Merge pull request #2516 from wazuh/enhancement/wqa2477-bump-bug/2477-test-bumper

Bump bug/2477-test-bumper branch

.env

@@ -1,3 +1,4 @@
 WAZUH_VERSION=5.0.0
 WAZUH_IMAGE_VERSION=5.0.0
 WAZUH_REGISTRY=docker.io
+IMAGE_TAG=5.0.0

.github/workflows/4_build_and_push_images.yml

@@ -0,0 +1,305 @@
+run-name: (4.x) Build and push images - ${{ inputs.dev && 'dev' || 'release' }} - ${{ inputs.id }}
+name: (4.x) Build and push images
+
+on:
+  workflow_dispatch:
+    inputs:
+      image_tag:
+        description: 'Docker image tag'
+        default: '4.14.7'
+        required: true
+      docker_reference:
+        description: 'wazuh-docker reference'
+        required: true
+      filebeat_module_version:
+        description: 'Filebeat module version'
+        default: '0.5'
+        required: true
+        type: string
+      products:
+        description: 'Comma-separated list of the image names to build and push'
+        default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
+        required: false
+        type: string
+      revision:
+        description: 'Package revision'
+        default: '1'
+        required: true
+      id:
+        description: "ID used to identify the workflow uniquely."
+        type: string
+        required: false
+      dev:
+        description: "Add tag suffix '-dev' to the image tag ?"
+        type: boolean
+        default: true
+        required: false
+  workflow_call:
+    inputs:
+      image_tag:
+        description: 'Docker image tag'
+        default: '4.14.7'
+        required: true
+        type: string
+      docker_reference:
+        description: 'wazuh-docker reference'
+        required: false
+        type: string
+      filebeat_module_version:
+        description: 'Filebeat module version'
+        default: '0.5'
+        required: true
+        type: string
+      products:
+        description: 'Comma-separated list of the image names to build and push'
+        default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
+        required: false
+        type: string
+      revision:
+        description: 'Package revision'
+        default: '1'
+        required: true
+        type: string
+      id:
+        description: "ID used to identify the workflow uniquely."
+        type: string
+        required: false
+      dev:
+        description: "Add tag suffix '-dev' to the image tag ?"
+        type: boolean
+        default: false
+        required: false
+
+jobs:
+  setup:
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+
+    permissions:
+      id-token: write
+      contents: read
+
+    env:
+      IMAGE_REGISTRY: ${{ inputs.dev && vars.IMAGE_REGISTRY_DEV || vars.IMAGE_REGISTRY_PROD }}
+      IMAGE_TAG: ${{ inputs.image_tag }}
+      FILEBEAT_MODULE_VERSION: ${{ inputs.filebeat_module_version }}
+      REVISION: ${{ inputs.revision }}
+
+    outputs:
+      WAZUH_COMPONENTS: ${{ steps.compute-outputs.outputs.WAZUH_COMPONENTS }}
+      ALL_PRODUCTS_SELECTED: ${{ steps.compute-outputs.outputs.ALL_PRODUCTS_SELECTED }}
+
+    steps:
+    - name: Print inputs
+      run: |
+        echo "---------------------------------------------"
+        echo "Running 4_build_and_push_images workflow"
+        echo "---------------------------------------------"
+        echo "* BRANCH: ${{ github.ref }}"
+        echo "* COMMIT: ${{ github.sha }}"
+        echo "---------------------------------------------"
+        echo "Inputs provided:"
+        echo "---------------------------------------------"
+        echo "* id: ${{ inputs.id }}"
+        echo "* image_tag: ${{ inputs.image_tag }}"
+        echo "* docker_reference: ${{ inputs.docker_reference }}"
+        echo "* filebeat_module_version: ${{ inputs.filebeat_module_version }}"
+        echo "* products: ${{ inputs.products }}"
+        echo "* revision: ${{ inputs.revision }}"
+        echo "* dev: ${{ inputs.dev }}"
+        echo "---------------------------------------------"
+
+    - name: Set up variables
+      id: compute-outputs
+      run: |
+        # Use the default list if products is empty
+        PRODUCTS="${{ inputs.products }}"
+        if [[ -z "$PRODUCTS" || "$PRODUCTS" == "null" ]]; then
+          PRODUCTS="wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent"
+        fi
+
+        # Check if all 4 core components are present in the string
+          if [[ "$PRODUCTS" == *"wazuh-manager"* && "$PRODUCTS" == *"wazuh-dashboard"* && "$PRODUCTS" == *"wazuh-indexer"* && "$PRODUCTS" == *"wazuh-agent"* ]]; then
+            echo "ALL_PRODUCTS_SELECTED=true" >> $GITHUB_OUTPUT
+          else
+            echo "ALL_PRODUCTS_SELECTED=false" >> $GITHUB_OUTPUT
+          fi
+
+        # Convert to JSON for the matrix (Your existing logic)
+        IFS=',' read -ra COMPONENTS <<< "$PRODUCTS"
+        JSON_ARRAY=$(printf '%s\n' "${COMPONENTS[@]}" | jq -R . | jq -s -c .)
+        echo "WAZUH_COMPONENTS=$JSON_ARRAY" >> $GITHUB_OUTPUT
+
+  build-and-push:
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+
+    permissions:
+      id-token: write
+      contents: read
+
+    needs:
+      - setup
+
+    strategy:
+      fail-fast: false # all jobs will run even if one fails
+      matrix:
+        wazuh_component: ${{ fromJson(needs.setup.outputs.WAZUH_COMPONENTS) }}
+
+    env:
+      IMAGE_REGISTRY: ${{ inputs.dev && vars.IMAGE_REGISTRY_DEV || vars.IMAGE_REGISTRY_PROD }}
+      IMAGE_TAG: ${{ inputs.image_tag }}
+      REVISION: ${{ inputs.revision }}
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+      with:
+        ref: ${{ inputs.docker_reference }}
+
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v4
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v4
