Keycloak 17.0.1 Import Realm on Docker / Docker-Compose Startup

I am trying to find a way to import a realm in Keycloak version 17.0.1 that can be done at starting up a docker container (with docker-compose). I want to be able to do this in "start" mode and not "start-dev" mode as in my experience so far "start-dev" in 17 is forcing an H2/in-mem database and not allowing me to point to an external db which I would like to do to more closely resemble dev/prod environments when running locally.

Things I’ve tried:

1) It appears that according to recent conversations on Github (Issue 10216 and Issue 10754 to name a couple) that the environment variable that used to allow this (KEYCLOAK_IMPORT or KC_IMPORT_REALM in some versions) is no longer a trigger for this. In my attempts it also did not work for version 17.0.1.

2) I’ve also tried appending the following command in my docker-compose setup for keycloak and had no luck (also tried with just "start") – It appears to just ignore the command (no error or anything):

command: ["start-dev", "-Dkeycloak.import=/tmp/my-realm.json"]

3) I tried running the kc.sh command "import" in the Dockerfile (both before and after Entrypoint/start) but got error: Unmatched arguments from index 1: ‘/opt/keycloak/bin/kc.sh’, ‘im port’, ‘–file’, ‘/tmp/my-realm.json’

4) I’ve shifted gears and have tried to see if it is possible to just do it after the container starts (even with manual intervention) just to get some sanity restored. I attempted to use the admin-cli but after quite a few different attempts at different points/endpoints etc. I just get that localhost refuses to connect.

bin/kcadm.sh config credentials --server http://localhost:8080/auth --realm master --user admin --password adminpassword

Responds when hitting the following ports as shown:

8080: Failed to send request – Connect to localhost:8080 [localhost/127.0.0.1] failed: Connection refused (Connection refused)

8443: Failed to send request – localhost:8443 failed to respond

I am sure there are other ways that I’ve tried and am forgetting – I’ve kind of spun my wheels at this point.

My code (largely the same as the latest docs on the Keycloak website):

Dockerfile:

FROM quay.io/keycloak/keycloak:17.0.1 as builder

ENV KC_METRICS_ENABLED=true
ENV KC_FEATURES=token-exchange
ENV KC_DB=postgres
RUN /opt/keycloak/bin/kc.sh build

FROM quay.io/keycloak/keycloak:17.0.1
COPY --from=builder /opt/keycloak/lib/quarkus/ /opt/keycloak/lib/quarkus/
WORKDIR /opt/keycloak
# for demonstration purposes only, please make sure to use proper certificates in production instead
ENV KC_HOSTNAME=localhost
RUN keytool -genkeypair -storepass password -storetype PKCS12 -keyalg RSA -keysize 2048 -dname "CN=server" -alias server -ext "SAN:c=DNS:localhost,IP:127.0.0.1" -keystore conf/server.keystore

ENTRYPOINT ["/opt/keycloak/bin/kc.sh", "start" ]

Docker-compose.yml:

version: "3"

services:
  keycloak:
    build:
      context: .
    volumes:
      - ./my-realm.json:/tmp/my-realm.json:ro
    env_file:
      - .env
    environment:
      KC_DB_URL: ${POSTGRESQL_URL}
      KC_DB_USERNAME: ${POSTGRESQL_USER}
      KC_DB_PASSWORD: ${POSTGRESQL_PASS}
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: adminpassword
    ports:
      - 8080:8080
      - 8443:8443 # <-- I've tried with only 8080 and with only 8443 as well. 8443 appears to be the only that I can get the admin console ui to even work on though.
    networks:
      - my_net
networks:
  my_net:
    name: my_net

Any suggestion on how to do this in a programmatic + "dev-opsy" way would be greatly appreciated. I’d really like to get this to work but am confused on how to get past this.