|
| 1 | +<% /* |
| 2 | + This file is passed through Groovy's SimpleTemplateEngine, so dollars and backslashes |
| 3 | + have to be escaped in order for them to appear in the final Dockerfile. You |
| 4 | + can also comment out blocks, like this one. See: |
| 5 | + |
| 6 | + https://docs.groovy-lang.org/latest/html/api/groovy/text/SimpleTemplateEngine.html |
| 7 | + |
| 8 | + We use control-flow tags in this file to conditionally render the content. The |
| 9 | + layout/presentation here has been adjusted so that it looks reasonable when rendered, |
| 10 | + at the slight expense of how it looks here. |
| 11 | + |
| 12 | + Note that this file is also filtered to squash together newlines, so we can |
| 13 | + add as many newlines here as necessary to improve legibility. |
| 14 | +*/ %> |
| 15 | + |
| 16 | + |
| 17 | +################################################################################ |
| 18 | +# Build stage 1 `builder`: |
| 19 | +# Extract Elasticsearch artifact |
| 20 | +################################################################################ |
| 21 | + |
| 22 | +FROM ${base_image} AS builder |
| 23 | + |
| 24 | +RUN microdnf install -y findutils tar gzip |
| 25 | + |
| 26 | +# `tini` is a tiny but valid init for containers. This is used to cleanly |
| 27 | +# control how ES and any child processes are shut down. |
| 28 | +# |
| 29 | +# The tini GitHub page gives instructions for verifying the binary using |
| 30 | +# gpg, but the keyservers are slow to return the key and this can fail the |
| 31 | +# build. Instead, we check the binary against the published checksum. |
| 32 | +RUN set -eux ; \\ |
| 33 | + tini_bin="" ; \\ |
| 34 | + arch="\$(rpm --query --queryformat='%{ARCH}' rpm)"; \ |
| 35 | + case "\$(arch)" in \\ |
| 36 | + aarch64) tini_bin='tini-arm64' ;; \\ |
| 37 | + x86_64) tini_bin='tini-amd64' ;; \\ |
| 38 | + *) echo >&2 ; echo >&2 "Unsupported architecture \$arch" ; echo >&2 ; exit 1 ;; \\ |
| 39 | + esac ; \\ |
| 40 | + curl -f --retry 10 -S -L -O https://github.com/krallin/tini/releases/download/v0.19.0/\${tini_bin} ; \\ |
| 41 | + curl -f --retry 10 -S -L -O https://github.com/krallin/tini/releases/download/v0.19.0/\${tini_bin}.sha256sum ; \\ |
| 42 | + sha256sum -c \${tini_bin}.sha256sum ; \\ |
| 43 | + rm \${tini_bin}.sha256sum ; \\ |
| 44 | + mv \${tini_bin} /bin/tini ; \\ |
| 45 | + chmod 0555 /bin/tini |
| 46 | + |
| 47 | +WORKDIR /usr/share/elasticsearch |
| 48 | +RUN arch="\$(rpm --query --queryformat='%{ARCH}' rpm)" && curl -f --retry 10 -S -L --output /tmp/elasticsearch.tar.gz https://artifacts-no-kpi.elastic.co/downloads/elasticsearch/elasticsearch-${version}-linux-\$(arch).tar.gz |
| 49 | +RUN tar -zxf /tmp/elasticsearch.tar.gz --strip-components=1 && \\ |
| 50 | +# Configure the distribution for Docker |
| 51 | + sed -i -e 's/ES_DISTRIBUTION_TYPE=tar/ES_DISTRIBUTION_TYPE=docker/' bin/elasticsearch-env && \\ |
| 52 | +# Create required directory |
| 53 | + mkdir data && \\ |
| 54 | +# Reset permissions on all directories |
| 55 | + find . -type d -exec chmod 0555 {} + && \\ |
| 56 | +# keep default elasticsearch log4j config |
| 57 | + mv config/log4j2.properties config/log4j2.file.properties && \\ |
| 58 | +# Reset permissions on all files |
| 59 | + find . -type f -exec chmod 0444 {} + && \\ |
| 60 | +# Make CLI tools executable |
| 61 | + chmod 0555 bin/* jdk/bin/* jdk/lib/jspawnhelper modules/x-pack-ml/platform/linux-*/bin/* && \\ |
| 62 | +# Make some directories writable. `bin` must be writable because |
| 63 | +# plugins can install their own CLI utilities. |
| 64 | + chmod 0775 bin config config/jvm.options.d data logs plugins && \\ |
| 65 | +# Make some files writable |
| 66 | + find config -type f -exec chmod 0664 {} + && \\ |
| 67 | +# Tighten up permissions on the ES home dir (the permissions of the contents are handled below) |
| 68 | + chmod 0775 . && \\ |
| 69 | +# You can't install plugins that include configuration when running as `elasticsearch` and the `config` |
| 70 | +# dir is owned by `root`, because the installed tries to manipulate the permissions on the plugin's |
| 71 | +# config directory. |
| 72 | + chown 1000:1000 bin config config/jvm.options.d data logs plugins |
| 73 | + |
| 74 | +# The distribution includes a `config` directory, no need to create it |
