Skip to content

Commit 7705089

Browse files
breskebybreskeby
committed
Explicitly set base image in dockerfile
- makes renovate configuration easier
1 parent 3184b9b commit 7705089

File tree

5 files changed

+157
-23
lines changed

5 files changed

+157
-23
lines changed

‎build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/DockerBase.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,10 @@ public enum DockerBase {
2323
// This is usually updated via renovatebot
2424
// spotless:off
2525
WOLFI(
26-
"docker.elastic.co/wolfi/chainguard-base:latest@sha256:29150cd940cc7f69407d978d5a19c86f4d9e67cf44e4d6ded787a497e8f27c9a",
26+
null,
2727
"-wolfi",
2828
"apk",
29-
"Dockerfile"
29+
"dockerfiles/wolfi/Dockerfile"
3030
),
3131
// spotless:on
3232
// Based on WOLFI above, with more extras. We don't set a base image because

‎distribution/docker/build.gradle‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -482,8 +482,10 @@ void addBuildDockerImageTask(Architecture architecture, DockerBase base) {
482482

483483
baseImages = [baseImage]
484484
buildArgs = buildArgsMap
485-
} else {
485+
} else if(base.image != null) {
486486
baseImages = [base.image]
487+
} else {
488+
baseImages = []
487489
}
488490

489491
Provider<DockerSupportService> serviceProvider = GradleUtils.getBuildService(

‎distribution/docker/src/docker/dockerfiles/cloud_ess_fips/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
# Extract Elasticsearch artifact
2525
################################################################################
2626
27-
FROM ${base_image} AS builder
27+
FROM docker.elastic.co/wolfi/chainguard-base-fips:sha256-ebfc3f1d7dba992231747a2e05ad1b859843e81b5e676ad342859d7cf9e425a7@sha256:ebfc3f1d7dba992231747a2e05ad1b859843e81b5e676ad342859d7cf9e425a7 AS builder
2828
2929
# Install required packages to extract the Elasticsearch distribution
3030
RUN <%= retry.loop(package_manager, "export DEBIAN_FRONTEND=noninteractive && ${package_manager} update && ${package_manager} update && ${package_manager} add --no-cache curl") %>
@@ -103,7 +103,7 @@ WORKDIR /usr/share/elasticsearch/config
103103
# Add entrypoint
104104
################################################################################
105105

106-
FROM ${base_image}
106+
FROM docker.elastic.co/wolfi/chainguard-base-fips:sha256-ebfc3f1d7dba992231747a2e05ad1b859843e81b5e676ad342859d7cf9e425a7@sha256:ebfc3f1d7dba992231747a2e05ad1b859843e81b5e676ad342859d7cf9e425a7
107107

