Skip to content

Commit 23f59d4

Browse files
breskebybreskeby
committed
[Build] Add FIPS docker image for GovCloud (elastic#117152)
- Adds docker image based on chainguard base fips image - x86 only for now as the base image is x86 only - the image does not provide any elasticsearch.yml configuration. for testing purposes you can follow the elasticsearch fips guide available at https://github.com/elastic/FIPSGuide/tree/main/elasticsearch The image is shipped with: - org.bouncycastle:bc-fips:1.0.2.5 and org.bouncycastle:bctls-fips:1.0.19 in Elasticsearch libs folder - config/jvm.options.d/fips.options for fips specific JVM options - fips_java.security file - fips_java.policy Out of scope: - Add packaging test coverage (part of later PR as we want to provide that image for testing early and packaging tests require more general restructuring for support fips scenarios) (cherry picked from commit 653c179) # Conflicts: # build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/distribution/InternalElasticsearchDistributionTypes.java # distribution/docker/build.gradle # distribution/docker/src/docker/Dockerfile
1 parent e088eb3 commit 23f59d4

File tree

8 files changed

+158
-52
lines changed

8 files changed

+158
-52
lines changed

‎build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/DockerBase.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ public enum DockerBase {
2828
"-wolfi",
2929
"apk"
3030
),
31+
32+
FIPS("docker.elastic.co/wolfi/chainguard-base-fips:sha256-feb7aeb1bbcb331afa089388f2fa1e81997fc24642ca4fa06b7e502ff599a4cf", "-fips", "apk"),
3133
// spotless:on
3234

3335
// Based on WOLFI above, with more extras. We don't set a base image because

‎build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/distribution/DockerFipsElasticsearchDistributionType.java‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the "Elastic License
4+
* 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
5+
* Public License v 1"; you may not use this file except in compliance with, at
6+
* your election, the "Elastic License 2.0", the "GNU Affero General Public
7+
* License v3.0 only", or the "Server Side Public License, v 1".
8+
*/
9+
10+
package org.elasticsearch.gradle.internal.distribution;
11+
12+
import org.elasticsearch.gradle.ElasticsearchDistributionType;
13+
14+
public class DockerFipsElasticsearchDistributionType implements ElasticsearchDistributionType {
15+
16+
DockerFipsElasticsearchDistributionType() {}
17+
18+
@Override
19+
public String getName() {
20+
return "dockerFips";
21+
}
22+
23+
@Override
24+
public boolean isDocker() {
25+
return true;
26+
}
27+
}

‎build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/distribution/InternalElasticsearchDistributionTypes.java‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,14 @@
1414
import java.util.List;
1515

1616
public class InternalElasticsearchDistributionTypes {
17-
public static ElasticsearchDistributionType DEB = new DebElasticsearchDistributionType();
18-
public static ElasticsearchDistributionType RPM = new RpmElasticsearchDistributionType();
19-
public static ElasticsearchDistributionType DOCKER = new DockerElasticsearchDistributionType();
20-
public static ElasticsearchDistributionType DOCKER_UBI = new DockerUbiElasticsearchDistributionType();
21-
public static ElasticsearchDistributionType DOCKER_IRONBANK = new DockerIronBankElasticsearchDistributionType();
22-
public static ElasticsearchDistributionType DOCKER_CLOUD_ESS = new DockerCloudEssElasticsearchDistributionType();
23-
public static ElasticsearchDistributionType DOCKER_WOLFI = new DockerWolfiElasticsearchDistributionType();
17+
public static final ElasticsearchDistributionType DEB = new DebElasticsearchDistributionType();
18+
public static final ElasticsearchDistributionType RPM = new RpmElasticsearchDistributionType();
19+
public static final ElasticsearchDistributionType DOCKER = new DockerElasticsearchDistributionType();
20+
public static final ElasticsearchDistributionType DOCKER_UBI = new DockerUbiElasticsearchDistributionType();
21+
public static final ElasticsearchDistributionType DOCKER_IRONBANK = new DockerIronBankElasticsearchDistributionType();
22+
public static final ElasticsearchDistributionType DOCKER_CLOUD_ESS = new DockerCloudEssElasticsearchDistributionType();
23+
public static final ElasticsearchDistributionType DOCKER_WOLFI = new DockerWolfiElasticsearchDistributionType();
24+
public static final ElasticsearchDistributionType DOCKER_FIPS = new DockerFipsElasticsearchDistributionType();
2425

