cloud-on-k8s icon indicating copy to clipboard operation
cloud-on-k8s copied to clipboard

Run as non-root Elasticsearch is outdated and not relevant when running on OpenShift

Open barkbay opened this issue 3 years ago • 0 comments

Run as non-root Elasticsearch is outdated:

By default, the Elastisearch container is run as root and its entrypoint is responsible to run the Elasticsearch process with the elasticsearch user (defined with ID 1000). In the background, ECK uses an initContainer to make sure that the data volume is writable for the elasticsearch user.

This is not true since 8.0.0, Elastisearch container is run as user id 1000 by default:

docker run --rm docker.elastic.co/elasticsearch/elasticsearch:7.17.5 id
uid=0(root) gid=0(root) groups=0(root)
docker run --rm docker.elastic.co/elasticsearch/elasticsearch:8.3.3 id
uid=1000(elasticsearch) gid=0(root) groups=0(root)

We should also state that this section is not relevant in the context of OpenShift as workloads are supposed to get assigned a random user id.

barkbay avatar Aug 02 '22 05:08 barkbay