+
+    - name: Configure aws credentials
+      if: ${{ inputs.dev == true }}
+      uses: aws-actions/configure-aws-credentials@v6
+      with:
+        role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
+        aws-region: "${{ secrets.AWS_REGION }}"
+
+    - name: Log in to Amazon ECR
+      if: ${{ inputs.dev == true }}
+      uses: aws-actions/amazon-ecr-login@v2
+
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v4
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+    - name: Build Wazuh images
+      run: |
+        IMAGE_TAG="${{ inputs.image_tag }}"
+        FILEBEAT_MODULE_VERSION=${{ inputs.filebeat_module_version }}
+        REVISION=${{ inputs.revision }}
+
+        if [[ "$IMAGE_TAG" == *"-"* ]]; then
+          IFS='-' read -r -a tokens <<< "$IMAGE_TAG"
+          if [ -z "${tokens[1]}" ]; then
+            echo "Invalid image tag: $IMAGE_TAG"
+            exit 1
+          fi
+          DEV_STAGE=${tokens[1]}
+          WAZUH_VER=${tokens[0]}
+          ./build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -f $FILEBEAT_MODULE_VERSION -rg $IMAGE_REGISTRY -m -c ${{ matrix.wazuh_component }}
+        else
+          ./build-images.sh -v $IMAGE_TAG -r $REVISION -f $FILEBEAT_MODULE_VERSION -rg $IMAGE_REGISTRY -m -c ${{ matrix.wazuh_component }}
+        fi
+
+        # Save .env file (generated by build-images.sh) contents to $GITHUB_ENV
+        ENV_FILE_PATH="../.env"
+
+        if [ -f $ENV_FILE_PATH ]; then
+          while IFS= read -r line || [ -n "$line" ]; do
+            echo "$line" >> $GITHUB_ENV
+          done < $ENV_FILE_PATH
+        else
+          echo "The environment file $ENV_FILE_PATH does not exist!"
+          exit 1
+        fi
+      working-directory: ./build-docker-images
+
+
+  notify:
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+    needs: [setup, build-and-push]
+    # Only run if NOT dev AND all products were selected
+    if: ${{ inputs.dev == false && needs.setup.outputs.ALL_PRODUCTS_SELECTED == 'true' }}
+
+    steps:
+    - name: Image exists validation
+      id: validation
+      run: |
+        IMAGE_TAG=${{ inputs.image_tag }}
+        IMAGE_REGISTRY="${{ vars.IMAGE_REGISTRY_PROD }}"
+        PURPOSE=""
+
+        if [[ "$IMAGE_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+          if docker manifest inspect $IMAGE_REGISTRY/wazuh/wazuh-manager:$IMAGE_TAG > /dev/null 2>&1; then
+            PURPOSE="regeneration"
+            echo "Image wazuh/wazuh-manager:$IMAGE_TAG exists. Setting PURPOSE to 'regeneration'"
+          else
+            PURPOSE="new release"
+            echo "Image wazuh/wazuh-manager:$IMAGE_TAG does NOT exist. Setting PURPOSE to 'new release'"
+          fi
+          echo "✅ Release tag: '$IMAGE_TAG'"
+        elif [[ "$IMAGE_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+-(alpha|beta|rc)[0-9]+$ ]]; then
+          PURPOSE="new stage"
+          echo "✅ Stage tag: '$IMAGE_TAG'. Setting PURPOSE to 'new stage'"
+        else
+          echo "❌ No release or stage tag ('$IMAGE_TAG'), the GH issue will not be created"
+        fi
+
+        echo "purpose=$PURPOSE" >> $GITHUB_OUTPUT
+
+    - name: GH issue notification
+      if: ${{ steps.validation.outputs.purpose != '' }}
+      env:
+        GH_TOKEN: ${{ secrets.NOTIFICATION_GH_ARTIFACT_TOKEN }}
+      run: |
+        IMAGE_TAG=${{ inputs.image_tag }}
+        PURPOSE="${{ steps.validation.outputs.purpose }}"
+
+        GH_TITLE=""
+        GH_MESSAGE=""
+
+        ## Setting GH issue title
+        GH_TITLE="Artifactory vulnerabilities update \`v$IMAGE_TAG\`"
+
+        ## Setting GH issue body
+        GH_MESSAGE=$(cat <<- EOF | tr -d '\r' | sed 's/^[[:space:]]*//'
+        ### Description
+        - [ ] Update the [Artifactory vulnerabilities](${{ secrets.NOTIFICATION_SHEET_URL }}) sheet with the \`v$IMAGE_TAG\` vulnerabilities.
+
+        **Purpose**: $PURPOSE
+        >[!NOTE]
+        >To update the \`Tentative Release\` column, follow these steps:
+        https://github.com/wazuh/${{ secrets.NOTIFICATION_REPO }}/issues/2049#issuecomment-2671590268
+        EOF
+        )
+
+        # Print the GH Variables content
+        echo "--- Variable Content ---"
+        echo "$GH_TITLE"
+        echo "------------------------"
+
+        echo "--- Variable Content ---"
+        echo "$GH_MESSAGE"
+        echo "------------------------"
+
+        ## GH issue creation
+        ISSUE_URL=$(gh issue create \
+          -R wazuh/${{ secrets.NOTIFICATION_REPO }} \
+          --title "$GH_TITLE" \
+          --body "$GH_MESSAGE" \
+          --label "level/task" \
+          --label "type/maintenance" \
+          --label "request/operational")
+
+        ## Adding the issue to the team project
+        PROJECT_ITEM_ID=$(gh project item-add \
+          ${{ secrets.NOTIFICATION_PROJECT_NUMBER }} \
+          --url $ISSUE_URL \
+          --owner wazuh \
+          --format json \
+          | jq -r '.id')
+
+          ## Setting Objective
+          gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_OBJECTIVE_ID }} --text  "Security scans"
+          ## Setting Priority
+          gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_PRIORITY_ID }} --single-select-option-id ${{ secrets.NOTIFICATION_PROJECT_PRIORITY_OPTION_ID }}
+          ## Setting Size
+          gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_SIZE_ID }} --single-select-option-id ${{ secrets.NOTIFICATION_PROJECT_SIZE_OPTION_ID }}
+          ## Setting Subteam
+          gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_SUBTEAM_ID }} --single-select-option-id ${{ secrets.NOTIFICATION_PROJECT_SUBTEAM_OPTION_ID }}

