Fix expose, use tomcat user, better CATALINA_HOME