[RORDEV-1095] docker images improvements (#982)

sscarduzio · Feb 3, 2024 · 25f8dd8 · 25f8dd8
1 parent 1c0d57c
commit 25f8dd8
Show file tree

Hide file tree

Showing 62 changed files with 368 additions and 88 deletions.
diff --git a/docker-image/init-readonlyrest.yml b/docker-image/init-readonlyrest.yml
@@ -8,5 +8,4 @@ readonlyrest:
 
     - name: "ADMIN"
       type: allow
-      verbosity: error
       auth_key: admin:${env:ADMIN_USER_PASS}
diff --git a/docker-image/ror-entrypoint-es6x.sh b/docker-image/ror-entrypoint-es6x.sh
@@ -0,0 +1,22 @@
+#!/bin/bash -e
+
+INVOKE_ROR_TOOLS="$JAVA_HOME/bin/java -jar /usr/share/elasticsearch/plugins/readonlyrest/ror-tools.jar"
+
+if $INVOKE_ROR_TOOLS verify | grep -q "Elasticsearch is NOT patched"; then
+
+  if [ -n "$I_UNDERSTAND_IMPLICATION_OF_ES_PATCHING" ] && [[ "${I_UNDERSTAND_IMPLICATION_OF_ES_PATCHING,,}" == *"yes"* ]]; then
+    $INVOKE_ROR_TOOLS patch
+  else
+    echo "Elasticsearch needs to be patched to work with ReadonlyREST. You can read about patching in our documentation:" \
+         "https://docs.readonlyrest.com/elasticsearch#id-3.-patch-elasticsearch. In this Docker image, the patching step" \
+         "is done automatically, but you must agree to have it done for you. You can do this by setting" \
+         "I_UNDERSTAND_IMPLICATION_OF_ES_PATCHING=yes environment variable when running the container."
+    exit 1
+  fi
+
+else
+  echo "Elasticsearch is already patched. We can continue ..."
+fi
+
+
+gosu elasticsearch /usr/local/bin/docker-entrypoint.sh "$@"
diff --git a/docker-image/ror-entrypoint.sh b/docker-image/ror-entrypoint.sh
@@ -0,0 +1,21 @@
+#!/bin/bash -e
+
+INVOKE_ROR_TOOLS="/usr/share/elasticsearch/jdk/bin/java -jar /usr/share/elasticsearch/plugins/readonlyrest/ror-tools.jar"
+
+if $INVOKE_ROR_TOOLS verify | grep -q "Elasticsearch is NOT patched"; then
+
+  if [ -n "$I_UNDERSTAND_IMPLICATION_OF_ES_PATCHING" ] && [[ "${I_UNDERSTAND_IMPLICATION_OF_ES_PATCHING,,}" == *"yes"* ]]; then
+    $INVOKE_ROR_TOOLS patch
+  else
+    echo "Elasticsearch needs to be patched to work with ReadonlyREST. You can read about patching in our documentation:" \
+         "https://docs.readonlyrest.com/elasticsearch#id-3.-patch-elasticsearch. In this Docker image, the patching step" \
+         "is done automatically, but you must agree to have it done for you. You can do this by setting" \
+         "I_UNDERSTAND_IMPLICATION_OF_ES_PATCHING=yes environment variable when running the container."
+    exit 1
+  fi
+
+else
+  echo "Elasticsearch is already patched. We can continue ..."
+fi
+
+gosu elasticsearch /usr/local/bin/docker-entrypoint.sh "$@"
diff --git a/es60x/build.gradle b/es60x/build.gradle
@@ -132,7 +132,7 @@ tasks.register('prepareDockerImageFiles', Copy) {
 
     from layout.projectDirectory.file("Dockerfile")
     from layout.buildDirectory.file("distributions/" + pluginFullName + ".zip")
-    from rootProject.file("docker-image/init-readonlyrest.yml")
+    from rootProject.files("docker-image")
 
     into layout.buildDirectory.dir("docker-image")
 }

diff --git a/es61x/build.gradle b/es61x/build.gradle
@@ -132,7 +132,7 @@ tasks.register('prepareDockerImageFiles', Copy) {
 