.github/workflows/4_bumper_repository.yml

@@ -1,4 +1,4 @@
-name: Repository bumper 4.x
+name: (4.x) Repository bumper
 run-name: Bump ${{ github.ref_name }} (${{ inputs.id }})
 
 on:
@@ -31,7 +31,7 @@ on:
 jobs:
   bump:
     name: Repository bumper 4.x
-    runs-on: ubuntu-24.04
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       contents: write
       pull-requests: write

.github/workflows/4_pr_check.yml

@@ -0,0 +1,383 @@
+name: (4.x) Docker PR check
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches:
+      - 4.*
+    paths:
+      - 'build-docker-images/**'
+      - 'multi-node/**'
+      - 'single-node/**'
+      - 'wazuh-agent/**'
+      - '.github/**'
+
+jobs:
+  build-docker-images:
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+    steps:
+
+    - name: Check out code
+      uses: actions/checkout@v6
+
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v4
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+    - name: Build Wazuh images
+      run: ./build-images.sh
+      working-directory: ./build-docker-images
+
+    - name: Create enviroment variables
+      run: cat .env > $GITHUB_ENV
+
+    - name: Create backup Docker images
+      run: |
+        mkdir -p /home/runner/work/wazuh-docker/wazuh-docker/docker-images/
+        docker save wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar
+        docker save wazuh/wazuh-indexer:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar
+        docker save wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar
+        docker save wazuh/wazuh-agent:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-agent.tar
+
+    - name: Temporarily save Wazuh manager Docker image
+      uses: actions/upload-artifact@v7
+      with:
+        name: docker-artifact-manager
+        path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar
+        retention-days: 1
+
+    - name: Temporarily save Wazuh indexer Docker image
+      uses: actions/upload-artifact@v7
+      with:
+        name: docker-artifact-indexer
+        path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar
+        retention-days: 1
+
+    - name: Temporarily save Wazuh dashboard Docker image
+      uses: actions/upload-artifact@v7
+      with:
+        name: docker-artifact-dashboard
+        path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar
+        retention-days: 1
+
+    - name: Temporarily save Wazuh agent Docker image
+      uses: actions/upload-artifact@v7
+      with:
+        name: docker-artifact-agent
+        path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-agent.tar
+        retention-days: 1
+
+  check-single-node:
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+    needs: build-docker-images
+    steps:
+
+    - name: Check out code
+      uses: actions/checkout@v6
+
+    - name: Create enviroment variables
+      run: cat .env > $GITHUB_ENV
+
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v4
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+    - name: Retrieve saved Wazuh indexer Docker image
+      uses: actions/download-artifact@v8
+      with:
+        name: docker-artifact-indexer
+
+    - name: Retrieve saved Wazuh manager Docker image
+      uses: actions/download-artifact@v8
+      with:
+        name: docker-artifact-manager
+
+    - name: Retrieve saved Wazuh dashboard Docker image
+      uses: actions/download-artifact@v8
+      with:
+        name: docker-artifact-dashboard
+
+    - name: Retrieve saved Wazuh agent Docker image
+      uses: actions/download-artifact@v8
+      with:
+        name: docker-artifact-agent
+
+    - name: Docker load
+      run: |
+        docker load --input ./wazuh-indexer.tar
+        docker load --input ./wazuh-dashboard.tar
+        docker load --input ./wazuh-manager.tar
+        docker load --input ./wazuh-agent.tar
+
+    - name: Create single node certficates
+      run: docker compose -f single-node/generate-indexer-certs.yml run --rm generator
+
+    - name: Start single node stack
+      run: docker compose -f single-node/docker-compose.yml up -d
+
+    - name: Check Wazuh indexer start
+      run: |
+       sleep 60
+       status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`"
+       if [[ $status_green -eq 1 ]]; then
+        curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
+       else
+        curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
+        exit 1
+       fi
+       status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | wc -l`"
+       status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | grep "green" | wc -l`"
+       if [[ $status_index_green -eq $status_index ]]; then
+        curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
+       else
+        curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
+        exit 1
+       fi
+
+
+    - name: Check Wazuh indexer nodes
+      run: |
+       nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:SecretPassword -k -s | grep -E "indexer" | wc -l`"
+       if [[ $nodes -eq 1 ]]; then
+        echo "Wazuh indexer nodes: ${nodes}"
+       else
+        echo "Wazuh indexer nodes: ${nodes}"
+        exit 1
+       fi
+
+    - name: Check Wazuh templates
+      run: |
+       qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`"
+       templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`"
+       if [[ $qty_templates -gt 3 ]]; then
+        echo "wazuh templates:"
+        echo "${templates}"
+       else
+        echo "wazuh templates:"
+        echo "${templates}"
+        exit 1
+       fi
+
+    - name: Check Wazuh manager start
+      run: |
+        services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`"
+        if [[ $services -gt 9 ]]; then
+          echo "Wazuh Manager Services: ${services}"
+          echo "OK"
+        else
+          echo "Wazuh indexer nodes: ${nodes}"
+          curl -k -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items
+          exit 1
+        fi
+      env:
+        TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
+
+    - name: Check filebeat output
+      run: ./.github/single-node-filebeat-check.sh
+
+    - name: Check Wazuh dashboard service URL
+      run: |
+       status=$(curl -XGET --silent  https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I -s | grep -E "^HTTP" | awk  '{print $2}')
+       if [[ $status -eq 200 ]]; then
+        echo "Wazuh dashboard status: ${status}"
+       else
+        echo "Wazuh dashboard status: ${status}"
+        exit 1