108108
RUN <%= retry.loop(package_manager,
109109
"export DEBIAN_FRONTEND=noninteractive && \n" +

‎distribution/docker/src/docker/dockerfiles/wolfi/Dockerfile‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
################################################################################
2+
# This Dockerfile was generated from the template at distribution/src/docker/Dockerfile
3+
#
4+
# Beginning of multi stage Dockerfile
5+
################################################################################
6+
7+
<% /*
8+
This file is passed through Groovy's SimpleTemplateEngine, so dollars and backslashes
9+
have to be escaped in order for them to appear in the final Dockerfile. You
10+
can also comment out blocks, like this one. See:
11+
12+
https://docs.groovy-lang.org/latest/html/api/groovy/text/SimpleTemplateEngine.html
13+
14+
We use control-flow tags in this file to conditionally render the content. The
15+
layout/presentation here has been adjusted so that it looks reasonable when rendered,
16+
at the slight expense of how it looks here.
17+
18+
Note that this file is also filtered to squash together newlines, so we can
19+
add as many newlines here as necessary to improve legibility.
20+
*/ %>
21+
22+
################################################################################
23+
# Build stage 1 `builder`:
24+
# Extract Elasticsearch artifact
25+
################################################################################
26+
27+
FROM docker.elastic.co/wolfi/chainguard-base:latest@sha256:29150cd940cc7f69407d978d5a19c86f4d9e67cf44e4d6ded787a497e8f27c9a AS builder
28+
29+
# Install required packages to extract the Elasticsearch distribution
30+
RUN <%= retry.loop(package_manager, "export DEBIAN_FRONTEND=noninteractive && ${package_manager} update && ${package_manager} update && ${package_manager} add --no-cache curl") %>
31+
32+
# `tini` is a tiny but valid init for containers. This is used to cleanly
33+
# control how ES and any child processes are shut down.
34+
# For wolfi we pick it from the blessed wolfi package registry.
35+
#
36+
# The tini GitHub page gives instructions for verifying the binary using
37+
# gpg, but the keyservers are slow to return the key and this can fail the
38+
# build. Instead, we check the binary against the published checksum.
39+
40+
RUN mkdir /usr/share/elasticsearch
41+
WORKDIR /usr/share/elasticsearch
42+
43+
44+
# Fetch the appropriate Elasticsearch distribution for this architecture.
45+
# Keep this command on one line - it is replaced with a `COPY` during local builds.
46+
# It uses the `arch` shell command to fetch the correct distro for the build machine,
47+
RUN curl --retry 10 -S -L --output /tmp/elasticsearch.tar.gz https://artifacts-no-kpi.elastic.co/downloads/elasticsearch/elasticsearch-${version}-linux-\${arch}.tar.gz
48+
49+
RUN tar -zxf /tmp/elasticsearch.tar.gz --strip-components=1
50+
51+
# The distribution includes a `config` directory, no need to create it
52+
COPY ${config_dir}/elasticsearch.yml config/
53+
COPY ${config_dir}/log4j2.properties config/log4j2.docker.properties
54+
55+
# 1. Configure the distribution for Docker
56+
# 2. Create required directory
57+
# 3. Move the distribution's default logging config aside
58+
# 4. Move the generated docker logging config so that it is the default
59+
# 5. Reset permissions on all directories
60+
# 6. Reset permissions on all files
61+
# 7. Make CLI tools executable
62+
# 8. Make some directories writable. `bin` must be writable because
63+
# plugins can install their own CLI utilities.
64+
# 9. Make some files writable
65+
RUN sed -i -e 's/ES_DISTRIBUTION_TYPE=tar/ES_DISTRIBUTION_TYPE=docker/' bin/elasticsearch-env && \\
66+
mkdir data && \\
67+
mv config/log4j2.properties config/log4j2.file.properties && \\
68+
mv config/log4j2.docker.properties config/log4j2.properties && \\
69+
find . -type d -exec chmod 0555 {} + && \\
70+
find . -type f -exec chmod 0444 {} + && \\
71+
chmod 0555 bin/* jdk/bin/* jdk/lib/jspawnhelper modules/x-pack-ml/platform/linux-*/bin/* && \\
72+
chmod 0775 bin config config/jvm.options.d data logs plugins && \\
73+
find config -type f -exec chmod 0664 {} +
74+
75+
################################################################################
76+
# Build stage 2 (the actual Elasticsearch image):
77+
#
78+
# Copy elasticsearch from stage 1
79+
# Add entrypoint
80+
################################################################################
81+
82+
FROM docker.elastic.co/wolfi/chainguard-base:latest@sha256:29150cd940cc7f69407d978d5a19c86f4d9e67cf44e4d6ded787a497e8f27c9a
83+
84+
RUN <%= retry.loop(package_manager,
85+
"export DEBIAN_FRONTEND=noninteractive && \n" +
86+
" ${package_manager} update && \n" +
87+
" ${package_manager} upgrade && \n" +
88+
" ${package_manager} add --no-cache \n" +
89+
" bash java-cacerts curl libstdc++ libsystemd netcat-openbsd p11-kit p11-kit-trust posix-libc-utils shadow tini unzip zip zstd && \n" +
90+
" rm -rf /var/cache/apk/* "
91+
) %>
92+
93+
# Set Bash as the default shell for future commands
94+
SHELL ["/bin/bash", "-c"]
95+
96+
# Optionally set Bash as the default shell in the container at runtime
97+
CMD ["/bin/bash"]
98+
99+
RUN groupadd -g 1000 elasticsearch && \
100+
adduser -G elasticsearch -u 1000 elasticsearch -D --home /usr/share/elasticsearch elasticsearch && \
101+
adduser elasticsearch root && \
102+
chown -R 0:0 /usr/share/elasticsearch
103+
104+
ENV ELASTIC_CONTAINER=true
105+
106+
WORKDIR /usr/share/elasticsearch
107+
108+
COPY --from=builder --chown=0:0 /usr/share/elasticsearch /usr/share/elasticsearch
109+
110+
ENV PATH=/usr/share/elasticsearch/bin:\$PATH
111+
ENV SHELL=/bin/bash
112+
COPY ${bin_dir}/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
113+
114+
# 1. Sync the user and group permissions of /etc/passwd
115+
# 2. Set correct permissions of the entrypoint
116+
# 3. Ensure that there are no files with setuid or setgid, in order to mitigate "stackclash" attacks.
117+
# We've already run this in previous layers so it ought to be a no-op.
118+
# 4. Replace OpenJDK's built-in CA certificate keystore with the one from the OS
119+
# vendor. The latter is superior in several ways.
120+
# REF: https://github.com/elastic/elasticsearch-docker/issues/171
121+
# 5. Tighten up permissions on the ES home dir (the permissions of the contents are handled earlier)
122+
# 6. You can't install plugins that include configuration when running as `elasticsearch` and the `config`
123+
# dir is owned by `root`, because the installed tries to manipulate the permissions on the plugin's
124+
# config directory.
125+
RUN chmod g=u /etc/passwd && \\
126+
chmod 0555 /usr/local/bin/docker-entrypoint.sh && \\
127+
find / -xdev -perm -4000 -exec chmod ug-s {} + && \\
128+
chmod 0775 /usr/share/elasticsearch && \\
129+
chown elasticsearch bin config config/jvm.options.d data logs plugins
130+
131+
RUN ln -sf /etc/ssl/certs/java/cacerts /usr/share/elasticsearch/jdk/lib/security/cacerts
132+
133+
EXPOSE 9200 9300
134+
135+
RUN mkdir /licenses && ln LICENSE.txt /licenses/LICENSE
136+
137+
# Our actual entrypoint is `tini`, a minimal but functional init program. It
138+
# calls the entrypoint we provide, while correctly forwarding signals.
139+
ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/docker-entrypoint.sh"]
140+
# Dummy overridable parameter parsed by entrypoint
141+
CMD ["eswrapper"]
142+
143+
USER 1000:0
144+
145+
################################################################################
146+
# End of multi-stage Dockerfile
147+
################################################################################

