bitergia / elasticsearch

Docker build files and other stuff for bitergia_elasticsearch

elasticsearch

Docker build files and other stuff for bitergia_elasticsearch

elasticsearch's Issues

Error java.nio.file.AccessDeniedException: /elasticsearch/data/nodes

@valeriocos reported internally the following error when deploying the image XXX

Stalling for Elasticsearch...
[2020-04-16T06:32:39,763][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [unknown] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: Failed to create node environment
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:163) ~[elasticsearch-6.8.6.jar:6.8.6]
	at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150) ~[elasticsearch-6.8.6.jar:6.8.6]
	at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-6.8.6.jar:6.8.6]
	at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) ~[elasticsearch-cli-6.8.6.jar:6.8.6]
	at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-6.8.6.jar:6.8.6]
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:116) ~[elasticsearch-6.8.6.jar:6.8.6]
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:93) ~[elasticsearch-6.8.6.jar:6.8.6]
Caused by: java.lang.IllegalStateException: Failed to create node environment
	at org.elasticsearch.node.Node.<init>(Node.java:299) ~[elasticsearch-6.8.6.jar:6.8.6]
	at org.elasticsearch.node.Node.<init>(Node.java:266) ~[elasticsearch-6.8.6.jar:6.8.6]
	at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:212) ~[elasticsearch-6.8.6.jar:6.8.6]
	at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:212) ~[elasticsearch-6.8.6.jar:6.8.6]
	at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:333) ~[elasticsearch-6.8.6.jar:6.8.6]
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-6.8.6.jar:6.8.6]
	... 6 more
Caused by: java.nio.file.AccessDeniedException: /elasticsearch/data/nodes
	at sun.nio.fs.UnixException.translateToIOException(UnixException.java:84) ~[?:?]
	at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102) ~[?:?]
	at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107) ~[?:?]
	at sun.nio.fs.UnixFileSystemProvider.createDirectory(UnixFileSystemProvider.java:384) ~[?:?]
	at java.nio.file.Files.createDirectory(Files.java:674) ~[?:1.8.0_202]
	at java.nio.file.Files.createAndCheckIsDirectory(Files.java:781) ~[?:1.8.0_202]
	at java.nio.file.Files.createDirectories(Files.java:767) ~[?:1.8.0_202]
	at org.elasticsearch.env.NodeEnvironment.lambda$new$0(NodeEnvironment.java:273) ~[elasticsearch-6.8.6.jar:6.8.6]
	at org.elasticsearch.env.NodeEnvironment$NodeLock.<init>(NodeEnvironment.java:206) ~[elasticsearch-6.8.6.jar:6.8.6]
	at org.elasticsearch.env.NodeEnvironment.<init>(NodeEnvironment.java:270) ~[elasticsearch-6.8.6.jar:6.8.6]
	at org.elasticsearch.node.Node.<init>(Node.java:296) ~[elasticsearch-6.8.6.jar:6.8.6]
	at org.elasticsearch.node.Node.<init>(Node.java:266) ~[elasticsearch-6.8.6.jar:6.8.6]
	at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:212) ~[elasticsearch-6.8.6.jar:6.8.6]
	at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:212) ~[elasticsearch-6.8.6.jar:6.8.6]
	at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:333) ~[elasticsearch-6.8.6.jar:6.8.6]
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-6.8.6.jar:6.8.6]

The reason of this error is a wrong usage of the instruction VOLUME at https://github.com/Bitergia/elasticsearch/blob/6.8.6-secured/docker/Dockerfile#L51

The Docker documentation says:

Changing the volume from within the Dockerfile: If any build steps change the data within the volume after it has been declared, those changes will be discarded.

That means we can not modify the permission of the volume after the VOLUME instruction is used.

VOLUME definition is wrong

The original version of this Docker image build definition specifies a VOLUME and WORKDIR of /data. However, it does this in conjunction with a configuration file which ensures that ES makes use of that volume.

In the case of this version no such configuration file is used, which means that the default /elasticsearch/data is used to store ES data.

This can catch users out if they're expecting their ES data to be persistent.

Furthermore, depending on how users make use of a persistent Docker volume for their data, permissions can be a problem if they decide to bind mount a folder from the host into their container, owing to the requirement to run as an unprivileged user. The startup script needs to be amended to chown the target directory when a container is started.

bitergia/elasticsearch:6.8.6-secured image contains propietary software

According to the Elasticsearch release notes since 6.3 it is not needed to enable X-Pack, it is distributed by default. This means the 6.8.6-secured Docker image is distributing proprietary software due to the following line:

elasticsearch/docker/Dockerfile

Line 15 in 23b0c12

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.6.tar.gz && \

More info at https://www.elastic.co/guide/en/elasticsearch/reference/6.8/release-highlights-6.3.0.html

In order to get the libre software version it is needed to follow these instructions https://www.elastic.co/guide/en/elasticsearch/reference/6.8/deb.html#install-deb, where we can read: "Alternatively, you can download the following package, which contains only features that are available under the Apache 2.0 license: https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-oss-6.8.6.deb"