AccessDeniedException: /usr/share/elasticsearch/config/scripts

[esperdynetech]

I am running this on CentOS 7, with docker 1.10.3.

I am unable to use the image to launch a container.

My docker-compose.yml file is here:

version: '2'

services:
elasticsearch:
image: elasticsearch:2.3.0
ports:
- 127.0.0.1:9200:9200
- 127.0.0.1:9300:9300
volumes:
- /opt/elasticsearch/config:/usr/share/elasticsearch/config
- /opt/elasticsearch/data:/usr/share/elasticsearch/data

labels:
  com.esperdyne.description: "ES Dev"
  com.esperdyne.role: "Development"

I am unable to launch a container using any version for the elastic search image.

I receive the AccessDeniedException: /usr/share/elasticsearch/config/scripts error. When I add an additional volume line ( - /opt/elasticsearch/scripts:/usr/share/elasticsearch/scripts), and chmod the /opt/elasticsearch dir to 777 (as some have suggested, but is not satisfactory), I then find that there are no configs populated.

A similar (or duplicate) issue was closed awhile ago, and was specifically related to OSX- but in this case it is all linux.

[tianon]

The image entrypoint script will do a chown on /usr/share/elasticsearch/data for you, but it's up to you to do the same for /usr/share/elasticsearch/config. Can you try doing chown -R 105 /opt/elasticsearch/config and try again?

[esperdynetech]

When I do that, I receive the following error:
Attaching to docker_elasticsearch_1
elasticsearch_1 | log4j:WARN No appenders could be found for logger (bootstrap).
elasticsearch_1 | log4j:WARN Please initialize the log4j system properly.
elasticsearch_1 | log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info.

The config directory is not populate (although the data dir is populated)

[esperdynetech]

As an FYI (and was expected)- when I remove the /opt/elasticsearch/config:/usr/share/elasticsearch/config line, leaving only the data mount, the container starts as expected.

[tianon]

Ah, the default config is only populated via the Dockerfile -- you could do something like this to pre-seed from the image:

$ docker run --rm elasticsearch:2.3 tar -cC /usr/share/elasticsearch/config . | tar -xC /opt/elasticsearch/config

[jalberto]

@tianon does this means the usual config override is not working anymore as expected?

• in images < 2.0 to override the config file work as expected
• in images > 2.0 it doesn't works

[tianon]

@jalberto not sure what you mean by "the usual config override"; can you elaborate a bit more?

[jalberto]

@tianon I mean this:

"This image comes with a default set of configuration files for elasticsearch, but if you want to provide your own set of configuration files, you can do so via a volume mounted at /usr/share/elasticsearch/config"

Now I am not able to provide my own config file, doesn't matter whats the content, ES just cannot start.

[tianon]