+       fi
+
+    - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file
+      run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
+
+    - name: Start Wazuh agent
+      run: docker compose -f wazuh-agent/docker-compose.yml up -d
+
+    - name: Check Wazuh agent enrollment
+      run: |
+        sleep 20
+        curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}"
+      env:
+        TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
+
+    - name: Check documents into wazuh-alerts index
+      run: |
+       sleep 120
+       docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`"
+       if [[ $docs -gt 0 ]]; then
+        echo "wazuh-alerts index documents: ${docs}"
+       else
+        echo "wazuh-alerts index documents: ${docs}"
+        exit 1
+       fi
+
+    - name: Check errors in ossec.log for Wazuh manager
+      run: ./.github/single-node-log-check.sh
+
+  check-multi-node:
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+    needs: build-docker-images
+    steps:
+
+    - name: Check out code
+      uses: actions/checkout@v6
+
+    - name: Create enviroment variables
+      run: cat .env > $GITHUB_ENV
+
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v4
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+    - name: Retrieve saved Wazuh dashboard Docker image
+      uses: actions/download-artifact@v8
+      with:
+        name: docker-artifact-dashboard
+
+    - name: Retrieve saved Wazuh manager Docker image
+      uses: actions/download-artifact@v8
+      with:
+        name: docker-artifact-manager
+
+    - name: Retrieve saved Wazuh indexer Docker image
+      uses: actions/download-artifact@v8
+      with:
+        name: docker-artifact-indexer
+
+    - name: Retrieve saved Wazuh agent Docker image
+      uses: actions/download-artifact@v8
+      with:
+        name: docker-artifact-agent
+
+    - name: Docker load
+      run: |
+        docker load --input ./wazuh-manager.tar
+        docker load --input ./wazuh-indexer.tar
+        docker load --input ./wazuh-dashboard.tar
+        docker load --input ./wazuh-agent.tar
+        rm -rf wazuh-manager.tar wazuh-indexer.tar wazuh-dashboard.tar wazuh-agent.tar
+
+    - name: Create multi node certficates
+      run: docker compose -f multi-node/generate-indexer-certs.yml run --rm generator
+
+    - name: Start multi node stack
+      run: docker compose -f multi-node/docker-compose.yml up -d
+
+    - name: Check Wazuh indexer start
+      run: |
+       until [[ `curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`  -eq 1 ]]
+       do
+         echo 'Waiting for Wazuh indexer start'
+         free -m
+         df -h
+         sleep 120
+       done
+       status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`"
+       if [[ $status_green -eq 1 ]]; then
+        curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
+       else
+        curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
+        exit 1
+       fi
+       status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | wc -l`"
+       status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | grep -E "green" | wc -l`"
+       if [[ $status_index_green -eq $status_index ]]; then
+        curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
+       else
+        curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
+        exit 1
+       fi
+
+    - name: Check Wazuh indexer nodes
+      run: |
+       nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:SecretPassword -k -s | grep -E "indexer" | wc -l`"
+       if [[ $nodes -eq 3 ]]; then
+        echo "Wazuh indexer nodes: ${nodes}"
+       else
+        echo "Wazuh indexer nodes: ${nodes}"
+        exit 1
+       fi
+
+    - name: Check Wazuh templates
+      run: |
+       qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh" | wc -l`"
+       templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh"`"
+       if [[ $qty_templates -gt 3 ]]; then
+        echo "wazuh templates:"
+        echo "${templates}"
+       else
+        echo "wazuh templates:"
+        echo "${templates}"
+        exit 1
+       fi
+
+    - name: Check Wazuh manager start
+      run: |
+        services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`"
+        if [[ $services -gt 10 ]]; then
+          echo "Wazuh Manager Services: ${services}"
+          echo "OK"
+        else
+          echo "Wazuh indexer nodes: ${nodes}"
+          curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items
+          exit 1
+        fi
+        nodes=$(curl -k -s -X GET "https://0.0.0.0:55000/cluster/nodes" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r ".data.affected_items[].name" | wc -l)
+        if [[ $nodes -eq 2 ]]; then
+         echo "Wazuh manager nodes: ${nodes}"
+        else
+         echo "Wazuh manager nodes: ${nodes}"
+         exit 1
+        fi
+      env:
+        TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
+
+    - name: Check filebeat output
+      run: ./.github/multi-node-filebeat-check.sh
+
+    - name: Check Wazuh dashboard service URL
+      run: |
+       status=$(curl -XGET --silent  https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I | grep -E "^HTTP" | awk  '{print $2}')
+       if [[ $status -eq 200 ]]; then
+        echo "Wazuh dashboard status: ${status}"
+       else
+        echo "Wazuh dashboard status: ${status}"
+        exit 1
+       fi
+
+    - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file
+      run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
+
+    - name: Start Wazuh agent
+      run: docker compose -f wazuh-agent/docker-compose.yml up -d
+
+    - name: Check Wazuh agent enrollment
+      run: |
+        sleep 20
+        curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}"
+      env:
+        TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
+
+    - name: Check documents into wazuh-alerts index
+      run: |
+       until [[ $(``curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"``)  -gt 0 ]]
+       do
+         echo 'Waiting for Wazuh indexer events'
+         free -m
+         df -h
+         sleep 10
+       done
+       docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`"
+       if [[ $docs -gt 0 ]]; then
+        echo "wazuh-alerts index documents: ${docs}"
+       else
+        echo "wazuh-alerts index documents: ${docs}"
+        exit 1
+       fi
+
+    - name: Check errors in ossec.log for Wazuh manager
+      run: ./.github/multi-node-log-check.sh

