Skip to content

Commit 1c07b69

Browse files
blakerouseandrewvc
authored and
mergify-bot
committed
Change docker image from CentOS 7 to Ubuntu 20.04 (#29681)
* Switch to Ubuntu 20.04. * Fix Dockerfile. * Change to amd64 in Dockerfile.tmpl. * Add missing curl and ca-certificate deps. Change back to x86_64. * Fix issues with setcap and xz extraction. * Add changelog, fix remaining issues. * Fix synthetics deps * Fix apt-get. Remove todo from packages.yml. Co-authored-by: Andrew Cholakian <[email protected]> (cherry picked from commit febc7dd)
1 parent 9a5ee41 commit 1c07b69

File tree

13 files changed

+111
-64
lines changed

13 files changed

+111
-64
lines changed

‎.ci/packer_cache.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ function dockerPullCommonImages() {
2121
docker.elastic.co/observability-ci/database-enterprise:12.2.0.1
2222
docker.elastic.co/beats-dev/fpm:1.11.0
2323
golang:1.14.12-stretch
24-
centos:7
24+
ubuntu:20.04
2525
"
2626
for image in ${DOCKER_IMAGES} ; do
2727
(retry 2 docker pull ${image}) || echo "Error pulling ${image} Docker image. Continuing."

‎CHANGELOG.next.asciidoc‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
2727
- Remove `auto` from the available options of `setup.ilm.enabled` and set the default value to `true`. {pull}28671[28671]
2828
- Remove deprecated `--template` and `--ilm-policy` flags. Use `--index-management` instead. {pull}28870[28870]
2929
- Remove options `logging.files.suffix` and default to datetime endings. {pull}28927[28927]
30+
- Remove Journalbeat. Use `journald` input of Filebeat instead. {pull}29131[29131]
31+
- `include_matches` option of `journald` input no longer accepts a list of string. {pull}29294[29294]
32+
- Add job.name in pods controlled by Jobs {pull}28954[28954]
33+
- Change Docker base image from CentOS 7 to Ubuntu 20.04 {pull}29681[29681]
3034

3135
*Auditbeat*
3236

‎auditbeat/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ FROM golang:1.17.5
22

33
RUN \
44
apt-get update \
5-
&& apt-get install -y --no-install-recommends \
5+
&& DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
66
python3 \
77
python3-pip \
88
python3-venv \

‎dev-tools/packaging/packages.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -475,8 +475,8 @@ shared:
475475
- &agent_docker_spec
476476
<<: *agent_binary_spec
477477
extra_vars:
478-
from: 'centos:7'
479-
buildFrom: 'centos:7'
478+
from: 'ubuntu:20.04'
479+
buildFrom: 'ubuntu:20.04'
480480
dockerfile: 'Dockerfile.elastic-agent.tmpl'
481481
docker_entrypoint: 'docker-entrypoint.elastic-agent.tmpl'
482482
user: '{{ .BeatName }}'
@@ -495,8 +495,8 @@ shared:
495495
- &agent_docker_arm_spec
496496
<<: *agent_docker_spec
497497
extra_vars:
498-
from: 'arm64v8/centos:7'
499-
buildFrom: 'arm64v8/centos:7'
498+
from: 'arm64v8/ubuntu:20.04'
499+
buildFrom: 'arm64v8/ubuntu:20.04'
500500

501501
- &agent_docker_cloud_spec
502502
<<: *agent_docker_spec
@@ -653,8 +653,8 @@ shared:
653653
- &docker_spec
654654
<<: *binary_spec
655655
extra_vars:
656-
from: 'centos:7'
657-
buildFrom: 'centos:7'
656+
from: 'ubuntu:20.04'
657+
buildFrom: 'ubuntu:20.04'
658658
user: '{{ .BeatName }}'
659659
linux_capabilities: ''
660660
files:
@@ -666,8 +666,8 @@ shared:
666666
- &docker_arm_spec
667667
<<: *docker_spec
668668
extra_vars:
669-
from: 'arm64v8/centos:7'
670-
buildFrom: 'arm64v8/centos:7'
669+
from: 'arm64v8/ubuntu:20.04'
670+
buildFrom: 'arm64v8/ubuntu:20.04'
671671

