Skip to content

[8.19] Rename docker fips image to cloud-ess-fips (#127561) #127568

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
May 2, 2025
Merged

[8.19] Rename docker fips image to cloud-ess-fips (#127561) #127568

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
91a9431
Rename docker fips image to cloud-ess-fips (#127561)
breskeby Apr 30, 2025
604a9a9
Fix typo
breskeby May 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/DockerBase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,16 +24,21 @@ public enum DockerBase {
// Chainguard based wolfi image with latest jdk
// This is usually updated via renovatebot
// spotless:off
WOLFI("docker.elastic.co/wolfi/chainguard-base:latest@sha256:1c7f5aa0e7997455b8500d095c7a90e617102d3941eb0757ac62cfea509e09b9",
WOLFI(
"docker.elastic.co/wolfi/chainguard-base:latest@sha256:1c7f5aa0e7997455b8500d095c7a90e617102d3941eb0757ac62cfea509e09b9",
"-wolfi",
"apk"
),
FIPS("docker.elastic.co/wolfi/chainguard-base-fips:sha256-ebfc3f1d7dba992231747a2e05ad1b859843e81b5e676ad342859d7cf9e425a7", "-fips", "apk"),
// spotless:on

// Based on WOLFI above, with more extras. We don't set a base image because
// we programmatically extend from the wolfi image.
CLOUD_ESS(null, "-cloud-ess", "apk");
CLOUD_ESS(null, "-cloud-ess", "apk"),
CLOUD_ESS_FIPS(
"docker.elastic.co/wolfi/chainguard-base-fips:sha256-ebfc3f1d7dba992231747a2e05ad1b859843e81b5e676ad342859d7cf9e425a7",
"-cloud-ess-fips",
"apk"
);

private final String image;
private final String suffix;
Expand Down
10 changes: 5 additions & 5 deletions distribution/docker/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -307,7 +307,7 @@ void addBuildDockerContextTask(Architecture architecture, DockerBase base) {
filter TransformLog4jConfigFilter
}
}
if(base == DockerBase.FIPS) {
if(base == DockerBase.CLOUD_ESS_FIPS) {

// If we're performing a release build, but `build.id` hasn't been set, we can
// infer that we're not at the Docker building stage of the build, and therefore
Expand Down Expand Up @@ -587,19 +587,19 @@ subprojects { Project subProject ->
base = DockerBase.UBI
} else if (subProject.name.contains('ironbank-')) {
base = DockerBase.IRON_BANK
} else if (subProject.name.contains('cloud-ess-')) {
} else if (subProject.name.contains('cloud-ess-docker')) {
base = DockerBase.CLOUD_ESS
} else if (subProject.name.contains('wolfi-')) {
base = DockerBase.WOLFI
} else if (subProject.name.contains('fips-')) {
base = DockerBase.FIPS
} else if (subProject.name.contains('cloud-ess-fips-docker')) {
base = DockerBase.CLOUD_ESS_FIPS
}

final String arch = architecture == Architecture.AARCH64 ? '-aarch64' : ''
final String extension = base == DockerBase.UBI ? 'ubi.tar' :
(base == DockerBase.IRON_BANK ? 'ironbank.tar' :
(base == DockerBase.CLOUD_ESS ? 'cloud-ess.tar' :
(base == DockerBase.FIPS ? 'fips.tar' :
(base == DockerBase.CLOUD_ESS_FIPS ? 'cloud-ess-fips.tar' :
(base == DockerBase.WOLFI ? 'wolfi.tar' :
'docker.tar'))))
final String artifactName = "elasticsearch${arch}${base.suffix}_test"
Expand Down
0 ...r/fips-docker-aarch64-export/build.gradle → ...s-fips-docker-aarch64-export/build.gradle
View file
Open in desktop
File renamed without changes.
0 ...on/docker/fips-docker-export/build.gradle → ...cloud-ess-fips-docker-export/build.gradle
View file
Open in desktop
File renamed without changes.
20 changes: 10 additions & 10 deletions distribution/docker/src/docker/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,13 +43,13 @@ RUN chmod 0555 /bin/tini
# Install required packages to extract the Elasticsearch distribution
<% if (docker_base == 'default') { %>
RUN <%= retry.loop(package_manager, "${package_manager} update && DEBIAN_FRONTEND=noninteractive ${package_manager} install -y curl ") %>
<% } else if (docker_base == "wolfi" || docker_base == "fips") { %>
<% } else if (docker_base == "wolfi" || docker_base == 'cloud_ess_fips') { %>
RUN <%= retry.loop(package_manager, "export DEBIAN_FRONTEND=noninteractive && ${package_manager} update && ${package_manager} update && ${package_manager} add --no-cache curl") %>
<% } else { %>
RUN <%= retry.loop(package_manager, "${package_manager} install -y findutils tar gzip") %>
<% } %>

