Why doesn't the Elastic Package Registry Docker Image have `/bin/bash`?

Elastic Stack Kibana
1
  • Assume there is the following docker-compose.yml.
services:
  elastic-package-registry:
    image: docker.elastic.co/package-registry/distribution:8.15.0
  • Start it,
docker compose pull
docker compose up -d
docker compose exec elastic-package-registry /bin/sh
cat /etc/shells
  • At this point I'll notice that /bin/bash doesn't exist.
/package-registry # cat /etc/shells
/bin/sh
/bin/ash
  • This resulted in commands like docker compose exec elastic-package-registry /bin/bash not working.
  • Why doesn't the Elastic Package Registry Docker Image have /bin/bash?
2

Why it should have?

It is a docker image, there is no need to access the container, if it is required for some reason you already have the sh shell.

1 Like
3
  • Well, this is just out of my curiosity. Because docker.elastic.co/beats/elastic-agent:8.15.0 and docker.elastic.co/elasticsearch/elasticsearch:8.15.0 both have /bin/bash. docker.elastic.co/package-registry/distribution:8.15.0 seems to be designed differently from other Docker Images.
4

Both Elasticsearch and Elastic Agent image uses a Ubuntu image in the Dockerfile, the Package Registry is a golang image in the Dockerfile, so they are different.

But the reason for that only someone from Elastic can answer.

1 Like
5
6

Hi!

I am in the team that maintains Package Registry. We recently started to use a Wolfi-based distribution as the base image for our Docker images. This is a minimalistic distribution focused on security that doesn't include bash by default, to reduce the potential attack surface.

Apart from the base packages we are only including the software we know that is used in common use cases, this basically translates to curl for healthchecks, and /etc/mime.types for the Go runtime, to be able to properly attach content type headers to HTTP responses.

We would be open to add bash if there are reasons or uses for it. Would you have a use case that requires the use of bash for the Package Registry? Is there any other reason why you think we should include it?

2 Likes
7

  • @jsoriano Thanks for the clarification. There is no known use for bash on my side, except that a container management tool called Portainer CE uses /bin/bash by default when connecting to a container via console, and there is no easy way to know in advance if there is /bin/bash in the container. This results in an extra step of clicking on the screen to switch to /bin/sh.

  • The only reason I need to enter the container is when I need to execute curl from inside the container to test connectivity to other containers under the same Docker Network, and curl is inside the container by default, which is fine.

1 Like