2526
public static List<ElasticsearchDistributionType> ALL_INTERNAL = List.of(
2627
DEB,
@@ -29,6 +30,7 @@ public class InternalElasticsearchDistributionTypes {
2930
DOCKER_UBI,
3031
DOCKER_IRONBANK,
3132
DOCKER_CLOUD_ESS,
32-
DOCKER_WOLFI
33+
DOCKER_WOLFI,
34+
DOCKER_FIPS
3335
);
3436
}

‎build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/test/DistroTestPlugin.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@
5151
import static org.elasticsearch.gradle.internal.distribution.InternalElasticsearchDistributionTypes.DEB;
5252
import static org.elasticsearch.gradle.internal.distribution.InternalElasticsearchDistributionTypes.DOCKER;
5353
import static org.elasticsearch.gradle.internal.distribution.InternalElasticsearchDistributionTypes.DOCKER_CLOUD_ESS;
54+
import static org.elasticsearch.gradle.internal.distribution.InternalElasticsearchDistributionTypes.DOCKER_FIPS;
5455
import static org.elasticsearch.gradle.internal.distribution.InternalElasticsearchDistributionTypes.DOCKER_IRONBANK;
5556
import static org.elasticsearch.gradle.internal.distribution.InternalElasticsearchDistributionTypes.DOCKER_UBI;
5657
import static org.elasticsearch.gradle.internal.distribution.InternalElasticsearchDistributionTypes.DOCKER_WOLFI;
@@ -153,6 +154,7 @@ private static Map<ElasticsearchDistributionType, TaskProvider<?>> lifecycleTask
153154
lifecyleTasks.put(DOCKER_IRONBANK, project.getTasks().register(taskPrefix + ".docker-ironbank"));
154155
lifecyleTasks.put(DOCKER_CLOUD_ESS, project.getTasks().register(taskPrefix + ".docker-cloud-ess"));
155156
lifecyleTasks.put(DOCKER_WOLFI, project.getTasks().register(taskPrefix + ".docker-wolfi"));
157+
lifecyleTasks.put(DOCKER_FIPS, project.getTasks().register(taskPrefix + ".docker-fips"));
156158
lifecyleTasks.put(ARCHIVE, project.getTasks().register(taskPrefix + ".archives"));
157159
lifecyleTasks.put(DEB, project.getTasks().register(taskPrefix + ".packages"));
158160
lifecyleTasks.put(RPM, lifecyleTasks.get(DEB));

‎distribution/docker/build.gradle‎

Lines changed: 56 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ import org.elasticsearch.gradle.LoggedExec
22
import org.elasticsearch.gradle.VersionProperties
33
import org.elasticsearch.gradle.internal.DockerBase
44
import org.elasticsearch.gradle.internal.distribution.InternalElasticsearchDistributionTypes
5+
import org.elasticsearch.gradle.internal.ExportElasticsearchBuildResourcesTask
56
import org.elasticsearch.gradle.internal.docker.DockerBuildTask
67
import org.elasticsearch.gradle.internal.docker.DockerSupportPlugin
78
import org.elasticsearch.gradle.internal.docker.DockerSupportService
@@ -17,6 +18,8 @@ apply plugin: 'elasticsearch.legacy-yaml-rest-test'
1718
apply plugin: 'elasticsearch.test.fixtures'
1819
apply plugin: 'elasticsearch.internal-distribution-download'
1920
apply plugin: 'elasticsearch.dra-artifacts'
21+
apply plugin: 'elasticsearch.jdk-download'
22+
apply plugin: 'elasticsearch.repositories'
2023

2124
String buildId = providers.systemProperty('build.id').getOrNull()
2225
boolean useLocalArtifacts = buildId != null && buildId.isBlank() == false && useDra == false
@@ -93,6 +96,7 @@ configurations {
9396
filebeat_x86_64
9497
metricbeat_aarch64
9598
metricbeat_x86_64
99+
fips
96100
}
97101