     from layout.projectDirectory.file("Dockerfile")
     from layout.buildDirectory.file("distributions/" + pluginFullName + ".zip")
-    from rootProject.file("docker-image/init-readonlyrest.yml")
+    from rootProject.files("docker-image")
 
     into layout.buildDirectory.dir("docker-image")
 }

diff --git a/es62x/build.gradle b/es62x/build.gradle
@@ -133,7 +133,7 @@ tasks.register('prepareDockerImageFiles', Copy) {
 
     from layout.projectDirectory.file("Dockerfile")
     from layout.buildDirectory.file("distributions/" + pluginFullName + ".zip")
-    from rootProject.file("docker-image/init-readonlyrest.yml")
+    from rootProject.files("docker-image")
 
     into layout.buildDirectory.dir("docker-image")
 }

diff --git a/es63x/Dockerfile b/es63x/Dockerfile
@@ -9,12 +9,20 @@ ARG ROR_VERSION
 ENV KIBANA_USER_PASS=kibana
 ENV ADMIN_USER_PASS=admin
 
+USER root
+
+RUN curl -o /usr/local/bin/gosu -SL "https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64" && \
+    chmod +x /usr/local/bin/gosu && \
+    gosu nobody true
+
+USER elasticsearch
+
 COPY readonlyrest-${ROR_VERSION}_es${ES_VERSION}.zip /tmp/readonlyrest.zip
 COPY init-readonlyrest.yml /usr/share/elasticsearch/config/readonlyrest.yml
+COPY ror-entrypoint-es6x.sh /usr/local/bin/ror-entrypoint.sh
 
 RUN /usr/share/elasticsearch/bin/elasticsearch-plugin install --batch file:///tmp/readonlyrest.zip
 
 USER root
-RUN $JAVA_HOME/bin/java -jar /usr/share/elasticsearch/plugins/readonlyrest/ror-tools.jar patch
 
-USER 1000:0
+ENTRYPOINT ["/usr/local/bin/ror-entrypoint.sh"]
diff --git a/es63x/build.gradle b/es63x/build.gradle
@@ -141,7 +141,7 @@ tasks.register('prepareDockerImageFiles', Copy) {
 
     from layout.projectDirectory.file("Dockerfile")
     from layout.buildDirectory.file("distributions/" + pluginFullName + ".zip")
-    from rootProject.file("docker-image/init-readonlyrest.yml")
+    from rootProject.files("docker-image")
 
     into layout.buildDirectory.dir("docker-image")
 }

diff --git a/es65x/Dockerfile b/es65x/Dockerfile
@@ -9,12 +9,20 @@ ARG ROR_VERSION
 ENV KIBANA_USER_PASS=kibana
 ENV ADMIN_USER_PASS=admin
 
+USER root
+
+RUN curl -o /usr/local/bin/gosu -SL "https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64" && \
+    chmod +x /usr/local/bin/gosu && \
+    gosu nobody true
+
+USER elasticsearch
+
 COPY readonlyrest-${ROR_VERSION}_es${ES_VERSION}.zip /tmp/readonlyrest.zip
 COPY init-readonlyrest.yml /usr/share/elasticsearch/config/readonlyrest.yml
+COPY ror-entrypoint-es6x.sh /usr/local/bin/ror-entrypoint.sh
 
 RUN /usr/share/elasticsearch/bin/elasticsearch-plugin install --batch file:///tmp/readonlyrest.zip
 
 USER root
-RUN $JAVA_HOME/bin/java -jar /usr/share/elasticsearch/plugins/readonlyrest/ror-tools.jar patch
 
