Skip to content

fix: add DNS config for ES container and fallback URL for IK plugin d… #1447

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
losingle wants to merge 1 commit into
base: main
Choose a base branch
from
+6 −1
Open

fix: add DNS config for ES container and fallback URL for IK plugin d… #1447

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,6 +178,9 @@ services:
es:
image: ${REGISTRY:-docker.io}/apecloud/elasticsearch:8.8.2
container_name: aperag-es
dns:
- 8.8.8.8
- 8.8.4.4
Comment on lines +181 to +183
Copy link

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hardcoding Google public DNS servers at the service level forces the ES container to bypass the host/daemon DNS configuration, which can break deployments in restricted/offline/corporate networks and may violate network policy. Consider making DNS servers configurable (e.g., via docker-compose override or .env-driven values) and documenting when/why this is needed instead of applying it unconditionally.

Suggested change
dns:
- 8.8.8.8
- 8.8.4.4

Copilot uses AI. Check for mistakes.
ports:
- "9200:9200"
environment:
Expand Down
4 changes: 3 additions & 1 deletion scripts/init-es.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,9 @@ fi
# Check and install IK Analyzer if needed
if ! ik_plugin_installed; then
echo "Installing IK Analyzer..."
/usr/share/elasticsearch/bin/elasticsearch-plugin install -b https://get.infini.cloud/elasticsearch/analysis-ik/8.8.2
# Try primary URL first, fallback to GitHub release
/usr/share/elasticsearch/bin/elasticsearch-plugin install -b https://get.infini.cloud/elasticsearch/analysis-ik/8.8.2 \
|| /usr/share/elasticsearch/bin/elasticsearch-plugin install -b https://github.com/infinilabs/analysis-ik/releases/download/v8.8.2/elasticsearch-analysis-ik-8.8.2.zip
if [ "$?" -ne 0 ]; then
Comment on lines +26 to 29
Copy link

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The plugin installation now falls back to downloading a ZIP directly from GitHub. This expands the supply-chain surface and still performs no integrity verification of the downloaded artifact. If possible, prefer an installation method that verifies the artifact (checksum/signature) or download the ZIP to a temp location and validate a pinned checksum before installing.

Suggested change
# Try primary URL first, fallback to GitHub release
/usr/share/elasticsearch/bin/elasticsearch-plugin install -b https://get.infini.cloud/elasticsearch/analysis-ik/8.8.2 \
|| /usr/share/elasticsearch/bin/elasticsearch-plugin install -b https://github.com/infinilabs/analysis-ik/releases/download/v8.8.2/elasticsearch-analysis-ik-8.8.2.zip
if [ "$?" -ne 0 ]; then
# Try primary URL first
/usr/share/elasticsearch/bin/elasticsearch-plugin install -b https://get.infini.cloud/elasticsearch/analysis-ik/8.8.2
install_status=$?
# If primary URL fails, fallback to GitHub release with checksum verification
if [ "$install_status" -ne 0 ]; then
echo "Primary IK Analyzer installation failed, attempting GitHub fallback with checksum verification..."
IK_PLUGIN_VERSION="8.8.2"
IK_PLUGIN_GITHUB_URL="https://github.com/infinilabs/analysis-ik/releases/download/v${IK_PLUGIN_VERSION}/elasticsearch-analysis-ik-${IK_PLUGIN_VERSION}.zip"
# Pinned SHA-256 checksum of the expected ZIP artifact.
# IMPORTANT: Replace the placeholder value below with the actual checksum for the release in use.
IK_PLUGIN_GITHUB_SHA256="${IK_PLUGIN_GITHUB_SHA256:-CHANGE_ME_TO_REAL_SHA256}"
if [ "$IK_PLUGIN_GITHUB_SHA256" = "CHANGE_ME_TO_REAL_SHA256" ]; then
echo "GitHub fallback checksum is not set. Aborting to avoid installing an unverified plugin."
install_status=1
else
TMP_DIR="$(mktemp -d)"
IK_PLUGIN_ZIP="${TMP_DIR}/elasticsearch-analysis-ik-${IK_PLUGIN_VERSION}.zip"
echo "Downloading IK Analyzer from GitHub to ${IK_PLUGIN_ZIP}..."
if ! curl -fsSL "$IK_PLUGIN_GITHUB_URL" -o "$IK_PLUGIN_ZIP"; then
echo "Failed to download IK Analyzer from GitHub"
install_status=1
else
echo "Verifying IK Analyzer ZIP checksum..."
if echo "${IK_PLUGIN_GITHUB_SHA256} ${IK_PLUGIN_ZIP}" | sha256sum -c -; then
echo "Checksum verification succeeded, installing from local file..."
/usr/share/elasticsearch/bin/elasticsearch-plugin install -b "file://${IK_PLUGIN_ZIP}"
install_status=$?
else
echo "Checksum verification failed for IK Analyzer ZIP"
install_status=1
fi
fi
fi
fi
if [ "$install_status" -ne 0 ]; then

Copilot uses AI. Check for mistakes.
Comment on lines +27 to 29
Copy link

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Relying on a separate if [ "$?" -ne 0 ] after the cmd1 || cmd2 compound makes the control flow a bit harder to read and is easy to break if any command gets inserted between them. Consider rewriting this as a single if block (try primary; on failure try fallback; if both fail then exit) so the failure handling is directly tied to the install commands.

Suggested change
/usr/share/elasticsearch/bin/elasticsearch-plugin install -b https://get.infini.cloud/elasticsearch/analysis-ik/8.8.2 \
|| /usr/share/elasticsearch/bin/elasticsearch-plugin install -b https://github.com/infinilabs/analysis-ik/releases/download/v8.8.2/elasticsearch-analysis-ik-8.8.2.zip
if [ "$?" -ne 0 ]; then
if ! /usr/share/elasticsearch/bin/elasticsearch-plugin install -b https://get.infini.cloud/elasticsearch/analysis-ik/8.8.2 \
&& ! /usr/share/elasticsearch/bin/elasticsearch-plugin install -b https://github.com/infinilabs/analysis-ik/releases/download/v8.8.2/elasticsearch-analysis-ik-8.8.2.zip
then

Copilot uses AI. Check for mistakes.
echo "Failed to install IK Analyzer"
exit 1
Expand Down
Loading