[kbn-es] Add --docker flag to yarn es snapshot

src/platform/packages/shared/kbn-es/src/cli_commands/snapshot.ts

@@ -33,6 +33,11 @@ export const snapshot: Command = {
       --password.[user] Sets password for native realm user [default: ${password}]
       -E                Additional key=value settings to pass to Elasticsearch
       --download-only   Download the snapshot but don't actually start it
+      --docker          Run in a Docker container instead of downloading the snapshot locally.
+                        Supports the same options (--license, -E, --ssl, --password, etc.)
+                        and maps -E path.data=<path> to a Docker volume mount.
+      --port            The port to bind to on 127.0.0.1 [default: 9200] (Docker mode only)
+      --kill            Kill running ES Docker containers before starting (Docker mode only)
       --ssl             Sets up SSL on Elasticsearch
       --use-cached      Skips cache verification and use cached ES snapshot.
       --skip-ready-check  Disable the ready check,
@@ -44,6 +49,7 @@ export const snapshot: Command = {
     Example:
 
       es snapshot --version 5.6.8 -E cluster.name=test -E path.data=/tmp/es-data
+      es snapshot --docker --license=trial -E path.data=../my-data
   `;
   },
   run: async (defaults = {}) => {
@@ -69,13 +75,28 @@ export const snapshot: Command = {
       },
 
       string: ['version', 'ready-timeout', 'es-log-level'],
-      boolean: ['download-only', 'use-cached', 'skip-ready-check'],
+      boolean: ['download-only', 'use-cached', 'skip-ready-check', 'docker', 'kill'],
 
       default: defaults,
     });
 
     const cluster = new Cluster({ ssl: options.ssl });
-    if (options['download-only']) {
+
+    if (options.docker) {
+      await cluster.runDockerSnapshot({
+        reportTime,
+        startTime: runStartTime,
+        license: options.license,
+        version: options.version,
+        password: options.password,
+        port: options.port ? Number(options.port) : undefined,
+        ssl: options.ssl,
+        kill: options.kill,
+        esArgs: options.esArgs,
+        skipReadyCheck: options.skipReadyCheck,
+        readyTimeout: parseTimeoutToMs(options.readyTimeout),
+      });
+    } else if (options['download-only']) {
       await cluster.downloadSnapshot({
         version: options.version,
         license: options.license,

src/platform/packages/shared/kbn-es/src/cluster.ts

@@ -22,13 +22,15 @@ import treeKill from 'tree-kill';
 import { MOCK_IDP_REALM_NAME, ensureSAMLRoleMapping } from '@kbn/mock-idp-utils';
 import { downloadSnapshot, installSnapshot, installSource, installArchive } from './install';
 import { ES_BIN, ES_PLUGIN_BIN, ES_KEYSTORE_BIN } from './paths';
-import type { DockerOptions, ServerlessOptions } from './utils';
+import type { DockerOptions, DockerSnapshotOptions, ServerlessOptions } from './utils';
 import {
   extractConfigFiles,
   log as defaultLog,
   NativeRealm,
   parseEsLog,
   runDockerContainer,
+  runDockerSnapshotContainer,
+  stopDockerSnapshotContainer,
   runServerlessCluster,
   stopServerlessCluster,
   teardownServerlessClusterSync,
@@ -111,6 +113,7 @@ export class Cluster {
   private process: execa.ExecaChildProcess | null;
   private outcome: Promise<void> | null;
   private serverlessNodes: string[];
+  private dockerSnapshotContainerName: string | null;
   private setupPromise: Promise<unknown> | null;
   private stdioTarget: NodeJS.WritableStream | null;
 
@@ -120,6 +123,8 @@ export class Cluster {
     this.stopCalled = false;
     // Serverless Elasticsearch node names, started via Docker
     this.serverlessNodes = [];
+    // Docker snapshot container name, if running via Docker
+    this.dockerSnapshotContainerName = null;
     // properties used exclusively for the locally started Elasticsearch cluster
     this.process = null;
     this.outcome = null;
@@ -317,6 +322,11 @@ export class Cluster {
       return await stopServerlessCluster(this.log, this.serverlessNodes);
     }
 
+    // Stop Docker snapshot container
+    if (this.dockerSnapshotContainerName) {
+      return await stopDockerSnapshotContainer(this.log, this.dockerSnapshotContainerName);
+    }
+
     // Stop local ES process
     if (!this.process || !this.outcome) {
       throw new Error('ES has not been started');
@@ -487,11 +497,11 @@ export class Cluster {
       if (!skipSecuritySetup) {
         const nativeRealm = new NativeRealm({
           log: this.log,
-          elasticPassword: options.password,
+          elasticPassword: options.password ?? 'changeme',
           client,
         });
 
-        await nativeRealm.setPasswords(options);
+        await nativeRealm.setPasswords(options as Record<string, unknown>);
 
         const samlRealmConfigPrefix = `authc.realms.saml.${MOCK_IDP_REALM_NAME}.`;
         if (args.some((arg) => arg.includes(samlRealmConfigPrefix))) {
@@ -642,4 +652,16 @@ export class Cluster {
 
     await runDockerContainer(this.log, options);
   }
+
+  /**
+   * Run an Elasticsearch Docker container with snapshot-equivalent semantics.
+   * Same defaults and native realm setup as the local snapshot flow.
+   */
+  async runDockerSnapshot(options: DockerSnapshotOptions) {
+    if (this.process || this.outcome) {
+      throw new Error('ES stateful cluster has already been started');
+    }
+
+    this.dockerSnapshotContainerName = await runDockerSnapshotContainer(this.log, options);
+  }
 }