.github/workflows/5_build_and_push_images.yml

@@ -1,5 +1,5 @@
-run-name: Launch Push Docker Images - ${{ inputs.id }}
-name: Push Docker Images
+run-name: Build and push images 8.x - ${{ inputs.dev && 'dev' || 'release' }} - ${{ inputs.id }}
+name: (8.x) Build and push images
 
 on:
   workflow_dispatch:
@@ -14,7 +14,7 @@ on:
       wazuh_automation_reference:
         description: 'Branch or tag of the wazuh-automation repository'
         required: false
-        default: 'main'
+        default: '5.0.0'
       products:
         description: 'Comma-separated list of the image names to build and push'
         default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
@@ -52,7 +52,7 @@ on:
       wazuh_automation_reference:
         description: 'Branch or tag of the wazuh-automation repository'
         required: false
-        default: 'main'
+        default: '5.0.0'
         type: string
       products:
         description: 'Comma-separated list of the image names to build and push'
@@ -84,8 +84,7 @@ permissions:
 
 jobs:
   setup:
-    runs-on:
-      group: wz-linux-amd64
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
 
     outputs:
       WAZUH_COMPONENTS: ${{ steps.compute-outputs.outputs.WAZUH_COMPONENTS }}
@@ -96,7 +95,7 @@ jobs:
     - name: Print inputs
       run: |
         echo "---------------------------------------------"
-        echo "Running Procedure_push_docker_images workflow"
+        echo "Running 5_build_and_push_images workflow"
         echo "---------------------------------------------"
         echo "* BRANCH: ${{ github.ref }}"
         echo "* COMMIT: ${{ github.sha }}"
@@ -115,9 +114,13 @@ jobs:
 
     - name: Set up variables
       id: compute-outputs
+      env:
+        PRODUCTS_INPUT: ${{ inputs.products }}
+        DEV_INPUT: ${{ inputs.dev }}
+        COMMIT_LIST_INPUT: ${{ inputs.commit_list }}
       run: |
         # Use the default list if products is empty
-        PRODUCTS="${{ inputs.products }}"
+        PRODUCTS="$PRODUCTS_INPUT"
         if [[ -z "$PRODUCTS" || "$PRODUCTS" == "null" ]]; then
           PRODUCTS="wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent"
         fi
@@ -135,9 +138,9 @@ jobs:
 
         # Set COMMIT_LIST
         WC_COMMIT_LIST=""
-        if [[ "${{ inputs.dev }}" == "true" ]]; then
-          if [[ "${{ inputs.commit_list }}" != "null" && "${{ inputs.commit_list }}" != "" ]]; then
-            WC_COMMIT_LIST='${{ inputs.commit_list }}'
+        if [[ "$DEV_INPUT" == "true" ]]; then
+          if [[ "$COMMIT_LIST_INPUT" != "null" && "$COMMIT_LIST_INPUT" != "" ]]; then
+            WC_COMMIT_LIST="$COMMIT_LIST_INPUT"
           else
             # Set commit list to "latest" for all components using WAZUH_COMPONENTS
             COMPONENTS=($(echo "$WC_JSON_ARRAY" | jq -r '.[]'))
@@ -156,8 +159,7 @@ jobs:
 
   package-urls:
     name: generate package urls
-    runs-on:
-      group: wz-linux-amd64
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
     needs: setup
 
     env:
@@ -174,6 +176,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: ${{ inputs.docker_reference }}
+          persist-credentials: false
 
