|
| 1 | +################################################################################ |
| 2 | +# This Dockerfile was generated from the template at distribution/src/docker/Dockerfile |
| 3 | +# |
| 4 | +# Beginning of multi stage Dockerfile |
| 5 | +################################################################################ |
| 6 | + |
| 7 | +<% /* |
| 8 | + This file is passed through Groovy's SimpleTemplateEngine, so dollars and backslashes |
| 9 | + have to be escaped in order for them to appear in the final Dockerfile. You |
| 10 | + can also comment out blocks, like this one. See: |
| 11 | +
|
| 12 | + https://docs.groovy-lang.org/latest/html/api/groovy/text/SimpleTemplateEngine.html |
| 13 | +
|
| 14 | + We use control-flow tags in this file to conditionally render the content. The |
| 15 | + layout/presentation here has been adjusted so that it looks reasonable when rendered, |
| 16 | + at the slight expense of how it looks here. |
| 17 | +
|
| 18 | + Note that this file is also filtered to squash together newlines, so we can |
| 19 | + add as many newlines here as necessary to improve legibility. |
| 20 | +*/ %> |
| 21 | +
|
| 22 | +################################################################################ |
| 23 | +# Build stage 1 `builder`: |
| 24 | +# Extract Elasticsearch artifact |
| 25 | +################################################################################ |
| 26 | +
|
| 27 | +FROM docker.elastic.co/wolfi/chainguard-base:latest@sha256:29150cd940cc7f69407d978d5a19c86f4d9e67cf44e4d6ded787a497e8f27c9a AS builder |
| 28 | +
|
| 29 | +# Install required packages to extract the Elasticsearch distribution |
| 30 | +RUN <%= retry.loop(package_manager, "export DEBIAN_FRONTEND=noninteractive && ${package_manager} update && ${package_manager} update && ${package_manager} add --no-cache curl") %> |
| 31 | +
|
| 32 | +# `tini` is a tiny but valid init for containers. This is used to cleanly |
| 33 | +# control how ES and any child processes are shut down. |
| 34 | +# For wolfi we pick it from the blessed wolfi package registry. |
| 35 | +# |
| 36 | +# The tini GitHub page gives instructions for verifying the binary using |
| 37 | +# gpg, but the keyservers are slow to return the key and this can fail the |
| 38 | +# build. Instead, we check the binary against the published checksum. |
| 39 | +
|
| 40 | +RUN mkdir /usr/share/elasticsearch |
| 41 | +WORKDIR /usr/share/elasticsearch |
| 42 | +
|
| 43 | +
|
| 44 | +# Fetch the appropriate Elasticsearch distribution for this architecture. |
| 45 | +# Keep this command on one line - it is replaced with a `COPY` during local builds. |
| 46 | +# It uses the `arch` shell command to fetch the correct distro for the build machine, |
| 47 | +RUN curl --retry 10 -S -L --output /tmp/elasticsearch.tar.gz https://artifacts-no-kpi.elastic.co/downloads/elasticsearch/elasticsearch-${version}-linux-\${arch}.tar.gz |
| 48 | +
|
| 49 | +RUN tar -zxf /tmp/elasticsearch.tar.gz --strip-components=1 |
| 50 | +
|
| 51 | +# The distribution includes a `config` directory, no need to create it |
| 52 | +COPY ${config_dir}/elasticsearch.yml config/ |
| 53 | +COPY ${config_dir}/log4j2.properties config/log4j2.docker.properties |
| 54 | +
|
| 55 | +# 1. Configure the distribution for Docker |
| 56 | +# 2. Create required directory |
| 57 | +# 3. Move the distribution's default logging config aside |
| 58 | +# 4. Move the generated docker logging config so that it is the default |
| 59 | +# 5. Reset permissions on all directories |
| 60 | +# 6. Reset permissions on all files |
| 61 | +# 7. Make CLI tools executable |
| 62 | +# 8. Make some directories writable. `bin` must be writable because |
| 63 | +# plugins can install their own CLI utilities. |
| 64 | +# 9. Make some files writable |
| 65 | +RUN sed -i -e 's/ES_DISTRIBUTION_TYPE=tar/ES_DISTRIBUTION_TYPE=docker/' bin/elasticsearch-env && \\ |
| 66 | + mkdir data && \\ |
| 67 | + mv config/log4j2.properties config/log4j2.file.properties && \\ |
| 68 | + mv config/log4j2.docker.properties config/log4j2.properties && \\ |
| 69 | + find . -type d -exec chmod 0555 {} + && \\ |
| 70 | + find . -type f -exec chmod 0444 {} + && \\ |
| 71 | + chmod 0555 bin/* jdk/bin/* jdk/lib/jspawnhelper modules/x-pack-ml/platform/linux-*/bin/* && \\ |
| 72 | + chmod 0775 bin config config/jvm.options.d data logs plugins && \\ |
| 73 | + find config -type f -exec chmod 0664 {} + |
| 74 | + |
| 75 | +################################################################################ |
| 76 | +# Build stage 2 (the actual Elasticsearch image): |
| 77 | +# |
| 78 | +# Copy elasticsearch from stage 1 |
| 79 | +# Add entrypoint |
| 80 | +################################################################################ |
| 81 | + |
| 82 | +FROM docker.elastic.co/wolfi/chainguard-base:latest@sha256:29150cd940cc7f69407d978d5a19c86f4d9e67cf44e4d6ded787a497e8f27c9a |
| 83 | + |
| 84 | +RUN <%= retry.loop(package_manager, |