672672
- &docker_ubi_spec
673673
extra_vars:
@@ -1230,4 +1230,4 @@ specs:
12301230
<<: *elastic_license_for_binaries
12311231
files:
12321232
'{{.BeatName}}{{.BinaryExt}}':
1233-
source: ./build/golang-crossbuild/{{.BeatName}}-{{.GOOS}}-{{.Platform.Arch}}{{.BinaryExt}}
1233+
source: ./build/golang-crossbuild/{{.BeatName}}-{{.GOOS}}-{{.Platform.Arch}}{{.BinaryExt}}

‎dev-tools/packaging/templates/docker/Dockerfile.elastic-agent.tmpl‎

Lines changed: 43 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -27,42 +27,51 @@ RUN mkdir -p {{ $beatHome }}/data {{ $beatHome }}/data/elastic-agent-{{ commit_s
2727
{{- end }}
2828
true
2929

30-
{{- if .linux_capabilities }}
31-
# Since the beat is stored at the other end of a symlink we must follow the symlink first
32-
# For security reasons setcap does not support symlinks. This is smart in the general case
33-
# but in our specific case since we're building a trusted image from trusted binaries this is
34-
# fine. Thus, we use readlink to follow the link and setcap on the actual binary
35-
RUN readlink -f {{ $beatBinary }} | xargs setcap {{ .linux_capabilities }}
36-
{{- end }}
37-
3830
FROM {{ .from }}
3931

4032
ENV BEAT_SETUID_AS={{ .user }}
4133

4234
{{- if contains .from "ubi-minimal" }}
43-
RUN for iter in {1..10}; do microdnf update -y && microdnf install -y shadow-utils jq && microdnf clean all && exit_code=0 && break || exit_code=$? && echo "microdnf error: retry $iter in 10s" && sleep 10; done; (exit $exit_code)
35+
RUN for iter in {1..10}; do microdnf update -y && microdnf install -y findutils shadow-utils && microdnf clean all && exit_code=0 && break || exit_code=$? && echo "microdnf error: retry $iter in 10s" && sleep 10; done; (exit $exit_code)
4436
{{- else }}
45-
# Installing jq needs to be installed after epel-release and cannot be in the same yum install command.
46-
RUN case $(arch) in aarch64) YUM_FLAGS="-x bind-license";; esac; \
47-
for iter in {1..10}; do \
48-
yum update -y $YUM_FLAGS && \
49-
yum install -y epel-release && \
50-
yum update -y $YUM_FLAGS && \
51-
yum install -y jq && \
52-
yum clean all && \
53-
exit_code=0 && break || exit_code=$? && echo "yum error: retry $iter in 10s" && sleep 10; \
37+
38+
RUN for iter in {1..10}; do \
39+
apt-get update -y && \
40+
DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --yes ca-certificates curl libcap2-bin xz-utils && \
41+
apt-get clean all && \
42+
exit_code=0 && break || exit_code=$? && echo "apt-get error: retry $iter in 10s" && sleep 10; \
5443
done; \
5544
(exit $exit_code)
5645
{{- end }}
5746

