main/java/org/apache/openejb/Container.java"
click node_cdi "https://github.com/apache/tomee/blob/main/container/openejb-core/src/main/java/org/apache/openejb/cdi/CdiAppContextsService.java"
click node_persistence "https://github.com/apache/tomee/blob/main/container/openejb-core/src/main/java/org/apache/openejb/core/cmp/jpa/JpaCmpEngine.java"
click node_transactions "https://github.com/apache/tomee/blob/main/container/openejb-core/src/main/java/org/apache/openejb/ri/sp/PseudoTransactionService.java"
click node_security "https://github.com/apache/tomee/blob/main/container/openejb-core/src/main/java/org/apache/openejb/core/security/AbstractSecurityService.java"
click node_rest "https://github.com/apache/tomee/blob/main/server/openejb-rest/src/main/java/org/apache/openejb/server/rest/RESTService.java"
click node_web_services "https://github.com/apache/tomee/blob/main/server/openejb-webservices/src/main/java/org/apache/openejb/server/webservices/WsService.java"
click node_tomcat_security "https://github.com/apache/tomee/blob/main/tomee/tomee-catalina/src/main/java/org/apache/tomee/catalina/TomcatSecurityService.java"
click node_hsql "https://github.com/apache/tomee/blob/main/server/openejb-hsql/src/main/java/org/apache/openejb/server/hsql/HsqlService.java"
click node_openid_session "https://github.com/apache/tomee/blob/main/tomee/tomee-security/src/main/java/org/apache/tomee/security/cdi/openid/storage/impl/SessionBasedOpenIdStorageHandler.java"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_assembler,node_deployment_model toneBlue
class node_ejb_runtime,node_cdi,node_persistence,node_transactions,node_security toneAmber
class node_rest,node_web_services,node_web_service_registry toneMint
class node_tomcat_security,node_hsql,node_openid_session toneRose
class node_app_developer,node_application toneIndigo
```

## Components

### Application deployment

- [Deployment assembler](https://github.com/apache/tomee/blob/main/container/openejb-core/src/main/java/org/apache/openejb/assembler/classic/Assembler.java): `container/openejb-core/src/main/java/org/apache/openejb/assembler/classic/Assembler.java`
- [Deployment metadata](https://github.com/apache/tomee/blob/main/container/openejb-core/src/main/java/org/apache/openejb/assembler/classic/AppInfo.java): `container/openejb-core/src/main/java/org/apache/openejb/assembler/classic/AppInfo.java`

### Enterprise runtime

- [EJB container](https://github.com/apache/tomee/blob/main/container/openejb-core/src/main/java/org/apache/openejb/Container.java): `container/openejb-core/src/main/java/org/apache/openejb/Container.java`
- [CDI contexts](https://github.com/apache/tomee/blob/main/container/openejb-core/src/main/java/org/apache/openejb/cdi/CdiAppContextsService.java): `container/openejb-core/src/main/java/org/apache/openejb/cdi/CdiAppContextsService.java`
- [JPA persistence](https://github.com/apache/tomee/blob/main/container/openejb-core/src/main/java/org/apache/openejb/core/cmp/jpa/JpaCmpEngine.java): `container/openejb-core/src/main/java/org/apache/openejb/core/cmp/jpa/JpaCmpEngine.java`
- [Transactions](https://github.com/apache/tomee/blob/main/container/openejb-core/src/main/java/org/apache/openejb/ri/sp/PseudoTransactionService.java): `container/openejb-core/src/main/java/org/apache/openejb/ri/sp/PseudoTransactionService.java`
- [Security service](https://github.com/apache/tomee/blob/main/container/openejb-core/src/main/java/org/apache/openejb/core/security/AbstractSecurityService.java): `container/openejb-core/src/main/java/org/apache/openejb/core/security/AbstractSecurityService.java`

### Web services

- [REST deployment](https://github.com/apache/tomee/blob/main/server/openejb-rest/src/main/java/org/apache/openejb/server/rest/RESTService.java): `server/openejb-rest/src/main/java/org/apache/openejb/server/rest/RESTService.java`
- [Web services](https://github.com/apache/tomee/blob/main/server/openejb-webservices/src/main/java/org/apache/openejb/server/webservices/WsService.java): `server/openejb-webservices/src/main/java/org/apache/openejb/server/webservices/WsService.java`
- **Endpoint registry**

### Platform integrations

- [Tomcat realm auth](https://github.com/apache/tomee/blob/main/tomee/tomee-catalina/src/main/java/org/apache/tomee/catalina/TomcatSecurityService.java): `tomee/tomee-catalina/src/main/java/org/apache/tomee/catalina/TomcatSecurityService.java`
- [HSQL service](https://github.com/apache/tomee/blob/main/server/openejb-hsql/src/main/java/org/apache/openejb/server/hsql/HsqlService.java): `server/openejb-hsql/src/main/java/org/apache/openejb/server/hsql/HsqlService.java`
- [OpenID session storage](https://github.com/apache/tomee/blob/main/tomee/tomee-security/src/main/java/org/apache/tomee/security/cdi/openid/storage/impl/SessionBasedOpenIdStorageHandler.java): `tomee/tomee-security/src/main/java/org/apache/tomee/security/cdi/openid/storage/impl/SessionBasedOpenIdStorageHandler.java`

### Other components

- **Application deployer**
- **Jakarta EE app**

## Connections

- Application deployer → Jakarta EE app: provides
- Jakarta EE app → Deployment assembler: deploys to
- Deployment assembler → Deployment metadata: assembles
- Deployment assembler → EJB container: deploys components
- Deployment assembler → REST deployment: deploys REST
- Deployment assembler → Web services: deploys endpoints
- REST deployment → EJB container: deploys EJB resources
- Web services → Endpoint registry: registers endpoints
- EJB container → JPA persistence: uses persistence
- EJB container → Transactions: uses transactions
- EJB container → Security service: uses security
- CDI contexts → Jakarta EE app: fires lifecycle events
- Tomcat realm auth → Security service: authenticates identities
- HSQL service → EJB container: hosts configured databases
- OpenID session storage → Tomcat realm auth: stores session state