Container trying to run elasticsearch as root

[hajimurtaza]

I am trying to restart my container , but its not able to run ELK services. It exits after a few seconds. This is the error log I was able to collect before the container exits. I have been using and developing for several weeks never got this issue.

root@6877514e0275:/opt/elasticsearch/logs# cat elasticsearch.log [2020-04-01T21:23:48,838][ERROR][o.e.b.Bootstrap ] [elk] Exception java.lang.RuntimeException: can not run elasticsearch as root at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:105) ~[elasticsearch-7.6.1.jar:7.6.1] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:172) ~[elasticsearch-7.6.1.jar:7.6.1] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) [elasticsearch-7.6.1.jar:7.6.1] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170) [elasticsearch-7.6.1.jar:7.6.1] at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:161) [elasticsearch-7.6.1.jar:7.6.1] at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) [elasticsearch-7.6.1.jar:7.6.1] at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125) [elasticsearch-cli-7.6.1.jar:7.6.1] at org.elasticsearch.cli.Command.main(Command.java:90) [elasticsearch-cli-7.6.1.jar:7.6.1] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:126) [elasticsearch-7.6.1.jar:7.6.1] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) [elasticsearch-7.6.1.jar:7.6.1] [2020-04-01T21:23:48,853][ERROR][o.e.b.ElasticsearchUncaughtExceptionHandler] [elk] uncaught exception in thread [main] org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:174) ~[elasticsearch-7.6.1.jar:7.6.1] at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:161) ~[elasticsearch-7.6.1.jar:7.6.1] at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-7.6.1.jar:7.6.1] at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125) ~[elasticsearch-cli-7.6.1.jar:7.6.1] at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-7.6.1.jar:7.6.1] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:126) ~[elasticsearch-7.6.1.jar:7.6.1] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) ~[elasticsearch-7.6.1.jar:7.6.1] Caused by: java.lang.RuntimeException: can not run elasticsearch as root at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:105) ~[elasticsearch-7.6.1.jar:7.6.1] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:172) ~[elasticsearch-7.6.1.jar:7.6.1] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.6.1.jar:7.6.1] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170) ~[elasticsearch-7.6.1.jar:7.6.1] ... 6 more

[spujadas]

Very strange indeed. How exactly did you restart the container?

[hajimurtaza]

docker restart elk

Ok so what I did was run a new container called elk_1 , deleted it , then again restarted my elk container and it worked.

I was worried that I might not be able to get my stuff from that container. Maybe something to look at. Let me know what I can send you which might be useful to check out the issue. Like logs and stuff

[spujadas]

The thing is I don't know how this could possibly have happened. When the container starts, the start-up script (start.sh) runs service elasticsearch start, which starts the Elasticsearch service using a dedicated non-root user (named elasticsearch), so I really don't see where the message can not run elasticsearch as root (which means exactly what it says) could be coming from in normal use.

Did you make any changes to the image and/or did you docker exec into the container and run any commands from the shell within the container?

[hajimurtaza]

No I havent made any changes to the image at all. This issue happened first time. Is there something you would want me to look for if this happens again? It might help debug the issue.

[spujadas]

Hmmm, looks like an unexplainable glitch that will be impossible to debug if it can't be reproduced consistently, but if it happens again sending the container's complete start-up logs can't hurt. (My default recommendation in this case would be to try turning it off and on again 😉)

[hajimurtaza]

Cool. Closing issue for now.