5847
{{- if (and (contains .image_name "-complete") (not (contains .from "ubi-minimal"))) }}
59-
RUN for iter in {1..10}; do \
60-
yum -y install atk gtk gdk xrandr pango libXcomposite libXcursor libXdamage \
61-
libXext libXi libXtst libXScrnSaver libXrandr GConf2 \
62-
alsa-lib atk gtk3 ipa-gothic-fonts xorg-x11-fonts-100dpi xorg-x11-fonts-75dpi xorg-x11-utils \
63-
xorg-x11-fonts-cyrillic xorg-x11-fonts-Type1 xorg-x11-fonts-misc \
64-
yum clean all && \
65-
exit_code=0 && break || exit_code=$? && echo "yum error: retry $iter in 10s" && sleep 10; \
48+
RUN apt-get update -y && \
49+
for iter in {1..10}; do \
50+
DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --yes \
51+
libglib2.0-0\
52+
libnss3\
53+
libnspr4\
54+
libatk1.0-0\
55+
libatk-bridge2.0-0\
56+
libcups2\
57+
libdrm2\
58+
libdbus-1-3\
59+
libxcb1\
60+
libxkbcommon0\
61+
libx11-6\
62+
libxcomposite1\
63+
libxdamage1\
64+
libxext6\
65+
libxfixes3\
66+
libxrandr2\
67+
libgbm1\
68+
libpango-1.0-0\
69+
libcairo2\
70+
libasound2\
71+
libatspi2.0-0\
72+
libxshmfence1 && \
73+
apt-get clean all && \
74+
exit_code=0 && break || exit_code=$? && echo "apt-get error: retry $iter in 10s" && sleep 10; \
6675
done; \
6776
(exit $exit_code)
6877
ENV NODE_PATH={{ $beatHome }}/.node
@@ -145,6 +154,14 @@ COPY --from=home {{ $beatHome }}/NOTICE.txt /licenses
145154
COPY --from=home /opt /opt
146155
{{- end }}
147156

157+
{{- if .linux_capabilities }}
158+
# Since the beat is stored at the other end of a symlink we must follow the symlink first
159+
# For security reasons setcap does not support symlinks. This is smart in the general case
160+
# but in our specific case since we're building a trusted image from trusted binaries this is
161+
# fine. Thus, we use readlink to follow the link and setcap on the actual binary
162+
RUN readlink -f {{ $beatBinary }} | xargs setcap {{ .linux_capabilities }}
163+
{{- end }}
164+
148165
{{- if eq .user "root" }}
149166
{{- if contains .image_name "-cloud" }}
150167
# Generate folder for a stub command that will be overwritten at runtime
@@ -213,3 +230,4 @@ RUN echo -e '#!/bin/sh\nexec /usr/local/bin/docker-entrypoint' > /app/apm.sh &&
213230
{{- else }}
214231
ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/docker-entrypoint"]
215232
{{- end }}
233+

‎dev-tools/packaging/templates/docker/Dockerfile.tmpl‎

Lines changed: 46 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -18,36 +18,52 @@ RUN mkdir -p {{ $beatHome }}/data {{ $beatHome }}/logs && \
1818
{{- end }}
1919
chmod 0775 {{ $beatHome }}/data {{ $beatHome }}/logs
2020

21-
{{- if .linux_capabilities }}
22-
# Since the beat is stored at the other end of a symlink we must follow the symlink first
23-
# For security reasons setcap does not support symlinks. This is smart in the general case
24-
# but in our specific case since we're building a trusted image from trusted binaries this is
25-
# fine. Thus, we use readlink to follow the link and setcap on the actual binary
26-
RUN readlink -f {{ $beatBinary }} | xargs setcap {{ .linux_capabilities }}
27-
{{- end }}
28-
2921
FROM {{ .from }}
3022

3123
{{- if contains .from "ubi-minimal" }}
3224
RUN microdnf -y update && \
33-
microdnf install shadow-utils && \
25+
microdnf install findutils shadow-utils && \
3426
microdnf clean all
3527
{{- else }}
36-
# FIXME: Package bind-license failed to update in arm
37-
RUN case $(arch) in aarch64) YUM_FLAGS="-x bind-license";; esac; \
38-
yum -y update $YUM_FLAGS \
39-
{{- if (eq .BeatName "heartbeat") }}
40-
&& yum -y install epel-release \
41-
&& yum -y install atk gtk gdk xrandr pango libXcomposite libXcursor libXdamage \
42-
libXext libXi libXtst libXScrnSaver libXrandr GConf2 \
43-
alsa-lib atk gtk3 ipa-gothic-fonts xorg-x11-fonts-100dpi xorg-x11-fonts-75dpi xorg-x11-utils \
44-
xorg-x11-fonts-cyrillic xorg-x11-fonts-Type1 xorg-x11-fonts-misc \
45-
{{- end }}
46-
&& yum clean all && rm -rf /var/cache/yum
47-
# See https://access.redhat.com/discussions/3195102 for why rm is needed
28+
RUN for iter in {1..10}; do \
29+
apt-get update -y && \
30+
DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --yes ca-certificates curl libcap2-bin xz-utils && \
31+
apt-get clean all && \
32+
exit_code=0 && break || exit_code=$? && echo "apt-get error: retry $iter in 10s" && sleep 10; \
33+
done; \
34+
(exit $exit_code)
4835
{{- end }}
4936