       - name: Checkout wazuh/wazuh-automation repository
         if: ${{ inputs.dev == true }}
@@ -183,6 +186,7 @@ jobs:
           ref: ${{ inputs.wazuh_automation_reference }}
           token: ${{ secrets.GH_CLONE_TOKEN }}
           path: wazuh-automation
+          persist-credentials: false
 
       - name: Configure AWS credentials
         if: ${{ inputs.dev == true }}
@@ -215,11 +219,15 @@ jobs:
         if: ${{ inputs.dev == true }}
         run: |
           WAZUH_VERSION=$(jq -r '.version' VERSION.json)
+          if ! [[ "$WAZUH_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Invalid version format: $WAZUH_VERSION"
+            exit 1
+          fi
           WAZUH_MAJOR=$(echo "$WAZUH_VERSION" | cut -d '.' -f 1)
           WAZUH_MINOR=$(echo "$WAZUH_VERSION" | cut -d '.' -f 1-2)
-          echo WAZUH_VERSION=$WAZUH_VERSION >> $GITHUB_ENV
-          echo WAZUH_MAJOR=$WAZUH_MAJOR >> $GITHUB_ENV
-          echo WAZUH_MINOR=$WAZUH_MINOR >> $GITHUB_ENV
+          echo "WAZUH_VERSION=$WAZUH_VERSION" >> $GITHUB_ENV
+          echo "WAZUH_MAJOR=$WAZUH_MAJOR" >> $GITHUB_ENV
+          echo "WAZUH_MINOR=$WAZUH_MINOR" >> $GITHUB_ENV
 
       - name: Get artifacts URLs file
         if: ${{ inputs.dev == true }}
@@ -229,13 +237,14 @@ jobs:
 
       - name: Generate presigned URLs for artifacts for dev packages
         if: ${{ inputs.dev == true }}
+        env:
+          WAZUH_COMPONENTS: ${{ needs.setup.outputs.WAZUH_COMPONENTS }}
+          COMMIT_LIST: ${{ needs.setup.outputs.COMMIT_LIST }}
         run: |
-          source ${{ env.WORKFLOW_VENV }}/bin/activate
-          WAZUH_COMPONENTS='${{ needs.setup.outputs.WAZUH_COMPONENTS }}'
-          COMMIT_LIST='${{ needs.setup.outputs.COMMIT_LIST }}'
-          SCRIPT_PARAMS="--process ${{ env.PRESIGNED_URLS_SCRIPT_PROCESS }} \
-                            --wazuh-version ${{ env.WAZUH_VERSION }} \
-                            --aws-s3-bucket-dev ${{ env.LOCAL_AWS_S3_BUCKET_DEV }} \
+          source "$WORKFLOW_VENV/bin/activate"
+          SCRIPT_PARAMS="--process $PRESIGNED_URLS_SCRIPT_PROCESS \
+                            --wazuh-version $WAZUH_VERSION \
+                            --aws-s3-bucket-dev $LOCAL_AWS_S3_BUCKET_DEV \
                             --assistant-revision $ASSISTANT_REVISION "
 
 
@@ -270,7 +279,7 @@ jobs:
           esac
           done
 
-          python ${{ env.GENERATE_PRESIGNED_URLS_SCRIPT_PATH }} \
+          python "$GENERATE_PRESIGNED_URLS_SCRIPT_PATH" \
               $SCRIPT_PARAMS
 
       - name: Save presigned URLs file to artifact
@@ -281,8 +290,7 @@ jobs:
           path: ${{ env.LOCAL_ARTIFACT_URLS_FILEPATH }}
 
   build-and-push:
-    runs-on:
-      group: wz-linux-amd64
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
 
     needs:
       - setup
@@ -302,6 +310,13 @@ jobs:
       uses: actions/checkout@v6
       with:
         ref: ${{ inputs.docker_reference }}
+        persist-credentials: false
+
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v4
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
     - name: Set up QEMU
       uses: docker/setup-qemu-action@v4
@@ -320,13 +335,6 @@ jobs:
       if: ${{ inputs.dev == true }}
       uses: aws-actions/amazon-ecr-login@v2
 
-    - name: Log in to Docker Hub
-      if: ${{ inputs.dev == false }}
-      uses: docker/login-action@v4
-      with:
-        username: ${{ secrets.DOCKERHUB_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_PASSWORD }}
-
     - name: Download artifact_urls.yaml (dev)
       if: ${{ inputs.dev == true }}
       uses: actions/download-artifact@v4
@@ -336,11 +344,11 @@ jobs:
 