-USER 1000:0
+ENTRYPOINT ["/usr/local/bin/ror-entrypoint.sh"]
diff --git a/es65x/build.gradle b/es65x/build.gradle
@@ -131,7 +131,7 @@ tasks.register('prepareDockerImageFiles', Copy) {
 
     from layout.projectDirectory.file("Dockerfile")
     from layout.buildDirectory.file("distributions/" + pluginFullName + ".zip")
-    from rootProject.file("docker-image/init-readonlyrest.yml")
+    from rootProject.files("docker-image")
 
     into layout.buildDirectory.dir("docker-image")
 }

diff --git a/es66x/Dockerfile b/es66x/Dockerfile
@@ -9,12 +9,20 @@ ARG ROR_VERSION
 ENV KIBANA_USER_PASS=kibana
 ENV ADMIN_USER_PASS=admin
 
+USER root
+
+RUN curl -o /usr/local/bin/gosu -SL "https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64" && \
+    chmod +x /usr/local/bin/gosu && \
+    gosu nobody true
+
+USER elasticsearch
+
 COPY readonlyrest-${ROR_VERSION}_es${ES_VERSION}.zip /tmp/readonlyrest.zip
 COPY init-readonlyrest.yml /usr/share/elasticsearch/config/readonlyrest.yml
+COPY ror-entrypoint-es6x.sh /usr/local/bin/ror-entrypoint.sh
 
 RUN /usr/share/elasticsearch/bin/elasticsearch-plugin install --batch file:///tmp/readonlyrest.zip
 
 USER root
-RUN $JAVA_HOME/bin/java -jar /usr/share/elasticsearch/plugins/readonlyrest/ror-tools.jar patch
 
-USER 1000:0
+ENTRYPOINT ["/usr/local/bin/ror-entrypoint.sh"]
diff --git a/es66x/build.gradle b/es66x/build.gradle
@@ -131,7 +131,7 @@ tasks.register('prepareDockerImageFiles', Copy) {
 
     from layout.projectDirectory.file("Dockerfile")
     from layout.buildDirectory.file("distributions/" + pluginFullName + ".zip")
-    from rootProject.file("docker-image/init-readonlyrest.yml")
+    from rootProject.files("docker-image")
 
     into layout.buildDirectory.dir("docker-image")
 }

diff --git a/es67x/Dockerfile b/es67x/Dockerfile
@@ -9,12 +9,20 @@ ARG ROR_VERSION
 ENV KIBANA_USER_PASS=kibana
 ENV ADMIN_USER_PASS=admin
 
+USER root
+
+RUN curl -o /usr/local/bin/gosu -SL "https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64" && \
+    chmod +x /usr/local/bin/gosu && \
+    gosu nobody true
+
+USER elasticsearch
+
 COPY readonlyrest-${ROR_VERSION}_es${ES_VERSION}.zip /tmp/readonlyrest.zip
 COPY init-readonlyrest.yml /usr/share/elasticsearch/config/readonlyrest.yml
+COPY ror-entrypoint-es6x.sh /usr/local/bin/ror-entrypoint.sh
 
 RUN /usr/share/elasticsearch/bin/elasticsearch-plugin install --batch file:///tmp/readonlyrest.zip
 
 USER root
-RUN $JAVA_HOME/bin/java -jar /usr/share/elasticsearch/plugins/readonlyrest/ror-tools.jar patch
 
-USER 1000:0
+ENTRYPOINT ["/usr/local/bin/ror-entrypoint.sh"]
diff --git a/es67x/build.gradle b/es67x/build.gradle
@@ -137,7 +137,7 @@ tasks.register('prepareDockerImageFiles', Copy) {
 
     from layout.projectDirectory.file("Dockerfile")
     from layout.buildDirectory.file("distributions/" + pluginFullName + ".zip")
-    from rootProject.file("docker-image/init-readonlyrest.yml")
+    from rootProject.files("docker-image")
 
     into layout.buildDirectory.dir("docker-image")
 }

diff --git a/es70x/Dockerfile b/es70x/Dockerfile
@@ -9,12 +9,20 @@ ARG ROR_VERSION
 ENV KIBANA_USER_PASS=kibana
 ENV ADMIN_USER_PASS=admin
 