5037
{{- if (and (eq .BeatName "heartbeat") (not (contains .from "ubi-minimal"))) }}
38+
RUN apt-get update -y && \
39+
for iter in {1..10}; do \
40+
DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --yes \
41+
libglib2.0-0\
42+
libnss3\
43+
libnspr4\
44+
libatk1.0-0\
45+
libatk-bridge2.0-0\
46+
libcups2\
47+
libdrm2\
48+
libdbus-1-3\
49+
libxcb1\
50+
libxkbcommon0\
51+
libx11-6\
52+
libxcomposite1\
53+
libxdamage1\
54+
libxext6\
55+
libxfixes3\
56+
libxrandr2\
57+
libgbm1\
58+
libpango-1.0-0\
59+
libcairo2\
60+
libasound2\
61+
libatspi2.0-0\
62+
libxshmfence1 && \
63+
apt-get clean all && \
64+
exit_code=0 && break || exit_code=$? && echo "apt-get error: retry $iter in 10s" && sleep 10; \
65+
done; \
66+
(exit $exit_code)
5167
ENV NODE_PATH={{ $beatHome }}/.node
5268
RUN echo \
5369
$NODE_PATH \
@@ -93,6 +109,7 @@ RUN set -e ; \
93109
TINI_BIN=""; \
94110
TINI_SHA256=""; \
95111
TINI_VERSION="v0.19.0"; \
112+
echo "The arch value is $(arch)"; \
96113
case "$(arch)" in \
97114
x86_64) \
98115
TINI_BIN="tini-amd64"; \
@@ -120,6 +137,14 @@ RUN mkdir /licenses
120137
COPY --from=home {{ $beatHome }}/LICENSE.txt /licenses
121138
COPY --from=home {{ $beatHome }}/NOTICE.txt /licenses
122139

140+
{{- if .linux_capabilities }}
141+
# Since the beat is stored at the other end of a symlink we must follow the symlink first
142+
# For security reasons setcap does not support symlinks. This is smart in the general case
143+
# but in our specific case since we're building a trusted image from trusted binaries this is
144+
# fine. Thus, we use readlink to follow the link and setcap on the actual binary
145+
RUN readlink -f {{ $beatBinary }} | xargs setcap {{ .linux_capabilities }}
146+
{{- end }}
147+
123148
{{- if ne .user "root" }}
124149
RUN groupadd --gid 1000 {{ .BeatName }}
125150
RUN useradd -M --uid 1000 --gid 1000 --groups 0 --home {{ $beatHome }} {{ .user }}

‎filebeat/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ FROM golang:1.17.5
22

33
RUN \
44
apt-get update \
5-
&& apt-get install -y --no-install-recommends \
5+
&& DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
66
libsystemd-dev \
77
netcat \
88
rsync \

‎heartbeat/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ FROM golang:1.17.5
22

33
RUN \
44
apt-get update \
5-
&& apt-get install -y --no-install-recommends \
5+
&& DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
66
netcat \
77
python3 \
88
python3-pip \

‎libbeat/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ FROM golang:1.17.5
22

33
RUN \
44
apt-get update \
5-
&& apt-get install -y --no-install-recommends \
5+
&& DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
66
netcat \
77
libpcap-dev \
88
python3 \

‎metricbeat/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ FROM golang:1.17.5
22

33
RUN \
44
apt update \
5-
&& apt install -qq -y --no-install-recommends \
5+
&& DEBIAN_FRONTEND=noninteractive apt-get install -qq -y --no-install-recommends \
66
netcat \
77
python3 \
88
python3-dev \

0 commit comments

Comments
 (0)