Make Docker images suitable for ESS/ECE/ECK

[tylersmalley]

Cloud currently builds and runs a fully custom Kibana image. The Stack image should provide an image suitable for direct use instead.

User / Group IDs

Cloud currently expects to be able to set the user and group IDs via environment variables. The entry point script changes the founduser user's UID and GID to those provided in the env vars, and performs a recursive chown on some directories in the container.

The Stack image takes a different approach, in that it follows the OKD image guidelines and uses GID 0 for all files.

setuid flags

PR: #56826

Cloud ensures that there are no files with setuid, in order to mitigate "stackclash" attacks. Basically, they do this:

RUN find / -xdev -perm -4000 -exec chmod u-s {} +

This could be done in the Stack image.

Init process

Cloud runs Kibana via a mini-init process in order to avoid zombie processes. There should be no harm in adopting this in the Stack image. https://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zombie-reaping-problem/

Unpack Chromium

Issue: #53664

Unpacking Chromium at startup results in a slower startup. Because of this, Cloud has chosen to unpack Chromium and delete remove the zip to conserve space.

License Management UI

Issue: #52709

In a managed environment, there is no need for the license management UI to be present. For this, the license management plugin is disabled, however this triggers an optimization run. I believe we can add a configuration option to disable the UI, while keeping the plugin installed, preventing an optimization run.

[elasticmachine]

Pinging @elastic/kibana-operations (Team:Operations)

[tylersmalley]

This is complete.