ipmi-bmc-toolkit

Browser-accessible desktop pre-loaded to manage Supermicro, ATEN, Dell iDRAC, and HP iLO BMCs that still ship Java Web Start KVM consoles and MD5-signed jars. A maintained replacement for the abandoned solarkennedy/ipmi-kvm-docker (last commit 2022).

Why this exists

Old IPMI KVM applets don't run on modern Linux without a fight. What this image fixes:

Problem	Fix
Ubuntu 24/26 dropped openjdk-8-jre	Eclipse Temurin 8 from Adoptium's apt repo
icedtea-netx 1.8.8 throws NoSuchMethodError on JRE 8	pins 1.8.4 (apt-mark hold)
Modern Java rejects MD5/SHA1 jars	empties jdk.{tls,certpath,jar}.disabledAlgorithms
KVM applets fail in <clinit> (SecurityManager)	grants AllPermission in /etc/icedtea-web/javaws.policy
No browser desktop	built on linuxserver/webtop (KasmVNC + XFCE + Chromium)

Quick start

docker run --rm -p 3000:3000 --shm-size=1g ghcr.io/dillonbrowne/ipmi-bmc-toolkit:latest

Open http://localhost:3000, browse to your BMC in Chromium, click Launch KVM, and double-click the downloaded .jnlp (or run javaws <file>). The viewer opens on the desktop.

For persistence, mount /config so the Chromium profile, downloads, and IPMIView survive a recreate:

docker run -d --name ipmi-bmc-toolkit -p 3000:3000 --shm-size=1g \
  -v $(pwd)/data:/config ghcr.io/dillonbrowne/ipmi-bmc-toolkit:latest

Also on Docker Hub as dillonbrowne/ipmi-bmc-toolkit. A docker-compose.example.yml is included.

What's inside

Base linuxserver/webtop (Ubuntu 26.04 · XFCE · KasmVNC · Chromium) + Eclipse Temurin 8 + icedtea-netx 1.8.4 (javaws), plus BMC CLIs — ipmitool, freeipmi-tools, openipmi, ipmiutil, conman — and net helpers (ssh, sshpass, lftp, dig, tcpdump, …).

IPMIView (optional)

Supermicro's multi-BMC GUI. Its EULA forbids redistribution, so it's never bundled — it's fetched at runtime onto your own machine:

• Auto (opt-in): run with -e IPMIVIEW_AUTODOWNLOAD=true (pin a build via IPMIVIEW_URL). Enabling it means you accept the EULA.
• Manual: Supermicro's browse/EULA pages are Akamai-gated, so download IPMIView_*_bundleJRE_Linux_x64.tar.gz via the in-desktop Chromium into ~/Downloads, then run install-ipmiview.sh (or restart).

Installs to /config/IPMIView with a desktop launcher and ipmiview CLI.

Java 7 for stubborn KVM consoles (optional)

Temurin 8 + IcedTea-Web handles most BMCs. Some pre-2014 applets — ATEN iKVM in particular — will not run on Java 8 at all. Their JNLP asks for

<j2se version="1.6.0+" java-vm-args="-XX:PermSize=32M -XX:MaxPermSize=32M"/>

and PermGen was removed in Java 8 (replaced by Metaspace). They also predate Java 7u51's security model.

The obvious workaround doesn't work. Pointing IcedTea-Web at a Java 7 JRE via deployment.jre.dir makes ITW run itself on that JRE, and netx.jar is compiled to class file version 52 (Java 8) — so Java 7 throws UnsupportedClassVersionError before reaching any applet:

unzip -p /usr/share/icedtea-web/netx.jar \
  net/sourceforge/jnlp/runtime/Boot.class | od -An -tu1 -j6 -N2   # -> 52

So Java 7 has to bring its own Web Start. Oracle's JRE 7 ships bin/javaws; OpenJDK builds (Temurin, Zulu, Corretto) do not — Web Start was proprietary, which is exactly why IcedTea-Web exists. A freely-redistributable Java 7 cannot substitute here.

Oracle's BCL forbids redistributing the JRE, so like IPMIView it is never bundled, and there is no auto-download (Oracle's archive is account-gated):

1. Get jre-7u80-linux-x64.tar.gz from Oracle's Java SE 7 archive
2. Drop it in ~/Downloads
3. Restart, or run install-java7.sh
4. ikvm7 <file.jnlp>, or right-click → Open With → Java 7 Web Start

Installs to /config/java7, opt-in per console. Temurin 8 stays the system default and the normal javaws path is untouched, so nothing that already works regresses. The installer presets the security level to its lowest, disables the expiry nag (7u80 is long superseded and would otherwise block every launch), and adds your BMC to the exception site list by reading the codebase out of the JNLPs in ~/Downloads.

Authentication

Ships no built-in auth — fine for local use, not for network exposure. Use CUSTOM_USER + PASSWORD (KasmVNC basic auth), a reverse proxy with OIDC/SSO (recommended), or VPN-only.

Configuration

Var	Default	Notes
PUID / PGID	1000	from linuxserver/webtop
TZ	Etc/UTC	timezone
CUSTOM_USER / PASSWORD	—	optional KasmVNC basic auth
SUBFOLDER	/	path prefix behind a reverse proxy
IPMIVIEW_AUTODOWNLOAD	false	true fetches IPMIView at runtime (accepts EULA)
IPMIVIEW_URL	pinned 2.21.0	override IPMIView version/URL

Mount /config for persistent state; Chromium needs --shm-size=1g. Full env list: webtop docs.

Build from source

git clone https://github.com/dillonbrowne/ipmi-bmc-toolkit
cd ipmi-bmc-toolkit
docker buildx build --load -t ipmi-bmc-toolkit:dev .

CI builds and publishes multi-arch (linux/amd64, linux/arm64) to GHCR and Docker Hub.

License

MIT. Thanks to solarkennedy/ipmi-kvm-docker, linuxserver.io, Adoptium, and IcedTea-Web.