github-mirrors/elasticsearch
1
0
Fork 0
mirror of https://github.com/elastic/elasticsearch.git synced 2025-04-22 22:27:47 -04:00
Code Issues Projects Releases Packages Wiki Activity

Change UBI docker user to elasticsearch (#88262)

Browse source 
Closes #88218.

Docker image scans have flagged up the `USER` that the UBI Docker image
runs with. Switch to `elasticsearch:root`, which is what the Iron Bank
image also uses, and is what we use for all images from
8.0 onwards.
This commit is contained in:
Rory Hunter 2022-07-05 15:38:08 +01:00 • committed by GitHub
parent daa37125dd
commit 3f770e7caf
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 19 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
distribution/docker/src/docker/Dockerfile
View file

@ -250,7 +250,7 @@ RUN mkdir /licenses && cp LICENSE.txt /licenses/LICENSE
COPY LICENSE /licenses/LICENSE.addendum
<% } %>
<% if (docker_base == 'iron_bank') { %>
<% if (docker_base == 'ubi' || docker_base == 'iron_bank') { %>
USER elasticsearch:root
<% } %>

6
docs/changelog/88262.yaml Normal file
View file

@ -0,0 +1,6 @@
pr: 88262
summary: Change UBI docker user to `elasticsearch`
area: Packaging
type: enhancement
issues:
- 88218

13
qa/os/src/test/java/org/elasticsearch/packaging/test/DockerTests.java
View file

@ -918,9 +918,20 @@ public class DockerTests extends PackagingTestCase {
final String[] fields = processes.get(0).trim().split("\\s+", 4);
String expectedUid;
switch (distribution.packaging) {
case DOCKER_IRON_BANK:
case DOCKER_UBI:
expectedUid = "1000";
break;
default:
expectedUid = "0";
break;
}
assertThat(fields, arrayWithSize(4));
assertThat("Incorrect PID", fields[0], equalTo("1"));
assertThat("Incorrect UID", fields[1], equalTo(distribution.packaging == Packaging.DOCKER_IRON_BANK ? "1000" : "0"));
assertThat("Incorrect UID", fields[1], equalTo(expectedUid));
assertThat("Incorrect GID", fields[2], equalTo("0"));
assertThat("Incorrect init command", fields[3], startsWith("/bin/tini"));
}