Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Azure container docker image #493

Closed
wants to merge 1 commit into from
Closed

Azure container docker image #493

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 10 additions & 6 deletions dev-tools/packaging/templates/docker/Dockerfile.elastic-agent.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,15 +142,21 @@ RUN set -e ; \
COPY docker-entrypoint /usr/local/bin/docker-entrypoint
RUN chmod 755 /usr/local/bin/docker-entrypoint

COPY --from=home {{ $beatHome }} {{ $beatHome }}


RUN groupadd --gid 1000 {{ .BeatName }}
RUN useradd -M --uid 1000 --gid 1000 --groups 0 --home {{ $beatHome }} {{ .user }}


COPY --chown={{ .user }}:root --from=home {{ $beatHome }} {{ $beatHome }}

# Elastic Agent needs group permissions in the home itself to be able to
# create fleet.yml when running as non-root.
RUN chmod 0770 {{ $beatHome }}

RUN mkdir /licenses
COPY --from=home {{ $beatHome }}/LICENSE.txt /licenses
COPY --from=home {{ $beatHome }}/NOTICE.txt /licenses
COPY --chown={{ .user }}:root --from=home {{ $beatHome }}/LICENSE.txt /licenses
COPY --chown={{ .user }}:root --from=home {{ $beatHome }}/NOTICE.txt /licenses

{{- if contains .image_name "-cloud" }}
COPY --from=home /opt /opt
Expand All @@ -170,8 +176,6 @@ RUN readlink -f {{ $beatBinary }} | xargs setcap {{ .linux_capabilities }}
RUN mkdir /app
{{- end }}
{{- else }}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We may want to remove all this conditional logic depending on the user of the image, and remove the parts run only for user root.
This comes from the template used by Beats, where there were beats images run with user root (auditbeat and packetbeat IIRC). But all elastic-agent images use the elastic-agent user, find the definition here.
This would simplify this template.

RUN groupadd --gid 1000 {{ .BeatName }}
RUN useradd -M --uid 1000 --gid 1000 --groups 0 --home {{ $beatHome }} {{ .user }}
{{- if (and (contains .image_name "-complete") (not (contains .from "ubi-minimal"))) }}
RUN chown {{ .user }} $NODE_PATH
{{- end }}
Expand Down Expand Up @@ -242,6 +246,6 @@ CMD ["/app/apm.sh"]
RUN echo -e '#!/bin/sh\nexec /usr/local/bin/docker-entrypoint' > /app/apm.sh && \
chmod 0555 /app/apm.sh
{{- else }}
ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/docker-entrypoint"]
ENTRYPOINT ["/usr/bin/tini", "-s", "--", "/usr/local/bin/docker-entrypoint"]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this change anything when tini is executed as PID 1?

Notice that this breaks compatibility with Linux < 3.4. But I guess we don't support any distribution with such old versions, so I guess this is fine.

{{- end }}