fix(elasticsearch): address review — build user, env_vars validation

- The 8.19.18 base image ends the build as USER 1000:0 with a
  root-owned, read-only (0555) entrypoint, so the sed patch and later
  chmod/package-install steps failed. Switch to root for the build and
  restore the Elasticsearch user before runtime.
- Tighten the env_vars name check to require a leading letter/underscore
  (shell identifier rules) instead of allowing a leading digit, which
  made `export "$name"=...` fail and abort startup under `set -e`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

elasticsearch/CHANGELOG.md

@@ -8,6 +8,8 @@
 - Removed the `ingest-attachment` plugin install: it is a bundled module since Elasticsearch 8.0.
 - Startup persistence logic rewritten as a proper init script (`/usr/local/bin/addon-init.sh`) instead of line-number-based entrypoint patching.
 - Added `updater.json` so upstream 8.19.x releases are tracked automatically (pinned to the 8.19 line: 9.x cannot read indices created in 7.x).
+- The upstream 8.x image ends the build as a non-root user with a read-only entrypoint; the Dockerfile now switches to root for the build steps that patch/install into it and restores the Elasticsearch user before runtime.
+- `env_vars` names starting with a digit are now rejected before export instead of crashing the entrypoint.
 
 ## 8.14.3-3 (2026-06-19)
 - Fix startup failing with `chroot: cannot change root directory` by allowing `capability sys_chroot` in the AppArmor profile (#2709)

elasticsearch/Dockerfile

@@ -17,6 +17,11 @@
 ARG BUILD_UPSTREAM="8.19.18"
 FROM elasticsearch:$BUILD_UPSTREAM
 
+# The base image ends as USER 1000:0 with a root-owned, read-only (0555)
+# entrypoint; switch back to root for the remaining build steps (entrypoint
+# patch, package install, chmod), then restore the Elasticsearch user below
+USER root
+
 ##################
 # 2 Modify Image #
 ##################
@@ -135,3 +140,6 @@ HEALTHCHECK \
     --start-period=30s \
     --timeout=25s \
     CMD curl -A "HealthCheck: Docker/1.0" -s -f "http://127.0.0.1:${HEALTH_PORT}${HEALTH_URL}" &>/dev/null || exit 1
+
+# Restore the Elasticsearch user for runtime, matching the base image
+USER 1000:0

elasticsearch/rootfs/usr/local/bin/addon-init.sh

@@ -28,7 +28,7 @@ if [ -f "$OPTIONS_JSON" ] && command -v jq >/dev/null 2>&1; then
     while IFS= read -r pair; do
         name=$(jq -r '.name // empty' <<<"$pair")
         value=$(jq -r '.value // empty' <<<"$pair")
-        if [[ $name =~ ^[A-Za-z0-9_]+$ ]]; then
+        if [[ $name =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then
             echo "Setting env variable from options: $name"
             export "$name"="$value"
         elif [ -n "$name" ]; then