‎renovate.json‎

Lines changed: 3 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,7 @@
1818
"9.0",
1919
"8.19",
2020
"8.18",
21-
"8.17",
22-
"7.17"
21+
"8.17"
2322
],
2423
"packageRules": [
2524
{
@@ -30,23 +29,9 @@
3029
"docker"
3130
],
3231
"matchPackageNames": [
33-
"/^docker.elastic.co/wolfi/chainguard-base$/"
32+
"/^docker.elastic.co/wolfi/chainguard-base$/",
33+
"/^docker.elastic.co/wolfi/chainguard-base-fips$/"
3434
]
3535
}
36-
],
37-
"customManagers": [
38-
{
39-
"description": "Extract Wolfi images from elasticsearch DockerBase configuration",
40-
"customType": "regex",
41-
"fileMatch": [
42-
"build\\-tools\\-internal\\/src\\/main\\/java\\/org\\/elasticsearch\\/gradle\\/internal\\/DockerBase\\.java$"
43-
],
44-
"matchStrings": [
45-
"\\s*\"?(?<depName>[^\\s:@\"]+)(?::(?<currentValue>[-a-zA-Z0-9.]+))?(?:@(?<currentDigest>sha256:[a-zA-Z0-9]+))?\"?"
46-
],
47-
"currentValueTemplate": "{{#if currentValue}}{{{currentValue}}}{{else}}latest{{/if}}",
48-
"autoReplaceStringTemplate": "{{{depName}}}{{#if newValue}}:{{{newValue}}}{{/if}}{{#if newDigest}}@{{{newDigest}}}{{/if}}\"",
49-
"datasourceTemplate": "docker"
50-
}
5136
]
5237
}

0 commit comments

Comments
 (0)