+USER root
+
+RUN curl -o /usr/local/bin/gosu -SL "https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64" && \
+    chmod +x /usr/local/bin/gosu && \
+    gosu nobody true
+
+USER elasticsearch
+
 COPY readonlyrest-${ROR_VERSION}_es${ES_VERSION}.zip /tmp/readonlyrest.zip
 COPY init-readonlyrest.yml /usr/share/elasticsearch/config/readonlyrest.yml
+COPY ror-entrypoint.sh /usr/local/bin/ror-entrypoint.sh
 
 RUN /usr/share/elasticsearch/bin/elasticsearch-plugin install --batch file:///tmp/readonlyrest.zip
 
 USER root
-RUN /usr/share/elasticsearch/jdk/bin/java -jar /usr/share/elasticsearch/plugins/readonlyrest/ror-tools.jar patch
 
-USER 1000:0
+ENTRYPOINT ["/usr/local/bin/ror-entrypoint.sh"]
diff --git a/es70x/build.gradle b/es70x/build.gradle
@@ -131,7 +131,7 @@ tasks.register('prepareDockerImageFiles', Copy) {
 
     from layout.projectDirectory.file("Dockerfile")
     from layout.buildDirectory.file("distributions/" + pluginFullName + ".zip")
-    from rootProject.file("docker-image/init-readonlyrest.yml")
+    from rootProject.files("docker-image")
 
     into layout.buildDirectory.dir("docker-image")
 }

diff --git a/es710x/Dockerfile b/es710x/Dockerfile
@@ -9,12 +9,20 @@ ARG ROR_VERSION
 ENV KIBANA_USER_PASS=kibana
 ENV ADMIN_USER_PASS=admin
 
+USER root
+
+RUN curl -o /usr/local/bin/gosu -SL "https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64" && \
+    chmod +x /usr/local/bin/gosu && \
+    gosu nobody true
+
+USER elasticsearch
+
 COPY readonlyrest-${ROR_VERSION}_es${ES_VERSION}.zip /tmp/readonlyrest.zip
 COPY init-readonlyrest.yml /usr/share/elasticsearch/config/readonlyrest.yml
+COPY ror-entrypoint.sh /usr/local/bin/ror-entrypoint.sh
 
 RUN /usr/share/elasticsearch/bin/elasticsearch-plugin install --batch file:///tmp/readonlyrest.zip
 
 USER root
-RUN /usr/share/elasticsearch/jdk/bin/java -jar /usr/share/elasticsearch/plugins/readonlyrest/ror-tools.jar patch
 
-USER 1000:0
+ENTRYPOINT ["/tini", "--", "/usr/local/bin/ror-entrypoint.sh"]
diff --git a/es710x/build.gradle b/es710x/build.gradle
@@ -132,7 +132,7 @@ tasks.register('prepareDockerImageFiles', Copy) {
 
     from layout.projectDirectory.file("Dockerfile")
     from layout.buildDirectory.file("distributions/" + pluginFullName + ".zip")
-    from rootProject.file("docker-image/init-readonlyrest.yml")
+    from rootProject.files("docker-image")
 
     into layout.buildDirectory.dir("docker-image")
 }

diff --git a/es711x/Dockerfile b/es711x/Dockerfile
@@ -9,12 +9,20 @@ ARG ROR_VERSION
 ENV KIBANA_USER_PASS=kibana
 ENV ADMIN_USER_PASS=admin
 
+USER root
+
+RUN curl -o /usr/local/bin/gosu -SL "https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64" && \
+    chmod +x /usr/local/bin/gosu && \
+    gosu nobody true
+
+USER elasticsearch
+
 COPY readonlyrest-${ROR_VERSION}_es${ES_VERSION}.zip /tmp/readonlyrest.zip
 COPY init-readonlyrest.yml /usr/share/elasticsearch/config/readonlyrest.yml
+COPY ror-entrypoint.sh /usr/local/bin/ror-entrypoint.sh
 
 RUN /usr/share/elasticsearch/bin/elasticsearch-plugin install --batch file:///tmp/readonlyrest.zip
 
 USER root
-RUN /usr/share/elasticsearch/jdk/bin/java -jar /usr/share/elasticsearch/plugins/readonlyrest/ror-tools.jar patch
 
