create an official docker image based on a well-accepted, open OS

[bean5]

https://github.com/krizsan/elastalert-docker exists, but it depends on iron/python:2 which on dockerhub doesn't like to a repository, meaning that we can't prove what is in it without manually inspection.

An official container based on this would be very helpful, more trustworthy, and more robust in environments. I build my own in a way similar to krizsan, but I base it on python:2.7.12-alpine:

Since I am new to python, I don't know a better way to reliably install requirements than to call pip install -r requirements.txt || pip install -r requirements.txt || pip install -r requirements.txt. Krizsan does pip install -e ., but I found that sometimes a dependency (stomp) ended up missing in the final container.

Note: #408 might help fulfill this request.

# Elastalert Docker image running on Alpine Linux.

FROM python:2.7.12-alpine

RUN apk update && apk upgrade && apk add bash

# Set this environment variable to true to set timezone on container start.
ENV SET_CONTAINER_TIMEZONE false
# Default container timezone as found under the directory /usr/share/zoneinfo/.
ENV CONTAINER_TIMEZONE Europe/Stockholm

# Install software required for Elastalert and NTP for time synchronization.
RUN apk add python-dev gcc musl-dev tzdata openntpd

RUN apk add ca-certificates wget && update-ca-certificates
# Install pip - required for installation of Elastalert.
RUN \
	wget https://bootstrap.pypa.io/get-pip.py \
	&& python get-pip.py \
	&& rm get-pip.py

WORKDIR /opt
# URL from which to download Elastalert.
ENV ELASTALERT_URL https://github.com/Yelp/elastalert/archive/master.zip
# Elastalert home directory name.
ENV ELASTALERT_DIRECTORY_NAME elastalert
# Download and unpack Elastalert.
RUN \
	wget ${ELASTALERT_URL} \
	&& unzip *.zip \
	&& rm *.zip \
	&& mv e* ${ELASTALERT_DIRECTORY_NAME}

# Elastalert home directory full path.
ENV ELASTALERT_HOME /opt/${ELASTALERT_DIRECTORY_NAME}
WORKDIR ${ELASTALERT_HOME}

# Install Elastalert (use `-r requirements.txt` with 3 times more tries than default for resiliency instead of -e)
RUN \
	python setup.py install \
	&& (pip install -r requirements.txt || pip install -r requirements.txt || pip install -r requirements.txt) \
# Install Supervisor.
	&& easy_install supervisor

# Create directories. The /var/empty directory is used by openntpd.
RUN \
	mkdir -p /opt/config \
	&& mkdir -p /opt/rules \
	&& mkdir -p /opt/logs \
	&& mkdir -p /var/empty

ENV ELASTICSEARCH_HOST elasticsearch
# Port on above Elasticsearch host. Set in default Elasticsearch configuration file.
ENV ELASTICSEARCH_PORT 9200

# Clean up.
RUN \
 	apk del python-dev \
	&& apk del musl-dev \
	&& apk del gcc

# Copy the script used to launch the Elastalert when a container is started.
ADD ./command.sh /opt/
# Make the start-script executable.
RUN chmod +x /opt/command.sh

# Launch Elastalert when a container is started.
CMD ["/opt/command.sh"]

Contents of command.sh:

#!/bin/sh

set -e

# Set the timezone.
if [ "$SET_CONTAINER_TIMEZONE" = "true" ]; then
	setup-timezone -z ${CONTAINER_TIMEZONE} && \
	echo "Container timezone set to: $CONTAINER_TIMEZONE"
else
	echo "Container timezone not modified"
fi

# Force immediate synchronisation of the time and start the time-synchronization service.
# In order to be able to use ntpd in the container, it must be run with the SYS_TIME capability.
# In addition you may want to add the SYS_NICE capability, in order for ntpd to be able to modify its priority.
ntpd -s

# Wait until Elasticsearch is online since otherwise Elastalert will fail.
echo "Checking whether elasticsearch is up."

rm -f garbage_file
while ! wget -O garbage_file ${ELASTICSEARCH_PROTOCOL}://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT} 2>/dev/null
do
	echo "Waiting for Elasticsearch...${ELASTICSEARCH_PROTOCOL}://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}"
	rm -f garbage_file
	sleep 1
done
rm -f garbage_file
echo "Sleeping for 5s to ensure that elasticsearch comes up."
sleep 5