I can't reproduce: 😢

$ docker pull elasticsearch:2.3
2.3: Pulling from library/elasticsearch

efd26ecc9548: Already exists 
a3ed95caeb02: Already exists 
d1784d73276e: Already exists 
52a884c93bb2: Already exists 
070ee56a6f7e: Already exists 
f8b8b1302b4f: Already exists 
e71221cc9598: Already exists 
349c9e35d503: Already exists 
c926a5d75666: Already exists 
706d6535a2f0: Already exists 
04931a364da7: Already exists 
e4667ac2171b: Already exists 
4893305d167a: Already exists 
5885742731a5: Already exists 
028e81961660: Already exists 
Digest: sha256:9a5b68fda191686d84af7e129d0de6de81df73c8225edf7876248e9f6b9d6d7a
Status: Image is up to date for elasticsearch:2.3
$ mkdir -p config
$ docker run --rm elasticsearch:2.3 tar -cC /usr/share/elasticsearch/config . | tar -xC config
$ docker run -it --rm -v "$PWD/config":/usr/share/elasticsearch/config elasticsearch:2.3
[2016-04-26 21:43:37,513][WARN ][bootstrap                ] unable to install syscall filter: seccomp unavailable: your kernel is buggy and you should upgrade
[2016-04-26 21:43:37,719][INFO ][node                     ] [Scorpio] version[2.3.1], pid[1], build[bd98092/2016-04-04T12:25:05Z]
[2016-04-26 21:43:37,719][INFO ][node                     ] [Scorpio] initializing ...
[2016-04-26 21:43:38,379][INFO ][plugins                  ] [Scorpio] modules [reindex, lang-expression, lang-groovy], plugins [], sites []
[2016-04-26 21:43:38,399][INFO ][env                      ] [Scorpio] using [1] data paths, mounts [[/usr/share/elasticsearch/data (/dev/sdc3)]], net usable_space [337.6gb], net total_space [935.8gb], spins? [possibly], types [ext4]
[2016-04-26 21:43:38,399][INFO ][env                      ] [Scorpio] heap size [989.8mb], compressed ordinary object pointers [true]
[2016-04-26 21:43:40,308][INFO ][node                     ] [Scorpio] initialized
[2016-04-26 21:43:40,308][INFO ][node                     ] [Scorpio] starting ...
[2016-04-26 21:43:40,386][INFO ][transport                ] [Scorpio] publish_address {172.18.0.12:9300}, bound_addresses {[::]:9300}
[2016-04-26 21:43:40,392][INFO ][discovery                ] [Scorpio] elasticsearch/I0CHQsMKRsOqFWlI-LScng
[2016-04-26 21:43:43,459][INFO ][cluster.service          ] [Scorpio] new_master {Scorpio}{I0CHQsMKRsOqFWlI-LScng}{172.18.0.12}{172.18.0.12:9300}, reason: zen-disco-join(elected_as_master, [0] joins received)
[2016-04-26 21:43:43,524][INFO ][http                     ] [Scorpio] publish_address {172.18.0.12:9200}, bound_addresses {[::]:9200}
[2016-04-26 21:43:43,524][INFO ][node                     ] [Scorpio] started
[2016-04-26 21:43:43,565][INFO ][gateway                  ] [Scorpio] recovered [0] indices into cluster_state

[yosifkit]

This looks to be docker-library/docs#378.

[jalberto]

@yosifkit is not the case, but thanks

@tianon in previous version the 'tar' extra step was not necessary, this make it harder to use this image in vagrant.

In other hand, the tar extra step is not mentioned in project's readme

[mi-hol]

@jalberto is this still an open issue?

[jalberto]

@mi-hol didn't tesnt in 5.x but the documentatoin don't mention that tar extra step

[jbrinnand]

We found that if a local config directory is being used to configure ES, then it should contain the "scripts" directory and not just the configuration files. It doesn't matter if the "scripts" directory is empty, but it must be present.

ls -l <your_workspace_dir>/config
-rwxrwxrwx 1 1196 Jan 30 16:54 elasticsearch.yml
-rw-r--r-- 1 12949 Jan 26 14:49 elasticsearch1.yml
-rw-rw-r-- 1 272 Jan 17 13:38 log4j2.properties
drwxr-xr-x 2 68 Jan 26 14:56 scripts

If the scripts directory is not there, ES will try and create it and it will fail with the AccessDenied Exception. Once the scripts directory is added to your local config directory, the following command should work without the infamous AccessDenied Exception

docker run --name els -d -v "$PWD/config:"/usr/share/elasticsearch/config elasticsearch

[tianon]

This image is officially deprecated in favor of upstream's images (see https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html).

For more information, please see #160, docker-library/docs#842, and docker-library/docs#945.

This image has been deprecated in favor of the official elasticsearch image provided and maintained by elastic.co. The upstream images are available to pull via docker.elastic.co/elasticsearch/elasticsearch:[version] like 5.4.2. The images found here will receive no further updates once the 5.6.0 release is available upstream. Please adjust your usage accordingly.

Elastic provides open-source support for Elasticsearch via the elastic/elasticsearch GitHub repository and the Docker image via the elastic/elasticsearch-docker GitHub repository, as well as community support via its forums.

Thanks!