     - name: Compute component reference (dev)
       if: ${{ inputs.dev == true }}
+      env:
+        COMPONENT: ${{ matrix.wazuh_component }}
+        WAZUH_COMPONENTS: ${{ needs.setup.outputs.WAZUH_COMPONENTS }}
+        COMMIT_LIST: ${{ needs.setup.outputs.COMMIT_LIST }}
       run: |
-        COMPONENT='${{ matrix.wazuh_component }}'
-        WAZUH_COMPONENTS='${{ needs.setup.outputs.WAZUH_COMPONENTS }}'
-        COMMIT_LIST='${{ needs.setup.outputs.COMMIT_LIST }}'
-
         idx=$(jq -r --arg c "$COMPONENT" 'index($c)' <<<"$WAZUH_COMPONENTS")
         ref=$(jq -r --argjson i "$idx" '.[ $i ]' <<<"$COMMIT_LIST")
 
@@ -348,6 +356,9 @@ jobs:
         echo "Using component ref for $COMPONENT: $ref"
 
     - name: Build Wazuh images
+      env:
+        DEV: ${{ inputs.dev }}
+        WAZUH_COMPONENT: ${{ matrix.wazuh_component }}
       run: |
         if [[ "$IMAGE_TAG" == *"-"* ]]; then
           IFS='-' read -r -a tokens <<< "$IMAGE_TAG"
@@ -357,7 +368,7 @@ jobs:
           fi
           DEV_STAGE=${tokens[1]}
           WAZUH_VER=${tokens[0]}
-          if [ "${{ inputs.dev }}" = true ]; then
+          if [ "$DEV" = true ]; then
             ./build-images.sh \
               -v $WAZUH_VER \
               -d $DEV_STAGE \
@@ -365,30 +376,30 @@ jobs:
               -m \
               --dev \
               -refs "$COMPONENT_REFS_JSON" \
-              -c ${{ matrix.wazuh_component }}
+              -c $WAZUH_COMPONENT
           else
             ./build-images.sh \
               -v $WAZUH_VER \
               -d $DEV_STAGE \
               -rg $IMAGE_REGISTRY \
               -m \
-              -c ${{ matrix.wazuh_component }}
+              -c $WAZUH_COMPONENT
           fi
         else
-          if [ "${{ inputs.dev }}" = true ]; then
+          if [ "$DEV" = true ]; then
             ./build-images.sh \
               -v $IMAGE_TAG \
               -rg $IMAGE_REGISTRY \
               -m \
               --dev \
               -refs "$COMPONENT_REFS_JSON" \
-              -c ${{ matrix.wazuh_component }}
+              -c $WAZUH_COMPONENT
           else
             ./build-images.sh \
               -v $IMAGE_TAG \
               -rg $IMAGE_REGISTRY \
               -m \
-              -c ${{ matrix.wazuh_component }}
+              -c $WAZUH_COMPONENT
           fi
         fi
         # Save .env file (generated by build-images.sh) contents to $GITHUB_ENV
@@ -406,7 +417,7 @@ jobs:
 
 
   notify:
-    runs-on: ubuntu-22.04
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
     needs: [setup, build-and-push]
     # Only run if NOT dev AND all products were selected
     if: ${{ inputs.dev == false && needs.setup.outputs.ALL_PRODUCTS_SELECTED == 'true' }}
@@ -414,9 +425,10 @@ jobs:
     steps:
     - name: Image exists validation
       id: validation
+      env:
+        IMAGE_TAG: ${{ inputs.image_tag }}
+        IMAGE_REGISTRY: ${{ vars.IMAGE_REGISTRY_PROD }}
       run: |
-        IMAGE_TAG=${{ inputs.image_tag }}
-        IMAGE_REGISTRY="${{ vars.IMAGE_REGISTRY_PROD }}"
         PURPOSE=""
 
         if [[ "$IMAGE_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
@@ -441,9 +453,9 @@ jobs:
       if: ${{ steps.validation.outputs.purpose != '' }}
       env:
         GH_TOKEN: ${{ secrets.NOTIFICATION_GH_ARTIFACT_TOKEN }}
+        IMAGE_TAG: ${{ inputs.image_tag }}
+        PURPOSE: ${{ steps.validation.outputs.purpose }}
       run: |
-        IMAGE_TAG=${{ inputs.image_tag }}
-        PURPOSE="${{ steps.validation.outputs.purpose }}"
 
         GH_TITLE=""
         GH_MESSAGE=""

.github/workflows/5_bumper_repository.yml

@@ -1,4 +1,4 @@
-name: Repository bumper 5.x
+name: (5.x) Repository bumper
 run-name: Bump ${{ github.ref_name }} (${{ inputs.id }})
 
 on:
@@ -40,7 +40,7 @@ on:
 jobs:
   bump:
     name: Repository bumper 5.x
-    runs-on: ubuntu-24.04
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       contents: write
       pull-requests: write
@@ -96,18 +96,24 @@ jobs:
           version=${{ env.VERSION }}
           stage=${{ env.STAGE }}
           tag=${{ env.TAG }}
-
           set_as_main=${{ inputs.set_as_main }}
 
-          if [[ "$set_as_main" == "true" ]]; then
-            script_params="--set-as-main"
+          if [[ -n "$version" && -n "$stage" && "$tag" != "true" ]]; then
+            script_params="--version ${version} --stage ${stage}"
+          elif [[ -n "$version" && -n "$stage" && "$tag" == "true" ]]; then
+            script_params="--version ${version} --stage ${stage} --tag"
+          elif [[ -z "$version" && -n "$stage" && "$tag" == "true" ]]; then
+            script_params="--stage ${stage} --tag"
+          elif [[ -z "$version" && -z "$stage" && "$tag" == "true" ]]; then
+            script_params="--tag"
           fi
 