98102
String tiniArch = Architecture.current() == Architecture.AARCH64 ? 'arm64' : 'amd64'
@@ -109,6 +113,8 @@ dependencies {
109113
filebeat_x86_64 "beats:filebeat:${VersionProperties.elasticsearch}:[email protected]"
110114
metricbeat_aarch64 "beats:metricbeat:${VersionProperties.elasticsearch}:[email protected]"
111115
metricbeat_x86_64 "beats:metricbeat:${VersionProperties.elasticsearch}:[email protected]"
116+
fips "org.bouncycastle:bc-fips:1.0.2.5"
117+
fips "org.bouncycastle:bctls-fips:1.0.19"
112118
}
113119

114120
ext.expansions = { Architecture architecture, DockerBase base ->
@@ -286,6 +292,34 @@ void addBuildDockerContextTask(Architecture architecture, DockerBase base) {
286292
filter TransformLog4jConfigFilter
287293
}
288294
}
295+
if(base == DockerBase.FIPS) {
296+
297+
// If we're performing a release build, but `build.id` hasn't been set, we can
298+
// infer that we're not at the Docker building stage of the build, and therefore
299+
// we should skip the beats part of the build.
300+
String buildId = providers.systemProperty('build.id').getOrNull()
301+
boolean includeBeats = VersionProperties.isElasticsearchSnapshot() == true || buildId != null || useDra
302+
303+
if (includeBeats) {
304+
from configurations.getByName("filebeat_${architecture.classifier}")
305+
from configurations.getByName("metricbeat_${architecture.classifier}")
306+
// For some reason, the artifact name can differ depending on what repository we used.
307+
rename ~/((?:file|metric)beat)-.*\.tar\.gz$/, "\$1-${VersionProperties.elasticsearch}.tar.gz"
308+
}
309+
310+
into("plugins") {
311+
from configurations.allPlugins
312+
}
313+
314+
into("fips") {
315+
into("libs") {
316+
from configurations.fips
317+
}
318+
into("resources") {
319+
from tasks.named('fipsResources')
320+
}
321+
}
322+
}
289323

290324
Provider<DockerSupportService> serviceProvider = GradleUtils.getBuildService(
291325
project.gradle.sharedServices,
@@ -431,7 +465,7 @@ void addBuildDockerImageTask(Architecture architecture, DockerBase base) {
431465
}
432466
}
433467

434-
void addBuildEssDockerImageTask(Architecture architecture) {
468+
void addBuildCloudDockerImageTasks(Architecture architecture) {
435469
DockerBase dockerBase = DockerBase.CLOUD_ESS
436470
String arch = architecture == Architecture.AARCH64 ? '-aarch64' : ''
437471
String contextDir = "${project.buildDir}/docker-context/elasticsearch${dockerBase.suffix}-${VersionProperties.elasticsearch}-docker-build-context${arch}"
@@ -463,10 +497,10 @@ void addBuildEssDockerImageTask(Architecture architecture) {
463497
from(projectDir.resolve("src/docker/Dockerfile.ess")) {
464498
expand(
465499
[
466-
base_image: "elasticsearch${baseSuffix}:${architecture.classifier}",
500+
base_image : "elasticsearch${baseSuffix}:${architecture.classifier}",
467501
docker_base: "${dockerBase.name().toLowerCase()}",
468-
version: "${VersionProperties.elasticsearch}",
469-
retry: ShellRetry
502+
version : "${VersionProperties.elasticsearch}",
503+
retry : ShellRetry
470504
]
471505
)
472506
filter SquashNewlinesFilter
@@ -501,17 +535,24 @@ void addBuildEssDockerImageTask(Architecture architecture) {
501535
}
502536
}
503537