<% if (docker_base != 'wolfi' && docker_base != 'fips' ) { %>
<% if (docker_base != 'wolfi' && docker_base != 'cloud_ess_fips' ) { %>
# `tini` is a tiny but valid init for containers. This is used to cleanly
# control how ES and any child processes are shut down.
# For wolfi we pick it from the blessed wolfi package registry.
Expand Down Expand Up @@ -117,7 +117,7 @@ RUN sed -i -e 's/ES_DISTRIBUTION_TYPE=tar/ES_DISTRIBUTION_TYPE=docker/' bin/elas
chmod 0775 bin config config/jvm.options.d data logs plugins && \\
find config -type f -exec chmod 0664 {} +

<% if (docker_base == "fips") { %>
<% if (docker_base == 'cloud_ess_fips') { %>
# Add plugins infrastructure
RUN mkdir -p /opt/plugins/archive
RUN chmod -R 0555 /opt/plugins
Expand Down Expand Up @@ -178,7 +178,7 @@ RUN ${package_manager} update --setopt=tsflags=nodocs -y && \\
nc shadow-utils zip findutils unzip procps-ng && \\
${package_manager} clean all

<% } else if (docker_base == "wolfi" || docker_base == "fips") { %>
<% } else if (docker_base == "wolfi" || docker_base == 'cloud_ess_fips') { %>
RUN <%= retry.loop(package_manager,
"export DEBIAN_FRONTEND=noninteractive && \n" +
" ${package_manager} update && \n" +
Expand Down Expand Up @@ -227,7 +227,7 @@ RUN groupadd -g 1000 elasticsearch && \\
adduser --uid 1000 --gid 1000 --home /usr/share/elasticsearch elasticsearch && \\
adduser elasticsearch root && \\
chown -R 0:0 /usr/share/elasticsearch
<% } else if (docker_base == "wolfi" || docker_base == "fips") { %>
<% } else if (docker_base == "wolfi" || docker_base == 'cloud_ess_fips') { %>
RUN groupadd -g 1000 elasticsearch && \
adduser -G elasticsearch -u 1000 elasticsearch -D --home /usr/share/elasticsearch elasticsearch && \
adduser elasticsearch root && \
Expand All @@ -243,7 +243,7 @@ ENV ELASTIC_CONTAINER true
WORKDIR /usr/share/elasticsearch

COPY --from=builder --chown=0:0 /usr/share/elasticsearch /usr/share/elasticsearch
<% if (docker_base != "wolfi" && docker_base != "fips") { %>
<% if (docker_base != "wolfi" && docker_base != 'cloud_ess_fips') { %>
COPY --from=builder --chown=0:0 /bin/tini /bin/tini
<% } %>

Expand Down Expand Up @@ -277,7 +277,7 @@ RUN chmod g=u /etc/passwd && \\
# stays up-to-date with changes to Ubuntu's store)
COPY bin/docker-openjdk /etc/ca-certificates/update.d/docker-openjdk
RUN /etc/ca-certificates/update.d/docker-openjdk
<% } else if (docker_base == 'wolfi' || docker_base == "fips") { %>
<% } else if (docker_base == 'wolfi' || docker_base == 'cloud_ess_fips') { %>
RUN ln -sf /etc/ssl/certs/java/cacerts /usr/share/elasticsearch/jdk/lib/security/cacerts
<% } else { %>
RUN ln -sf /etc/pki/ca-trust/extracted/java/cacerts /usr/share/elasticsearch/jdk/lib/security/cacerts
Expand Down Expand Up @@ -324,7 +324,7 @@ RUN mkdir /licenses && cp LICENSE.txt /licenses/LICENSE
COPY LICENSE /licenses/LICENSE.addendum
<% } %>

<% if (docker_base == "wolfi" || docker_base == "fips") { %>
<% if (docker_base == "wolfi" || docker_base == 'cloud_ess_fips') { %>
# Our actual entrypoint is `tini`, a minimal but functional init program. It
# calls the entrypoint we provide, while correctly forwarding signals.
ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/docker-entrypoint.sh"]
Expand All @@ -344,12 +344,12 @@ USER 1000:0
HEALTHCHECK --interval=10s --timeout=5s --start-period=1m --retries=5 CMD curl -I -f --max-time 5 http://localhost:9200 || exit 1
<% } %>

<% if (docker_base == 'fips') { %>
<% if (docker_base == 'cloud_ess_fips') { %>
COPY --from=builder --chown=0:0 /opt /opt
ENV ES_PLUGIN_ARCHIVE_DIR /opt/plugins/archive
WORKDIR /usr/share/elasticsearch
COPY --from=builder --chown=0:0 /fips/libs/*.jar /usr/share/elasticsearch/lib/
<% } %>
################################################################################
# End of multi-stage Dockerfile
################################################################################
################################################################################
4 changes: 2 additions & 2 deletions settings.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,8 +72,8 @@ List projects = [
'distribution:docker:ubi-docker-export',
'distribution:docker:wolfi-docker-aarch64-export',
'distribution:docker:wolfi-docker-export',
'distribution:docker:fips-docker-export',
'distribution:docker:fips-docker-aarch64-export',
'distribution:docker:cloud-ess-fips-docker-export',
'distribution:docker:cloud-ess-fips-docker-aarch64-export',
'distribution:packages:aarch64-deb',
'distribution:packages:deb',
'distribution:packages:aarch64-rpm',
Expand Down