Build Docker image in GoIntegTest mage target

[belimawr]

GenAI-Assisted: Yes
Human-Reviewed: Yes
Tool: Cursor-CLI, Model: GPT-5.3 Codex Extra High Fast

Proposed commit message

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
• I have added an entry in ./changelog/fragments using the changelog tool.

Disruptive User Impact

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

[botelastic]

This pull request doesn't have a Team:<team> label.

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @belimawr? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[github-actions]

TL;DR

The failure is a configuration/infrastructure regression in the CI step, not a Filebeat test logic bug: Docker package archives produced during mage goIntegTest are unreadable (archive/tar: invalid tar header). Re-enabling the Docker daemon setup from .buildkite/scripts/docker.sh before running the target should fix it.

Remediation

• In .buildkite/filebeat/filebeat-pipeline.yml, ensure the Go integration step runs source .buildkite/scripts/docker.sh before mage goIntegTest.
• Re-run :ubuntu: Filebeat: Go Integration Tests and confirm dev-tools/packaging/package_test.go no longer fails on *.docker.tar.gz.

Investigation details

Root Cause

TestDocker is failing while reading generated Docker package artifacts:

• dev-tools/packaging/package_test.go reads Docker artifacts as gzip -> tar (readDocker, around lines 929-937).
• The archive read fails with archive/tar: invalid tar header, which means the produced *.docker.tar.gz does not contain a valid tar stream.

The Docker artifacts are created by docker save and gzip-compressed in dev-tools/mage/dockerbuilder.go (around lines 225-246). In CI, this output is known to be affected by Docker daemon snapshotter config; .buildkite/scripts/docker.sh explicitly disables containerd-snapshotter (“as it affects the output of docker save”).

In this PR’s commit (32ddc9f4), the Filebeat Go integration pipeline step was changed from:

• source .buildkite/scripts/docker.sh
• SNAPSHOT=true PACKAGES="docker" PLATFORMS="linux/amd64" mage -v package
• mage goIntegTest

to only:

• cd filebeat
• mage goIntegTest

That removes the Docker daemon preparation step that protects docker save output.

Evidence

• Build: https://buildkite.com/elastic/beats/builds/43495
• Job/step: :ubuntu: Filebeat: Go Integration Tests
• Key log excerpt:
  • package_test.go:292: error reading file ...filebeat-oss-9.4.0-SNAPSHOT-linux-amd64.docker.tar.gz: archive/tar: invalid tar header
  • package_test.go:292: error reading file ...filebeat-oss-wolfi-9.4.0-SNAPSHOT-linux-amd64.docker.tar.gz: archive/tar: invalid tar header

Verification

• Not run locally in this workflow environment (read-only investigation based on Buildkite logs + repository code).

Follow-up

If re-adding docker.sh does not resolve it, capture and compare file/tar -tvf output for one generated *.docker.tar.gz artifact in CI to confirm whether the stream is OCI-layout vs docker-save tar format.

Note

🔒 Integrity filtering filtered 1 item

Integrity filtering activated and filtered the following item during workflow execution.
This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.

• pr:Build Docker image in GoIntegTest mage target #49870 (pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.