538+
// fips
539+
TaskProvider<ExportElasticsearchBuildResourcesTask> fipsResourcesTask = tasks.register('fipsResources', ExportElasticsearchBuildResourcesTask)
540+
fipsResourcesTask.configure {
541+
outputDir = project.layout.buildDirectory.dir('fips-resources').get().asFile
542+
copy 'fips_java.security'
543+
copy 'fips_java.policy'
544+
}
545+
504546
for (final Architecture architecture : Architecture.values()) {
505547
for (final DockerBase base : DockerBase.values()) {
506548
if (base == DockerBase.CLOUD_ESS) {
507-
continue
549+
addBuildCloudDockerImageTasks(architecture)
550+
} else {
551+
addBuildDockerContextTask(architecture, base)
552+
addTransformDockerContextTask(architecture, base)
553+
addBuildDockerImageTask(architecture, base)
508554
}
509-
addBuildDockerContextTask(architecture, base)
510-
addTransformDockerContextTask(architecture, base)
511-
addBuildDockerImageTask(architecture, base)
512555
}
513-
514-
addBuildEssDockerImageTask(architecture)
515556
}
516557

517558
def exportDockerImages = tasks.register("exportDockerImages")
@@ -535,14 +576,17 @@ subprojects { Project subProject ->
535576
base = DockerBase.CLOUD_ESS
536577
} else if (subProject.name.contains('wolfi-')) {
537578
base = DockerBase.WOLFI
579+
} else if (subProject.name.contains('fips-')) {
580+
base = DockerBase.FIPS
538581
}
539582

540583
final String arch = architecture == Architecture.AARCH64 ? '-aarch64' : ''
541584
final String extension = base == DockerBase.UBI ? 'ubi.tar' :
542585
(base == DockerBase.IRON_BANK ? 'ironbank.tar' :
543-
(base == DockerBase.CLOUD_ESS ? 'cloud-ess.tar' :
586+
(base == DockerBase.CLOUD_ESS ? 'cloud-ess.tar' :
587+
(base == DockerBase.FIPS ? 'fips.tar' :
544588
(base == DockerBase.WOLFI ? 'wolfi.tar' :
545-
'docker.tar')))
589+
'docker.tar'))))
546590
final String artifactName = "elasticsearch${arch}${base.suffix}_test"
547591

548592
final String exportTaskName = taskName("export", architecture, base, 'DockerImage')

‎distribution/docker/fips-docker-export/build.gradle‎

Whitespace-only changes.

‎distribution/docker/src/docker/Dockerfile‎

Lines changed: 60 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -41,15 +41,15 @@ RUN chmod 0555 /bin/tini
4141
<% } else { %>
4242
4343
# Install required packages to extract the Elasticsearch distribution
44-
<% if (docker_base == 'default' || docker_base == 'cloud') { %>
44+
<% if (docker_base == 'default') { %>
4545
RUN <%= retry.loop(package_manager, "${package_manager} update && DEBIAN_FRONTEND=noninteractive ${package_manager} install -y curl ") %>
46-
<% } else if (docker_base == "wolfi") { %>
46+
<% } else if (docker_base == "wolfi" || docker_base == "fips") { %>
4747
RUN <%= retry.loop(package_manager, "export DEBIAN_FRONTEND=noninteractive && ${package_manager} update && ${package_manager} update && ${package_manager} add --no-cache curl") %>
4848
<% } else { %>
4949
RUN <%= retry.loop(package_manager, "${package_manager} install -y findutils tar gzip") %>
5050
<% } %>
5151
52-
<% if (docker_base != 'wolfi') { %>
52+
<% if (docker_base != 'wolfi' && docker_base != 'fips' ) { %>
5353
# `tini` is a tiny but valid init for containers. This is used to cleanly
5454
# control how ES and any child processes are shut down.
5555
# For wolfi we pick it from the blessed wolfi package registry.
@@ -117,25 +117,46 @@ RUN sed -i -e 's/ES_DISTRIBUTION_TYPE=tar/ES_DISTRIBUTION_TYPE=docker/' bin/elas
117117
chmod 0775 bin config config/jvm.options.d data logs plugins && \\
118118
find config -type f -exec chmod 0664 {} +
119119

