Stop running agent container as root by default #21213
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jsoriano
added
Team:Platforms
botelastic
bot
added
needs_team
|
/package |
💔 Build Failed
Expand to view the summary
Build stats
Test stats 🧪
Steps errorsExpand to view the steps failures
Log outputExpand to view the last 100 lines of log output
|
jsoriano
force-pushed
the
elastic-agent-docker-root-user
branch
from
2dd6988 to
2214889
Compare
|
Pinging @elastic/ingest-management (Team:Ingest Management) |
|
Pinging @elastic/integrations-platforms (Team:Platforms) |
|
@blakerouse is this ok from endpoint perspective? |
|
@michalpristas take into account that after this change is still possible to use When running Endpoint (or Packetbeat, Auditbeat, or some features in other beats), if more privileges are required, these privileges have to be provided on runtime. This already happens now, running a container as root doesn't guarantee full privileges. |
|
/package |
|
@michalpristas It is not possible to run Endpoint in a container at the moment, so this will change will not affect Endpoint when it comes to Agent inside of a container. |
|
Failing tests are flaky ones, packaging failure seems to be unrelated to this change as also affects other PRs. |
jsoriano
added
:Packaging
needs_backport
|
/package |
|
Packaging builds passing, other failures are flaky tests. |
kvch
approved these changes
Sep 24, 2020
jsoriano
added a commit
to jsoriano/beats
that referenced
this pull request
Sep 24, 2020
Stop running Elastic Agent as root by default on docker image. When root user or other privileges are required, they will need to be explicitly configured at run time. This already happens now, except for the root user. Provided Kubernetes manifests already use security context to run as user 0. (cherry picked from commit a9db1b1)
7 tasks
jsoriano
removed
the
needs_backport
v1v
added a commit
to v1v/beats
that referenced
this pull request
Sep 24, 2020
…ne-2.0 * upstream/master: (33 commits) Stop running agent container as root by default (elastic#21213) Stop running auditbeat container as root by default (elastic#21202) Fix autodiscover flaky tests (elastic#21242) [Ingest Manager] Enabled dev builds (elastic#21241) Fix librpm installation in auditbeat build (elastic#21239) Fix prometheus default config (elastic#21253) Fix dev guide test command (elastic#21254) Move aws lambda metricset to GA (elastic#21255) [Docs] Typo in table syntax (elastic#20227) [ECS] Adds related.hosts to capture all hostnames and host identifiers on an event. (elastic#21160) Add recursive split to httpjson (elastic#21214) [DOCS] Add beat specific start widgets (elastic#21217) Fix timestamp handling in remote_write (elastic#21166) Fix aws, azure and googlecloud compute dashboards (elastic#21098) Add acceptable event log keys to winlog (elastic#21205) Add elastic-agent to gitignore (elastic#21219) Add cloudfoundry tags to events (elastic#21177) [Ingest Manager] Agent includes pgp file (elastic#19480) Add compatibility note about ingress-controller-v0.34.1 (elastic#21209) [Ingest Manager] Support for UPGRADE_ACTION (elastic#21002) ...
v1v
added a commit
to v1v/beats
that referenced
this pull request
Sep 24, 2020
…ne-2.0-arm * upstream/master: [Ingest manager] Copy Action store on upgrade (elastic#21298) [CI] Pipeline 2.0 for monorepos (elastic#20104) Stop running agent container as root by default (elastic#21213) Stop running auditbeat container as root by default (elastic#21202) Fix autodiscover flaky tests (elastic#21242) [Ingest Manager] Enabled dev builds (elastic#21241)
v1v
added a commit
to v1v/beats
that referenced
this pull request
Sep 24, 2020
…-refactor * upstream/master: [Ingest manager] Copy Action store on upgrade (elastic#21298) [CI] Pipeline 2.0 for monorepos (elastic#20104) Stop running agent container as root by default (elastic#21213) Stop running auditbeat container as root by default (elastic#21202) Fix autodiscover flaky tests (elastic#21242) [Ingest Manager] Enabled dev builds (elastic#21241) Fix librpm installation in auditbeat build (elastic#21239) Fix prometheus default config (elastic#21253) Fix dev guide test command (elastic#21254) Move aws lambda metricset to GA (elastic#21255) [Docs] Typo in table syntax (elastic#20227) [ECS] Adds related.hosts to capture all hostnames and host identifiers on an event. (elastic#21160)
v1v
added a commit
to v1v/beats
that referenced
this pull request
Sep 28, 2020
* upstream/master: (417 commits) libbeat/cmd/instance: report cgroup stats (elastic#21113) Configurable index template loading (elastic#21212) [Ingest Manager] Thread safe sorted set (elastic#21290) Change mirror of kafka download (elastic#19645) [Ingest manager] Copy Action store on upgrade (elastic#21298) [CI] Pipeline 2.0 for monorepos (elastic#20104) Stop running agent container as root by default (elastic#21213) Stop running auditbeat container as root by default (elastic#21202) Fix autodiscover flaky tests (elastic#21242) [Ingest Manager] Enabled dev builds (elastic#21241) Fix librpm installation in auditbeat build (elastic#21239) Fix prometheus default config (elastic#21253) Fix dev guide test command (elastic#21254) Move aws lambda metricset to GA (elastic#21255) [Docs] Typo in table syntax (elastic#20227) [ECS] Adds related.hosts to capture all hostnames and host identifiers on an event. (elastic#21160) Add recursive split to httpjson (elastic#21214) [DOCS] Add beat specific start widgets (elastic#21217) Fix timestamp handling in remote_write (elastic#21166) Fix aws, azure and googlecloud compute dashboards (elastic#21098) ...
