# Uninstalling x-pack plugin from Kibana Docker image (5.6.1) broken: Unable to remove plugin because of error: "ENOTEMPTY: directory not empty, rmdir '/usr/share/kibana/plugins/x-pack/.phantom'"

**URL:** <https://discuss.elastic.co/t/uninstalling-x-pack-plugin-from-kibana-docker-image-5-6-1-broken-unable-to-remove-plugin-because-of-error-enotempty-directory-not-empty-rmdir-usr-share-kibana-plugins-x-pack-phantom/101744>\
**Category:** Kibana\
**Created:** [September 25, 2017, 7:03pm UTC](https://discuss.elastic.co/t/uninstalling-x-pack-plugin-from-kibana-docker-image-5-6-1-broken-unable-to-remove-plugin-because-of-error-enotempty-directory-not-empty-rmdir-usr-share-kibana-plugins-x-pack-phantom/101744 "2017-09-25T19:03:27Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![kspear](https://avatars.discourse-cdn.com/v4/letter/k/9f8e36/32.png) [@kspear](https://discuss.elastic.co/u/kspear)\
**Post date:** [September 25, 2017, 7:03pm UTC](https://discuss.elastic.co/t/uninstalling-x-pack-plugin-from-kibana-docker-image-5-6-1-broken-unable-to-remove-plugin-because-of-error-enotempty-directory-not-empty-rmdir-usr-share-kibana-plugins-x-pack-phantom/101744/1 "2017-09-25T19:03:27Z")

</div>

Relates to this [GitHub issue](https://github.com/elastic/kibana/issues/10474) (now closed).

Opening a thread here at the suggestion of [kobelb](https://github.com/elastic/kibana/issues/10474#issuecomment-281653080), who closed the original GitHub issue. I can confirm, though, that the problem is present as of the latest available Kibana Docker image.

Copying [my comment from that thread](https://github.com/elastic/kibana/issues/10474#issuecomment-331978044) here:

* * *

Running into this same issue with [docker.elastic.co/kibana/kibana:5.6.1](http://docker.elastic.co/kibana/kibana:5.6.1).

```auto
[user@server]$ docker run --user root -ti --rm docker.elastic.co/kibana/kibana:5.6.1 bash
[root@70ac29ce9a7e kibana]# bin/kibana-plugin remove x-pack
Removing x-pack...
Unable to remove plugin because of error: "ENOTEMPTY: directory not empty, rmdir '/usr/share/kibana/plugins/x-pack/.phantom'" 
[root@70ac29ce9a7e kibana]# rm -rf /usr/share/kibana/plugins/x-pack/.phantom    
rm: cannot remove '/usr/share/kibana/plugins/x-pack/.phantom': Directory not empty
[root@70ac29ce9a7e kibana]# ls /usr/share/kibana/plugins/x-pack/.phantom -l
ls: cannot access /usr/share/kibana/plugins/x-pack/.phantom/phantomjs-2.1.1-linux-i686.tar.bz2: No such file or directory
ls: cannot access /usr/share/kibana/plugins/x-pack/.phantom/phantomjs-2.1.1-linux-x86_64.tar.bz2: No such file or directory
ls: cannot access /usr/share/kibana/plugins/x-pack/.phantom/phantomjs-2.1.1-macosx.zip: No such file or directory
ls: cannot access /usr/share/kibana/plugins/x-pack/.phantom/phantomjs-2.1.1-windows.zip: No such file or directory
total 0
?????????? ? ? ? ? ? phantomjs-2.1.1-linux-i686.tar.bz2
?????????? ? ? ? ? ? phantomjs-2.1.1-linux-x86_64.tar.bz2
?????????? ? ? ? ? ? phantomjs-2.1.1-macosx.zip
?????????? ? ? ? ? ? phantomjs-2.1.1-windows.zip
[root@70ac29ce9a7e kibana]# rm -f /usr/share/kibana/plugins/x-pack/.phantom/*
[root@70ac29ce9a7e kibana]# ls /usr/share/kibana/plugins/x-pack/.phantom -l
ls: cannot access /usr/share/kibana/plugins/x-pack/.phantom/phantomjs-2.1.1-linux-i686.tar.bz2: No such file or directory
ls: cannot access /usr/share/kibana/plugins/x-pack/.phantom/phantomjs-2.1.1-linux-x86_64.tar.bz2: No such file or directory
ls: cannot access /usr/share/kibana/plugins/x-pack/.phantom/phantomjs-2.1.1-macosx.zip: No such file or directory
ls: cannot access /usr/share/kibana/plugins/x-pack/.phantom/phantomjs-2.1.1-windows.zip: No such file or directory
total 0
?????????? ? ? ? ? ? phantomjs-2.1.1-linux-i686.tar.bz2
?????????? ? ? ? ? ? phantomjs-2.1.1-linux-x86_64.tar.bz2
?????????? ? ? ? ? ? phantomjs-2.1.1-macosx.zip
?????????? ? ? ? ? ? phantomjs-2.1.1-windows.zip