| 85 | + "export DEBIAN_FRONTEND=noninteractive && \n" + |
| 86 | + " ${package_manager} update && \n" + |
| 87 | + " ${package_manager} upgrade && \n" + |
| 88 | + " ${package_manager} add --no-cache \n" + |
| 89 | + " bash java-cacerts curl libstdc++ libsystemd netcat-openbsd p11-kit p11-kit-trust posix-libc-utils shadow tini unzip zip zstd && \n" + |
| 90 | + " rm -rf /var/cache/apk/* " |
| 91 | + ) %> |
| 92 | + |
| 93 | +# Set Bash as the default shell for future commands |
| 94 | +SHELL ["/bin/bash", "-c"] |
| 95 | + |
| 96 | +# Optionally set Bash as the default shell in the container at runtime |
| 97 | +CMD ["/bin/bash"] |
| 98 | + |
| 99 | +RUN groupadd -g 1000 elasticsearch && \ |
| 100 | + adduser -G elasticsearch -u 1000 elasticsearch -D --home /usr/share/elasticsearch elasticsearch && \ |
| 101 | + adduser elasticsearch root && \ |
| 102 | + chown -R 0:0 /usr/share/elasticsearch |
| 103 | + |
| 104 | +ENV ELASTIC_CONTAINER=true |
| 105 | + |
| 106 | +WORKDIR /usr/share/elasticsearch |
| 107 | + |
| 108 | +COPY --from=builder --chown=0:0 /usr/share/elasticsearch /usr/share/elasticsearch |
| 109 | + |
| 110 | +ENV PATH=/usr/share/elasticsearch/bin:\$PATH |
| 111 | +ENV SHELL=/bin/bash |
| 112 | +COPY ${bin_dir}/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh |
| 113 | + |
| 114 | +# 1. Sync the user and group permissions of /etc/passwd |
| 115 | +# 2. Set correct permissions of the entrypoint |
| 116 | +# 3. Ensure that there are no files with setuid or setgid, in order to mitigate "stackclash" attacks. |
| 117 | +# We've already run this in previous layers so it ought to be a no-op. |
| 118 | +# 4. Replace OpenJDK's built-in CA certificate keystore with the one from the OS |
| 119 | +# vendor. The latter is superior in several ways. |
| 120 | +# REF: https://github.com/elastic/elasticsearch-docker/issues/171 |
| 121 | +# 5. Tighten up permissions on the ES home dir (the permissions of the contents are handled earlier) |
| 122 | +# 6. You can't install plugins that include configuration when running as `elasticsearch` and the `config` |
| 123 | +# dir is owned by `root`, because the installed tries to manipulate the permissions on the plugin's |
| 124 | +# config directory. |
| 125 | +RUN chmod g=u /etc/passwd && \\ |
| 126 | + chmod 0555 /usr/local/bin/docker-entrypoint.sh && \\ |
| 127 | + find / -xdev -perm -4000 -exec chmod ug-s {} + && \\ |
| 128 | + chmod 0775 /usr/share/elasticsearch && \\ |
| 129 | + chown elasticsearch bin config config/jvm.options.d data logs plugins |
| 130 | + |
| 131 | +RUN ln -sf /etc/ssl/certs/java/cacerts /usr/share/elasticsearch/jdk/lib/security/cacerts |
| 132 | + |
| 133 | +EXPOSE 9200 9300 |
| 134 | + |
| 135 | + |
| 136 | +LABEL org.label-schema.build-date="${build_date}" \\ |
| 137 | + org.label-schema.license="${license}" \\ |
| 138 | + org.label-schema.name="Elasticsearch" \\ |
| 139 | + org.label-schema.schema-version="1.0" \\ |
| 140 | + org.label-schema.url="https://www.elastic.co/products/elasticsearch" \\ |
| 141 | + org.label-schema.usage="https://www.elastic.co/guide/en/elasticsearch/reference/index.html" \\ |
| 142 | + org.label-schema.vcs-ref="${git_revision}" \\ |
| 143 | + org.label-schema.vcs-url="https://github.com/elastic/elasticsearch" \\ |
| 144 | + org.label-schema.vendor="Elastic" \\ |
| 145 | + org.label-schema.version="${version}" \\ |
| 146 | + org.opencontainers.image.created="${build_date}" \\ |
| 147 | + org.opencontainers.image.documentation="https://www.elastic.co/guide/en/elasticsearch/reference/index.html" \\ |
| 148 | + org.opencontainers.image.licenses="${license}" \\ |
| 149 | + org.opencontainers.image.revision="${git_revision}" \\ |
| 150 | + org.opencontainers.image.source="https://github.com/elastic/elasticsearch" \\ |
| 151 | + org.opencontainers.image.title="Elasticsearch" \\ |
| 152 | + org.opencontainers.image.url="https://www.elastic.co/products/elasticsearch" \\ |
| 153 | + org.opencontainers.image.vendor="Elastic" \\ |
| 154 | + org.opencontainers.image.version="${version}" |
| 155 | + |
| 156 | +LABEL name="Elasticsearch" \\ |
| 157 | + |
| 158 | + vendor="Elastic" \\ |
| 159 | + version="${version}" \\ |
| 160 | + release="1" \\ |
| 161 | + summary="Elasticsearch" \\ |
| 162 | + description="You know, for search." |
| 163 | + |
| 164 | +RUN mkdir /licenses && ln LICENSE.txt /licenses/LICENSE |
| 165 | + |
| 166 | +# Our actual entrypoint is `tini`, a minimal but functional init program. It |
| 167 | +# calls the entrypoint we provide, while correctly forwarding signals. |
| 168 | +ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/docker-entrypoint.sh"] |
| 169 | +# Dummy overridable parameter parsed by entrypoint |
| 170 | +CMD ["eswrapper"] |
| 171 | + |
| 172 | +USER 1000:0 |
| 173 | + |
| 174 | +################################################################################ |
| 175 | +# End of multi-stage Dockerfile |
| 176 | +################################################################################ |
0 commit comments