elasticsearch unable to start due to wrong ownership

[thoughtbox]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

A fresh build will fail to bring up the container running Elasticsearch.

Expected Behavior

The container running Elasticsearch should start without errors.

Steps To Reproduce

Follow basic installation steps in https://github.com/StamusNetworks/SELKS/wiki/Docker

Docker version

Docker version 26.0.0, build 2ae903e

Docker version

No docker compose.

OS Version

Description: Debian GNU/Linux 10 (buster)

Content of the environnement File

COMPOSE_PROJECT_NAME=selks
INTERFACES= -i ens19
ELASTIC_DATAPATH=/local/selks/
SCIRIUS_SECRET_KEY=
ML_ENABLED=false
PWD=${PWD}

Version of SELKS

commit 2fc5391 (HEAD -> master, origin/master, origin/HEAD)
Merge: a030b9a 16fc908
Author: Eric Leblond eleblond@stamus-networks.com
Date: Mon Sep 11 08:35:37 2023 +0000

Merge branch 'Arkime-fix-v1' into 'master'

Add oui file for Arkime

See merge request devel/SELKS!5

Anything else?

The fix is to change the ownership of /usr/share/elasticsearch/data to elasticsearch.

# docker ps |grep -i elasticsearch
f89a70a25633   elastic/elasticsearch:7.16.1                 "/bin/tini -- /usr/l…"   43 hours ago   Up 43 hours (healthy)   9200/tcp, 9300/tcp                                              elasticsearch
# docker exec f89 chown elasticsearch /usr/share/elasticsearch/data

[pevma]

I cant seem to reproduce that.
Is there an error in the elasticsearch logs ?