```

No amount of trying will let me remove these files, so the uninstall command for x-pack (`bin/kibana-plugin remove x-pack`) appears to be straight up broken in the latest official Kibana docker image.

---

<div class="post-metadata">

**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\
**Post date:** [September 25, 2017, 8:28pm UTC](https://discuss.elastic.co/t/uninstalling-x-pack-plugin-from-kibana-docker-image-5-6-1-broken-unable-to-remove-plugin-because-of-error-enotempty-directory-not-empty-rmdir-usr-share-kibana-plugins-x-pack-phantom/101744/2 "2017-09-25T20:28:02Z")

</div>

Strange... I know that phantom is unpacked into that path, maybe the remove command isn't doing a deep remove of the path? I suspect it's a bug in the plugin installer, but let me dig into this a little bit.

UPDATE: It looks like the plugin uninstaller [just does a deep path removal](https://github.com/elastic/kibana/blob/master/src/cli_plugin/remove/remove.js#L17-L21), so I'm not sure why the `.phantom` path wouldn't be empty. Is it possible that the instance was still running while you tried to uninstall the plugin? I'm thinking maybe the phantom instance was running, so it couldn't be removed, and then the path was not empty as a result of that... just a wild guess though.

---

<div class="post-metadata">

**Author:** ![Dallas\_Toth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dallas_toth/32/22630_2.png) [@Dallas\_Toth](https://discuss.elastic.co/u/Dallas_Toth)\
**Post date:** [September 26, 2017, 5:49am UTC](https://discuss.elastic.co/t/uninstalling-x-pack-plugin-from-kibana-docker-image-5-6-1-broken-unable-to-remove-plugin-because-of-error-enotempty-directory-not-empty-rmdir-usr-share-kibana-plugins-x-pack-phantom/101744/3 "2017-09-26T05:49:23Z")

</div>

even if you get xpack removed from the docker container I still recieve an error plugin:elasticsearch@5.6.1 | [remote\_transport\_exception] [tiebreaker-0000000014][111.111.111.111:19672][indices:admin/mapping/put] when you try to login. My other 5.4.2 docker containers that never had xpack installed are still fine. ES is not red.

---

<div class="post-metadata">

**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\
**Post date:** [September 26, 2017, 3:41pm UTC](https://discuss.elastic.co/t/uninstalling-x-pack-plugin-from-kibana-docker-image-5-6-1-broken-unable-to-remove-plugin-because-of-error-enotempty-directory-not-empty-rmdir-usr-share-kibana-plugins-x-pack-phantom/101744/4 "2017-09-26T15:41:21Z")

</div>

Did you remove xpack from the Elasticsearch container as well? Or at least disable Security? If you still have security on, that could be what is preventing Kibana's es plugin from working correctly. The error message makes me think that's not actually the issue, but it seemed worth asking.

---

<div class="post-metadata">

**Author:** ![Dallas\_Toth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dallas_toth/32/22630_2.png) [@Dallas\_Toth](https://discuss.elastic.co/u/Dallas_Toth)\
**Post date:** [October 10, 2017, 5:53pm UTC](https://discuss.elastic.co/t/uninstalling-x-pack-plugin-from-kibana-docker-image-5-6-1-broken-unable-to-remove-plugin-because-of-error-enotempty-directory-not-empty-rmdir-usr-share-kibana-plugins-x-pack-phantom/101744/5 "2017-10-10T17:53:52Z")

</div>

This is resolved for me. The issue for me was that my kibana index's were missing some mappings.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 7, 2017, 5:54pm UTC](https://discuss.elastic.co/t/uninstalling-x-pack-plugin-from-kibana-docker-image-5-6-1-broken-unable-to-remove-plugin-because-of-error-enotempty-directory-not-empty-rmdir-usr-share-kibana-plugins-x-pack-phantom/101744/6 "2017-11-07T17:54:19Z")

</div>

Closed on November 7, 2017, 5:54pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