v1v
added a commit
to v1v/beats
that referenced
this pull request
Sep 28, 2020
* upstream/master: (399 commits) libbeat/cmd/instance: report cgroup stats (elastic#21113) Configurable index template loading (elastic#21212) [Ingest Manager] Thread safe sorted set (elastic#21290) Change mirror of kafka download (elastic#19645) [Ingest manager] Copy Action store on upgrade (elastic#21298) [CI] Pipeline 2.0 for monorepos (elastic#20104) Stop running agent container as root by default (elastic#21213) Stop running auditbeat container as root by default (elastic#21202) Fix autodiscover flaky tests (elastic#21242) [Ingest Manager] Enabled dev builds (elastic#21241) Fix librpm installation in auditbeat build (elastic#21239) Fix prometheus default config (elastic#21253) Fix dev guide test command (elastic#21254) Move aws lambda metricset to GA (elastic#21255) [Docs] Typo in table syntax (elastic#20227) [ECS] Adds related.hosts to capture all hostnames and host identifiers on an event. (elastic#21160) Add recursive split to httpjson (elastic#21214) [DOCS] Add beat specific start widgets (elastic#21217) Fix timestamp handling in remote_write (elastic#21166) Fix aws, azure and googlecloud compute dashboards (elastic#21098) ...
v1v
added a commit
to v1v/beats
that referenced
this pull request
Sep 28, 2020
* upstream/master: (60 commits) libbeat/cmd/instance: report cgroup stats (elastic#21113) Configurable index template loading (elastic#21212) [Ingest Manager] Thread safe sorted set (elastic#21290) Change mirror of kafka download (elastic#19645) [Ingest manager] Copy Action store on upgrade (elastic#21298) [CI] Pipeline 2.0 for monorepos (elastic#20104) Stop running agent container as root by default (elastic#21213) Stop running auditbeat container as root by default (elastic#21202) Fix autodiscover flaky tests (elastic#21242) [Ingest Manager] Enabled dev builds (elastic#21241) Fix librpm installation in auditbeat build (elastic#21239) Fix prometheus default config (elastic#21253) Fix dev guide test command (elastic#21254) Move aws lambda metricset to GA (elastic#21255) [Docs] Typo in table syntax (elastic#20227) [ECS] Adds related.hosts to capture all hostnames and host identifiers on an event. (elastic#21160) Add recursive split to httpjson (elastic#21214) [DOCS] Add beat specific start widgets (elastic#21217) Fix timestamp handling in remote_write (elastic#21166) Fix aws, azure and googlecloud compute dashboards (elastic#21098) ...
jsoriano
added a commit
that referenced
this pull request
Sep 28, 2020
Stop running Elastic Agent as root by default on docker image. When root user or other privileges are required, they will need to be explicitly configured at run time. This already happens now, except for the root user. Provided Kubernetes manifests already use security context to run as user 0. (cherry picked from commit a9db1b1)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Stop running Elastic Agent as root by default on docker image. When root user or other privileges are required, they will need to be explicitly configured at run time. This already happens now, except for the root user.
Provided Kubernetes manifests already use security context to run as user 0.
Why is it important?
Using
USER rootin docker images is not a very good practice, and is not allowed in some certification processes (see #20996).Checklist
I have made corresponding changes to the documentationI have made corresponding change to the default configuration filesCHANGELOG.next.asciidocorCHANGELOG-developer.next.asciidoc.Author's Checklist
Related issues