-USER 1000:0
+ENTRYPOINT ["/bin/tini", "--", "/usr/local/bin/ror-entrypoint.sh"]
diff --git a/es711x/build.gradle b/es711x/build.gradle
@@ -137,7 +137,7 @@ tasks.register('prepareDockerImageFiles', Copy) {
 
     from layout.projectDirectory.file("Dockerfile")
     from layout.buildDirectory.file("distributions/" + pluginFullName + ".zip")
-    from rootProject.file("docker-image/init-readonlyrest.yml")
+    from rootProject.files("docker-image")
 
     into layout.buildDirectory.dir("docker-image")
 }

diff --git a/es714x/Dockerfile b/es714x/Dockerfile
@@ -9,12 +9,20 @@ ARG ROR_VERSION
 ENV KIBANA_USER_PASS=kibana
 ENV ADMIN_USER_PASS=admin
 
+USER root
+
+RUN curl -o /usr/local/bin/gosu -SL "https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64" && \
+    chmod +x /usr/local/bin/gosu && \
+    gosu nobody true
+
+USER elasticsearch
+
 COPY readonlyrest-${ROR_VERSION}_es${ES_VERSION}.zip /tmp/readonlyrest.zip
 COPY init-readonlyrest.yml /usr/share/elasticsearch/config/readonlyrest.yml
+COPY ror-entrypoint.sh /usr/local/bin/ror-entrypoint.sh
 
 RUN /usr/share/elasticsearch/bin/elasticsearch-plugin install --batch file:///tmp/readonlyrest.zip
 
 USER root
-RUN /usr/share/elasticsearch/jdk/bin/java -jar /usr/share/elasticsearch/plugins/readonlyrest/ror-tools.jar patch
 
-USER 1000:0
+ENTRYPOINT ["/bin/tini", "--", "/usr/local/bin/ror-entrypoint.sh"]
diff --git a/es714x/build.gradle b/es714x/build.gradle
@@ -131,7 +131,7 @@ tasks.register('prepareDockerImageFiles', Copy) {
 
     from layout.projectDirectory.file("Dockerfile")
     from layout.buildDirectory.file("distributions/" + pluginFullName + ".zip")
-    from rootProject.file("docker-image/init-readonlyrest.yml")
+    from rootProject.files("docker-image")
 
     into layout.buildDirectory.dir("docker-image")
 }

diff --git a/es716x/Dockerfile b/es716x/Dockerfile
@@ -9,12 +9,21 @@ ARG ROR_VERSION
 ENV KIBANA_USER_PASS=kibana
 ENV ADMIN_USER_PASS=admin
 
+USER root
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends gosu && \
+    rm -rf /var/lib/apt/lists/* && \
+    gosu nobody true
+
+USER elasticsearch
+
 COPY readonlyrest-${ROR_VERSION}_es${ES_VERSION}.zip /tmp/readonlyrest.zip
 COPY init-readonlyrest.yml /usr/share/elasticsearch/config/readonlyrest.yml
+COPY ror-entrypoint.sh /usr/local/bin/ror-entrypoint.sh
 
 RUN /usr/share/elasticsearch/bin/elasticsearch-plugin install --batch file:///tmp/readonlyrest.zip
 
 USER root
-RUN /usr/share/elasticsearch/jdk/bin/java -jar /usr/share/elasticsearch/plugins/readonlyrest/ror-tools.jar patch
 
-USER 1000:0
+ENTRYPOINT ["/bin/tini", "--", "/usr/local/bin/ror-entrypoint.sh"]
diff --git a/es716x/build.gradle b/es716x/build.gradle
@@ -132,7 +132,7 @@ tasks.register('prepareDockerImageFiles', Copy) {
 
     from layout.projectDirectory.file("Dockerfile")
     from layout.buildDirectory.file("distributions/" + pluginFullName + ".zip")
-    from rootProject.file("docker-image/init-readonlyrest.yml")
+    from rootProject.files("docker-image")
 
     into layout.buildDirectory.dir("docker-image")
 }