Change image build process

build-docker-images/wazuh-agent/Dockerfile

@@ -1,10 +1,13 @@
 # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
-FROM amazonlinux:2023
 
-RUN rm /bin/sh && ln -s /bin/bash /bin/sh
+################################################################################
+# Build stage 0 (builder):
+# Install Wazuh Agent RPM and download tini (static PID-1 init shim).
+################################################################################
+FROM amazonlinux:2023 AS builder
 
 ARG WAZUH_VERSION
-ARG S6_VERSION="v2.2.0.3"
+ARG TINI_VERSION="v0.19.0"
 ARG WAZUH_MANAGER='CHANGE_MANAGER_IP'
 ARG WAZUH_REGISTRATION_SERVER='CHANGE_ENROLL_IP'
 ARG WAZUH_AGENT_NAME='CHANGE_AGENT_NAME'
@@ -16,19 +19,51 @@ RUN RPM_ARCH="x86_64" && \
     if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \
     URL_VAR="wazuh_agent_${RPM_ARCH}_rpm" && \
     agent_url="${!URL_VAR}" && \
-    dnf install curl-minimal tar gzip procps -y &&\
+    dnf install curl-minimal tar gzip procps shadow-utils -y && \
     curl -o /wazuh-agent.rpm "${agent_url}" && \
     dnf install /wazuh-agent.rpm -y && \
     rm -rf /wazuh-agent.rpm && \
     dnf clean all && \
-    sed -i '/<authorization_pass_path>/d' /var/ossec/etc/ossec.conf && \
-    S6_ARCH="amd64" && \
-    if [ "${TARGETARCH}" = "arm64" ]; then S6_ARCH="aarch64"; fi && \
-    curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-${S6_ARCH}.tar.gz \
-    -o /tmp/s6-overlay-${S6_ARCH}.tar.gz && \
-    tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \
-    tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \
-    rm  /tmp/s6-overlay-${S6_ARCH}.tar.gz
+    sed -i '/<authorization_pass_path>/d' /var/ossec/etc/ossec.conf
+
+# Download tini static binary (no external library dependencies)
+RUN TINI_ARCH="amd64" && \
+    if [ "${TARGETARCH}" = "arm64" ]; then TINI_ARCH="arm64"; fi && \
+    curl --fail --silent -L \
+    https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini-static-${TINI_ARCH} \
+    -o /usr/local/bin/tini && \
+    chmod +x /usr/local/bin/tini
+
+################################################################################
+# Build stage 1 (the actual Wazuh Agent image):
+# Copy Wazuh Agent and tini from builder. Install only runtime dependencies.
+################################################################################
+FROM amazonlinux:2023
+
+RUN rm /bin/sh && ln -s /bin/bash /bin/sh
+
+# Install only runtime dependencies
+RUN dnf install procps shadow-utils -y && \
+    dnf clean all && \
+    getent group wazuh || groupadd -r -g 999 wazuh && \
+    getent passwd wazuh || useradd --system \
+        --uid 999 \
+        --no-create-home \
+        --home-dir /var/ossec \
+        --gid wazuh \
+        --shell /sbin/nologin \
+        wazuh
+
+# Copy Wazuh Agent installation from builder
+COPY --from=builder /var/ossec /var/ossec
+
+# Copy tini static binary
+COPY --from=builder /usr/local/bin/tini /usr/local/bin/tini
+
+# Copy entrypoint and init scripts
+COPY config/entrypoint.sh /entrypoint.sh
 COPY config/etc/ /etc/
 
-ENTRYPOINT [ "/init" ]
+RUN chmod 755 /entrypoint.sh
+
+ENTRYPOINT ["/usr/local/bin/tini", "--", "/entrypoint.sh"]

build-docker-images/wazuh-agent/config/entrypoint.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
+
+# Run initialization and configuration
+bash /etc/cont-init.d/0-wazuh-init
+
+# Start Wazuh Agent (may log warnings if manager address is not configured)
+bash /etc/cont-init.d/1-agent
+
+# Tail the main log to stdout so Docker captures it
+tail -F /var/ossec/logs/ossec.log &
+TAIL_PID=$!
+
+# Graceful shutdown: stop Wazuh and exit cleanly on SIGTERM/SIGINT
+_stop() {
+    echo "Stopping Wazuh Agent..."
+    /var/ossec/bin/wazuh-control stop 2>/dev/null || true
+    kill "${TAIL_PID}" 2>/dev/null || true
+}
+trap _stop SIGTERM SIGINT SIGQUIT
+
+wait "${TAIL_PID}"

build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init

@@ -1,4 +1,4 @@
-#!/usr/bin/with-contenv bash
+#!/bin/bash
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 
 WAZUH_INSTALL_PATH=/var/ossec

build-docker-images/wazuh-agent/config/etc/cont-init.d/1-agent

@@ -1,4 +1,4 @@
-#!/usr/bin/with-contenv bash
+#!/bin/bash
 
 ##############################################################################
 # Migration sequence

build-docker-images/wazuh-agent/config/etc/services.d/ossec-logs/run

@@ -1,4 +1,4 @@
-#!/usr/bin/with-contenv sh
+#!/bin/sh
 
 # dumping ossec.log to standard output
 exec tail -F /var/ossec/logs/ossec.log