From 02bbfa86c33b9191b992b34a8c13634ec37d637b Mon Sep 17 00:00:00 2001
From: alexbelgium <alexandre.pary@gmail.com>
Date: Tue, 14 Jul 2026 13:35:03 +0200
Subject: [PATCH] fix(elasticsearch): force fresh image pull, clarify non-root
 failure

The published 8.19.18 images are correct (verified: real ES 8.19.18,
run as root, migration + privilege-drop in place). But some upgrades
were left running a stale cached Elasticsearch 7.17.9 image that starts
as uid 1000, producing the reported "mv: cannot move '/data/config' ...
Permission denied" and "AccessDeniedException[.../data/nodes/0]".

- Bump version to 8.19.18-3 to force Home Assistant / Docker to pull a
  fresh image tag instead of reusing the cached one.
- Add an explicit root check on the first init pass (before any move or
  chown) so a non-root start fails with a clear, actionable message
  instead of the cryptic permission error, and wrap the config-archive
  mv with the same clear failure. The re-exec'd uid-1000 pass returns
  before this check, so the privilege drop still works.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 elasticsearch/CHANGELOG.md                      |  4 ++++
 elasticsearch/config.yaml                       |  2 +-
 .../rootfs/usr/local/bin/addon-init.sh          | 17 ++++++++++++++++-
 3 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/elasticsearch/CHANGELOG.md b/elasticsearch/CHANGELOG.md
index 48d816149e..67063f0cb5 100644
--- a/elasticsearch/CHANGELOG.md
+++ b/elasticsearch/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 8.19.18-3 (14-07-2026)
+- Force a fresh image pull for users left on a stale cached image (some upgrades kept running the old Elasticsearch 7.17.9 image, failing with `mv: cannot move '/data/config' ... Permission denied` and `AccessDeniedException[/usr/share/elasticsearch/data/nodes/0]`). Fully stop and update the add-on so Home Assistant pulls this build.
+- Replaced the cryptic `Permission denied` failure with a clear message when the add-on is not running as root (the state that caused the failure above).
+
 ## 8.19.18-2 (14-07-2026)
 - Minor bugs fixed
 ## 8.19.18 (2026-07-14)
diff --git a/elasticsearch/config.yaml b/elasticsearch/config.yaml
index 475cd3ce06..dba4ca188e 100644
--- a/elasticsearch/config.yaml
+++ b/elasticsearch/config.yaml
@@ -90,4 +90,4 @@ slug: elasticsearch
 startup: services
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/elasticsearch
-version: 8.19.18-2
+version: 8.19.18-3
diff --git a/elasticsearch/rootfs/usr/local/bin/addon-init.sh b/elasticsearch/rootfs/usr/local/bin/addon-init.sh
index 66a06d36ff..eae765ed58 100755
--- a/elasticsearch/rootfs/usr/local/bin/addon-init.sh
+++ b/elasticsearch/rootfs/usr/local/bin/addon-init.sh
@@ -31,6 +31,17 @@ PERSISTENT_HOME="/data"
 VERSION_MARKER="$PERSISTENT_HOME/.addon-upstream-version"
 OPTIONS_JSON="/data/options.json"
 
+# This first pass must be root so it can relocate and take ownership of
+# pre-existing /data content written by an earlier (root) install. If it
+# is not root (e.g. an old cached image that pinned USER 1000:0, or the
+# container being forced to another user), the moves/chowns below fail
+# with a cryptic "Permission denied"; fail loudly with the real reason.
+if [ "$(id -u)" -ne 0 ]; then
+    echo "FATAL: the Elasticsearch add-on must start as root (currently uid $(id -u))."
+    echo "If you upgraded from an older version, the running image is likely stale - fully stop and update/reinstall the add-on so Home Assistant pulls the current image."
+    exit 1
+fi
+
 ############################
 # 1 Export user env_vars   #
 ############################
@@ -94,7 +105,11 @@ if [ -n "$data_version" ] && [[ $current_major =~ ^[0-9]+$ ]]; then
         if [ -d "$PERSISTENT_HOME/config" ] && [ ! -L "$PERSISTENT_HOME/config" ]; then
             config_backup="$PERSISTENT_HOME/config.bak-$data_version"
             if [ ! -e "$config_backup" ]; then
-                mv "$PERSISTENT_HOME/config" "$config_backup"
+                if ! mv "$PERSISTENT_HOME/config" "$config_backup"; then
+                    echo "FATAL: could not archive the old config to $config_backup."
+                    echo "This add-on must run as root to migrate a previous install. Restore a Home Assistant backup and ensure the add-on is not forced to a non-root user."
+                    exit 1
+                fi
                 echo "NOTICE: previous config archived to $config_backup. Re-apply any custom settings to the new config."
             fi
         fi