120-
<% if (docker_base == "cloud") { %>
121-
COPY filebeat-${version}.tar.gz metricbeat-${version}.tar.gz /tmp/
122-
RUN set -eux ; \\
123-
for beat in filebeat metricbeat ; do \\
124-
if [ ! -s /tmp/\$beat-${version}.tar.gz ]; then \\
125-
echo "/tmp/\$beat-${version}.tar.gz is empty - cannot uncompress" 2>&1 ; \\
126-
exit 1 ; \\
127-
fi ; \\
128-
if ! tar tf /tmp/\$beat-${version}.tar.gz >/dev/null; then \\
129-
echo "/tmp/\$beat-${version}.tar.gz is corrupt - cannot uncompress" 2>&1 ; \\
130-
exit 1 ; \\
131-
fi ; \\
132-
mkdir -p /opt/\$beat ; \\
133-
tar xf /tmp/\$beat-${version}.tar.gz -C /opt/\$beat --strip-components=1 ; \\
134-
done
135-
136-
# Add plugins infrastructure
137-
RUN mkdir -p /opt/plugins/archive
138-
RUN chmod -R 0555 /opt/plugins
120+
<% if (docker_base == "fips") { %>
121+
# Add plugins infrastructure
122+
RUN mkdir -p /opt/plugins/archive
123+
RUN chmod -R 0555 /opt/plugins
124+
125+
RUN mkdir -p /fips/libs
126+
COPY fips/libs/*.jar /fips/libs/
127+
128+
COPY filebeat-${version}.tar.gz metricbeat-${version}.tar.gz /tmp/
129+
RUN set -eux ; \\
130+
for beat in filebeat metricbeat ; do \\
131+
if [ ! -s /tmp/\$beat-${version}.tar.gz ]; then \\
132+
echo "/tmp/\$beat-${version}.tar.gz is empty - cannot uncompress" 2>&1 ; \\
133+
exit 1 ; \\
134+
fi ; \\
135+
if ! tar tf /tmp/\$beat-${version}.tar.gz >/dev/null; then \\
136+
echo "/tmp/\$beat-${version}.tar.gz is corrupt - cannot uncompress" 2>&1 ; \\
137+
exit 1 ; \\
138+
fi ; \\
139+
mkdir -p /opt/\$beat ; \\
140+
tar xf /tmp/\$beat-${version}.tar.gz -C /opt/\$beat --strip-components=1 ; \\
141+
done
142+
143+
COPY plugins/*.zip /opt/plugins/archive/
144+
145+
RUN chown 1000:1000 /opt/plugins/archive/*
146+
RUN chmod 0444 /opt/plugins/archive/*
147+
148+
COPY fips/resources/fips_java.security /usr/share/elasticsearch/config/fips_java.security
149+
COPY fips/resources/fips_java.policy /usr/share/elasticsearch/config/fips_java.policy
150+
151+
WORKDIR /usr/share/elasticsearch/config
152+
153+
## Add fips specific JVM options
154+
RUN cat <<EOF > /usr/share/elasticsearch/config/jvm.options.d/fips.options
155+
-Djavax.net.ssl.keyStoreType=BCFKS
156+
-Dorg.bouncycastle.fips.approved_only=true
157+
-Djava.security.properties=config/fips_java.security
158+
-Djava.security.policy=config/fips_java.policy
159+
EOF
139160
<% } %>
140161

141162
################################################################################
@@ -157,7 +178,7 @@ RUN ${package_manager} update --setopt=tsflags=nodocs -y && \\
157178
nc shadow-utils zip findutils unzip procps-ng && \\
158179
${package_manager} clean all
159180
160-
<% } else if (docker_base == "wolfi") { %>
181+
<% } else if (docker_base == "wolfi" || docker_base == "fips") { %>
161182
RUN <%= retry.loop(package_manager,
162183
"export DEBIAN_FRONTEND=noninteractive && \n" +
163184
" ${package_manager} update && \n" +
@@ -201,28 +222,24 @@ RUN <%= retry.loop(
201222
<% } %>
202223
203224
204-
<% if (docker_base == "default" || docker_base == "cloud") { %>
225+
<% if (docker_base == "default") { %>
205226
RUN groupadd -g 1000 elasticsearch && \\
206227
adduser --uid 1000 --gid 1000 --home /usr/share/elasticsearch elasticsearch && \\
207228
adduser elasticsearch root && \\
208229
chown -R 0:0 /usr/share/elasticsearch
209-
<% } else if (docker_base == "wolfi") { %>
230+
<% } else if (docker_base == "wolfi" || docker_base == "fips") { %>
210231
RUN groupadd -g 1000 elasticsearch && \
211232
adduser -G elasticsearch -u 1000 elasticsearch -D --home /usr/share/elasticsearch elasticsearch && \
212233
adduser elasticsearch root && \
213234
chown -R 0:0 /usr/share/elasticsearch
214-
<% } else { %>
215-
RUN groupadd -g 1000 elasticsearch && \\
216-
adduser -u 1000 -g 1000 -G 0 -d /usr/share/elasticsearch elasticsearch && \\
217-
chown -R 0:0 /usr/share/elasticsearch
218235
<% } %>
219236
220237
ENV ELASTIC_CONTAINER true
221238
222239
WORKDIR /usr/share/elasticsearch
223240
224241
COPY --from=builder --chown=0:0 /usr/share/elasticsearch /usr/share/elasticsearch
225-
<% if (docker_base != "wolfi") { %>
242+
<% if (docker_base != "wolfi" && docker_base != "fips") { %>
226243
COPY --from=builder --chown=0:0 /bin/tini /bin/tini
227244
<% } %>
228245
@@ -251,12 +268,13 @@ RUN chmod g=u /etc/passwd && \\
251268
chmod 0775 /usr/share/elasticsearch && \\
252269
chown elasticsearch bin config config/jvm.options.d data logs plugins
253270

