From 68120a84da2a519d08c3bb131237289b32595adf Mon Sep 17 00:00:00 2001
From: alexbelgium <alexandre.pary@gmail.com>
Date: Tue, 14 Jul 2026 11:18:49 +0200
Subject: [PATCH] =?UTF-8?q?fix(elasticsearch):=20address=20review=20?=
 =?UTF-8?q?=E2=80=94=20build=20user,=20env=5Fvars=20validation?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- The 8.19.18 base image ends the build as USER 1000:0 with a
  root-owned, read-only (0555) entrypoint, so the sed patch and later
  chmod/package-install steps failed. Switch to root for the build and
  restore the Elasticsearch user before runtime.
- Tighten the env_vars name check to require a leading letter/underscore
  (shell identifier rules) instead of allowing a leading digit, which
  made `export "$name"=...` fail and abort startup under `set -e`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 elasticsearch/CHANGELOG.md                       | 2 ++
 elasticsearch/Dockerfile                         | 8 ++++++++
 elasticsearch/rootfs/usr/local/bin/addon-init.sh | 2 +-
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/elasticsearch/CHANGELOG.md b/elasticsearch/CHANGELOG.md
index a11e709ecb..9ea78d5768 100644
--- a/elasticsearch/CHANGELOG.md
+++ b/elasticsearch/CHANGELOG.md
@@ -8,6 +8,8 @@
 - Removed the `ingest-attachment` plugin install: it is a bundled module since Elasticsearch 8.0.
 - Startup persistence logic rewritten as a proper init script (`/usr/local/bin/addon-init.sh`) instead of line-number-based entrypoint patching.
 - Added `updater.json` so upstream 8.19.x releases are tracked automatically (pinned to the 8.19 line: 9.x cannot read indices created in 7.x).
+- The upstream 8.x image ends the build as a non-root user with a read-only entrypoint; the Dockerfile now switches to root for the build steps that patch/install into it and restores the Elasticsearch user before runtime.
+- `env_vars` names starting with a digit are now rejected before export instead of crashing the entrypoint.
 
 ## 8.14.3-3 (2026-06-19)
 - Fix startup failing with `chroot: cannot change root directory` by allowing `capability sys_chroot` in the AppArmor profile (#2709)
diff --git a/elasticsearch/Dockerfile b/elasticsearch/Dockerfile
index abb39edbb4..4295ea3e0e 100644
--- a/elasticsearch/Dockerfile
+++ b/elasticsearch/Dockerfile
@@ -17,6 +17,11 @@
 ARG BUILD_UPSTREAM="8.19.18"
 FROM elasticsearch:$BUILD_UPSTREAM
 
+# The base image ends as USER 1000:0 with a root-owned, read-only (0555)
+# entrypoint; switch back to root for the remaining build steps (entrypoint
+# patch, package install, chmod), then restore the Elasticsearch user below
+USER root
+
 ##################
 # 2 Modify Image #
 ##################
@@ -135,3 +140,6 @@ HEALTHCHECK \
     --start-period=30s \
     --timeout=25s \
     CMD curl -A "HealthCheck: Docker/1.0" -s -f "http://127.0.0.1:${HEALTH_PORT}${HEALTH_URL}" &>/dev/null || exit 1
+
+# Restore the Elasticsearch user for runtime, matching the base image
+USER 1000:0
diff --git a/elasticsearch/rootfs/usr/local/bin/addon-init.sh b/elasticsearch/rootfs/usr/local/bin/addon-init.sh
index 63533c96d3..97ee6af763 100644
--- a/elasticsearch/rootfs/usr/local/bin/addon-init.sh
+++ b/elasticsearch/rootfs/usr/local/bin/addon-init.sh
@@ -28,7 +28,7 @@ if [ -f "$OPTIONS_JSON" ] && command -v jq >/dev/null 2>&1; then
     while IFS= read -r pair; do
         name=$(jq -r '.name // empty' <<<"$pair")
         value=$(jq -r '.value // empty' <<<"$pair")
-        if [[ $name =~ ^[A-Za-z0-9_]+$ ]]; then
+        if [[ $name =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then
             echo "Setting env variable from options: $name"
             export "$name"="$value"
         elif [ -n "$name" ]; then