| 75 | +COPY --chmod=664 config/elasticsearch.yml config/log4j2.properties config/ |
| 76 | + |
| 77 | + |
| 78 | +################################################################################ |
| 79 | +# Build stage 2 (the actual Elasticsearch image): |
| 80 | +# |
| 81 | +# Copy elasticsearch from stage 1 |
| 82 | +# Add entrypoint |
| 83 | +################################################################################ |
| 84 | + |
| 85 | +FROM ${base_image} |
| 86 | + |
| 87 | +RUN microdnf install --setopt=tsflags=nodocs -y \\ |
| 88 | + nc shadow-utils zip unzip findutils procps-ng && \\ |
| 89 | + microdnf clean all |
| 90 | + |
| 91 | +RUN groupadd -g 1000 elasticsearch && \\ |
| 92 | + adduser -u 1000 -g 1000 -G 0 -d /usr/share/elasticsearch elasticsearch && \\ |
| 93 | + chown -R 0:0 /usr/share/elasticsearch |
| 94 | + |
| 95 | +ENV ELASTIC_CONTAINER=true |
| 96 | + |
| 97 | +COPY --from=builder /bin/tini /bin/tini |
| 98 | + |
| 99 | +WORKDIR /usr/share/elasticsearch |
| 100 | + |
| 101 | +COPY --from=builder --chown=0:0 /usr/share/elasticsearch . |
| 102 | + |
| 103 | +# Replace OpenJDK's built-in CA certificate keystore with the one from the OS |
| 104 | +# vendor. The latter is superior in several ways. |
| 105 | +# REF: https://github.com/elastic/elasticsearch-docker/issues/171 |
| 106 | +RUN ln -sf /etc/pki/ca-trust/extracted/java/cacerts jdk/lib/security/cacerts |
| 107 | + |
| 108 | +ENV PATH=/usr/share/elasticsearch/bin:\$PATH |
| 109 | +ENV SHELL=/bin/bash |
| 110 | + |
| 111 | +COPY --chmod=0555 bin/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh |
| 112 | + |
| 113 | +RUN chmod g=u /etc/passwd && \\ |
| 114 | + chmod 0555 /usr/local/bin/docker-entrypoint.sh && \\ |
| 115 | + find / -xdev -perm -4000 -exec chmod ug-s {} + && \\ |
| 116 | + chmod 0775 /usr/share/elasticsearch && \\ |
| 117 | + chown elasticsearch bin config config/jvm.options.d data logs plugins |
| 118 | + |
| 119 | + |
| 120 | +EXPOSE 9200 9300 |
| 121 | + |
| 122 | +LABEL org.label-schema.build-date="${build_date}" \\ |
| 123 | + org.label-schema.license="${license}" \\ |
| 124 | + org.label-schema.name="Elasticsearch" \\ |
| 125 | + org.label-schema.schema-version="1.0" \\ |
| 126 | + org.label-schema.url="https://www.elastic.co/products/elasticsearch" \\ |
| 127 | + org.label-schema.usage="https://www.elastic.co/guide/en/elasticsearch/reference/index.html" \\ |
| 128 | + org.label-schema.vcs-ref="${git_revision}" \\ |
| 129 | + org.label-schema.vcs-url="https://github.com/elastic/elasticsearch" \\ |
| 130 | + org.label-schema.vendor="Elastic" \\ |
| 131 | + org.label-schema.version="${version}" \\ |
| 132 | + org.opencontainers.image.created="${build_date}" \\ |
| 133 | + org.opencontainers.image.documentation="https://www.elastic.co/guide/en/elasticsearch/reference/index.html" \\ |
| 134 | + org.opencontainers.image.licenses="${license}" \\ |
| 135 | + org.opencontainers.image.revision="${git_revision}" \\ |
| 136 | + org.opencontainers.image.source="https://github.com/elastic/elasticsearch" \\ |
| 137 | + org.opencontainers.image.title="Elasticsearch" \\ |
| 138 | + org.opencontainers.image.url="https://www.elastic.co/products/elasticsearch" \\ |
| 139 | + org.opencontainers.image.vendor="Elastic" \\ |
| 140 | + org.opencontainers.image.version="${version}" |
| 141 | + |
| 142 | +LABEL name="Elasticsearch" \\ |
| 143 | + |
| 144 | + vendor="Elastic" \\ |
| 145 | + version="${version}" \\ |
| 146 | + release="1" \\ |
| 147 | + summary="Elasticsearch" \\ |
| 148 | + description="You know, for search." |
| 149 | + |
| 150 | +RUN mkdir /licenses && ln LICENSE.txt /licenses/LICENSE |
| 151 | + |
| 152 | +# Our actual entrypoint is `tini`, a minimal but functional init program. It |
| 153 | +# calls the entrypoint we provide, while correctly forwarding signals. |
| 154 | +ENTRYPOINT ["/bin/tini", "--", "/usr/local/bin/docker-entrypoint.sh"] |
| 155 | +# Dummy overridable parameter parsed by entrypoint |
| 156 | +CMD ["eswrapper"] |
| 157 | + |
| 158 | +USER 1000:0 |
| 159 | + |
| 160 | +################################################################################ |
| 161 | +# End of multi-stage Dockerfile |
| 162 | +################################################################################ |
0 commit comments