254-
<% if (docker_base == 'default' || docker_base == 'cloud') { %>
271+
<<<<<<< HEAD
272+
<% if (docker_base == 'default') { %>
255273
# Update "cacerts" bundle to use Ubuntu's CA certificates (and make sure it
256274
# stays up-to-date with changes to Ubuntu's store)
257275
COPY bin/docker-openjdk /etc/ca-certificates/update.d/docker-openjdk
258276
RUN /etc/ca-certificates/update.d/docker-openjdk
259-
<% } else if (docker_base == 'wolfi') { %>
277+
<% } else if (docker_base == 'wolfi' || docker_base == "fips") { %>
260278
RUN ln -sf /etc/ssl/certs/java/cacerts /usr/share/elasticsearch/jdk/lib/security/cacerts
261279
<% } else { %>
262280
RUN ln -sf /etc/pki/ca-trust/extracted/java/cacerts /usr/share/elasticsearch/jdk/lib/security/cacerts
@@ -303,6 +321,7 @@ RUN mkdir /licenses && cp LICENSE.txt /licenses/LICENSE
303321
COPY LICENSE /licenses/LICENSE.addendum
304322
<% } %>
305323

324+
<<<<<<< HEAD
306325
<% if (docker_base == "cloud") { %>
307326
ENTRYPOINT ["/bin/tini", "--"]
308327
CMD ["/app/elasticsearch.sh"]
@@ -311,6 +330,9 @@ RUN mkdir /app && \\
311330
echo -e '#!/bin/bash\\nexec /usr/local/bin/docker-entrypoint.sh eswrapper' > /app/elasticsearch.sh && \\
312331
chmod 0555 /app/elasticsearch.sh
313332
<% } else if (docker_base == "wolfi") { %>
333+
=======
334+
<% if (docker_base == "wolfi" || docker_base == "fips") { %>
335+
>>>>>>> 653c179b08b ([Build] Add FIPS docker image for GovCloud (#117152))
314336
# Our actual entrypoint is `tini`, a minimal but functional init program. It
315337
# calls the entrypoint we provide, while correctly forwarding signals.
316338
ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/docker-entrypoint.sh"]
@@ -330,6 +352,12 @@ USER 1000:0
330352
HEALTHCHECK --interval=10s --timeout=5s --start-period=1m --retries=5 CMD curl -I -f --max-time 5 http://localhost:9200 || exit 1
331353
<% } %>
332354

355+
<% if (docker_base == 'fips') { %>
356+
COPY --from=builder --chown=0:0 /opt /opt
357+
ENV ES_PLUGIN_ARCHIVE_DIR /opt/plugins/archive
358+
WORKDIR /usr/share/elasticsearch
359+
COPY --from=builder --chown=0:0 /fips/libs/*.jar /usr/share/elasticsearch/lib/
360+
<% } %>
333361
################################################################################
334362
# End of multi-stage Dockerfile
335363
################################################################################

0 commit comments

Comments
 (0)