# Check if the Elastalert index exists in Elasticsearch and create it if it does not.
if ! wget -O garbage_file ${ELASTICSEARCH_PROTOCOL}://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}/${ELASTICSEARCH_INDEX} 2>/dev/null
then
	echo "Creating Elastalert index in Elasticsearch...${ELASTICSEARCH_PROTOCOL}://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}/${ELASTICSEARCH_INDEX}"
    # elastalert-create-index --index ${ELASTICSEARCH_INDEX} --old-index ""
	apk add curl; curl -X PUT ${ELASTICSEARCH_PROTOCOL}://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}/${ELASTICSEARCH_INDEX}; apk del curl
else
	echo "Elastalert index already exists in Elasticsearch."
fi

echo "Starting Elastalert..."
# Following the help mentioned at http://stackoverflow.com/questions/35779450/how-to-run-elastalert-with-supervisor
python /opt/elastalert/elastalert/elastalert.py --config /opt/config/config.yaml --verbose

[abhishekunotech]

@bean5 : I have set up ElastAlert for production in Centos 7, with smtp server ingrained in it. I can write a dockerfile for building elastalert over centos:7 as base image.

[WillLiu360]

@abhishekunotech I would appreciate if you can share the dockerfile for this.

[bean5]

@abhishekunotech can you share your dockerfile for setting up ElastAlert in Centos 7?

[abhishekunotech]

sorry guys, I lost the dockerfile for the same. I will be working on releasing one by this weekend. My bad, sorry. *Thanks and Regards*, *Abhishek Aravind Kulkarni* | *Unotech Software Pvt. Ltd ** <http://www.unotechsoft.com>* *M*: +91 7303 495 035 *O*: +91 (22) 2687 9402 *A*: D Wing, 7th floor, 32 Corporate Avenue, Off Mahakali Caves Road, Andheri (E), Mumbai, 400093 *W*: www.unotechsoft.com

…

On Wed, Apr 19, 2017 at 9:37 AM, Bean ***@***.***> wrote: @abhishekunotech <https://github.com/abhishekunotech> can you share your dockerfile for setting up ElastAlert in Centos 7? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#862 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AYKtkx4le1wA03sB9NaiXJ-qlI5ggKNWks5rxYhkgaJpZM4Lg5s7> .

-- *Disclaimer :* The contents of this e-mail and attachment(s) thereto are confidential and intended for the named recipient(s) only. It shall not attach any liability on the originator or Unotech Software Pvt. Ltd. or its affiliates. Any views or opinions presented in this email are solely those of the author and may not necessarily reflect the opinions of Unotech Software Pvt. Ltd. or its affiliates. Any form of reproduction, dissemination, copying, disclosure, modification, distribution and / or publication of this message without the prior written consent of the author of this e-mail is strictly prohibited. If you have received this email in error please delete it and notify the sender immediately.

[krizsan]

Hi!
My Elastalert Docker image no longer use the IronPython as a base image, but Alpine. Perhaps Alpine is not considered to be a well-accepted open OS?
With that said, I would be more than willing to donate my Elastalert Docker image to Yelp or step aside for an official image. In fact, it is just the lack of an official image that keeps me going with this.
Best regards.

[bean5]

@krizsan that is great news! Sorry to take so long to respond. Do you think you could add it in as Dockerfile and refactor the current Dockerfile to be Dockerfile-tox ? Probably want to wait until krizsan/elastalert-docker#13 is merged in, though. It looks like that has some really great improvements on the work you've done.

[krizsan]

I'll leave it to someone else to pick up the torch, as I need to focus on other things.

[xaka]

@Qmando @bean5 is there anything the community can help with? what about #408?

[bean5]

Piping in here. In my experience having that docker file really helps. I prefer using that one since it is based on Alpine. Basing in Python would also work though, I think.

…

On Mon, Nov 20, 2017, 4:54 PM Pavel Strashkin ***@***.***> wrote: @Qmando <https://github.com/qmando> @bean5 <https://github.com/bean5> is there anything the community can help with? what about #408 <#408>? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#862 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AB9SJgbMPg2xhY11YOBKaLIRmJ_tmR6Nks5s4h9PgaJpZM4Lg5s7> .

[bean5]

Breast practice is to peg to a version. For python-based projects usually to a Python base image. Many projects at this point have a slim alpine flavor. Might call that a best practice.

This project still references ubuntu:latest which either speaks to its robustness over time, quality of TLC and activity, or all of the above. Bravo for keeping it alive and well. I'm not currently using it but I'm glad it is still around. Serious props for hitting on a tech gap that large!