-          # Both version and stage provided
-          if [[ -n "$version" && -n "$stage" && "$tag" != "true" ]]; then
-            script_params+=" --version ${version} --stage ${stage}"
-          elif [[ -n "$version" && -n "$stage" && "$tag" == "true" ]]; then
-            script_params+=" --version ${version} --stage ${stage} --tag ${tag}"
+          if [[ "$set_as_main" == "true" ]]; then
+            if [[ -z "$version" || -z "$stage" ]]; then
+              echo "Error: set_as_main requires both version and stage inputs."
+              exit 1
+            fi
+            script_params="${script_params} --set-as-main"
           fi
 
           issue_number=$(echo "${{ inputs.issue-link }}" | awk -F'/' '{print $NF}')

.github/workflows/5_check_integration_tools.yml

@@ -0,0 +1,881 @@
+run-name: >-
+  ${{ github.event_name == 'workflow_dispatch'
+    && format('Docker Integration Test - Manual {0} on {1}', inputs.deployment_type, inputs.pr_head_ref)
+    || format('Docker Integration Test - #{0} {1}', github.event.issue.number, github.event.issue.title) }}
+name: (8.x) PR Check - Docker Integration Tests
+
+on:
+  issue_comment:
+    types: [created]
+  workflow_dispatch:
+    inputs:
+      pr_head_ref:
+        description: 'Branch of wazuh-docker to test'
+        required: true
+        type: string
+      automation_reference:
+        description: 'Branch of wazuh-automation to use'
+        required: false
+        default: '5.0.0'
+        type: string
+      deployment_type:
+        description: 'Deployment type to test'
+        required: true
+        type: choice
+        options:
+          - single-node
+          - multi-node
+          - both
+      version:
+        description: 'Image version to test (e.g. 5.0.0).'
+        required: false
+        type: string
+      stage:
+        description: 'Image stage suffix (e.g. beta1, beta2-latest, beta2-<commit>). Required when version is set.'
+        required: false
+        type: string
+      registry:
+        description: 'Docker registry. ECR for dev versions, DockerHub for prod versions.'
+        required: false
+        type: choice
+        options:
+          - ECR
+          - DockerHub
+
+permissions:
+  id-token: write
+  contents: read
+  pull-requests: write
+  issues: write
+  checks: write
+
+env:
+  AUTOMATION_REFERENCE: ${{ inputs.automation_reference || 'main' }}
+  ALLOCATOR_PATH: /tmp/allocator_instance
+  REGION: us-east-1
+
+jobs:
+  # -------------------------------------------------------------------------
+  # Job 1: Parse PR info and determine which deployment(s) to test
+  #
+  # Available commands:
+  #   /test-docker-single  — test single-node deployment
+  #   /test-docker-multi   — test multi-node deployment
+  #   /test-docker         — test both single-node and multi-node
+  # -------------------------------------------------------------------------
+  get_pr_info:
+    if: |
+      github.event_name == 'issue_comment' &&
+      github.event.issue.pull_request &&
+      github.event.issue.state == 'open' &&
+      !github.event.issue.draft &&
+      (contains(github.event.comment.body, '/test-docker-single') ||
+       contains(github.event.comment.body, '/test-docker-multi') ||
+       contains(github.event.comment.body, '/test-docker'))
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+    outputs:
+      pr_number: ${{ steps.pr_data.outputs.pr_number }}
+      pr_head_ref: ${{ steps.pr_data.outputs.pr_head_ref }}
+      pr_head_sha: ${{ steps.pr_data.outputs.pr_head_sha }}
+      check_run_id: ${{ steps.create_check.outputs.result }}
+      deployment_matrix: ${{ steps.parse_command.outputs.deployment_matrix }}
+      check_name: ${{ steps.parse_command.outputs.check_name }}
+
+    steps:
+      - name: React to comment
+        uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.reactions.createForIssueComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              comment_id: context.payload.comment.id,
+              content: 'rocket'
+            });
+
+      - name: Extract PR data
+        id: pr_data
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          PR_NUMBER="${{ github.event.issue.number }}"
+          PR_DATA=$(gh api repos/${{ github.repository }}/pulls/${PR_NUMBER})
+          PR_HEAD_REF=$(echo "$PR_DATA" | jq -r '.head.ref')
+          PR_HEAD_SHA=$(echo "$PR_DATA" | jq -r '.head.sha')
+          echo "pr_number=${PR_NUMBER}" >> $GITHUB_OUTPUT
+          echo "pr_head_ref=${PR_HEAD_REF}" >> $GITHUB_OUTPUT
+          echo "pr_head_sha=${PR_HEAD_SHA}" >> $GITHUB_OUTPUT
+
+      - name: Parse command and set deployment metadata
+        id: parse_command
+        env:
+          COMMENT_BODY: ${{ github.event.comment.body }}
+        run: |
+          if echo "$COMMENT_BODY" | grep -q '/test-docker-single'; then
+            echo 'deployment_matrix=["single-node"]'                >> $GITHUB_OUTPUT
+            echo 'check_name=Docker Integration Check (Single-Node)' >> $GITHUB_OUTPUT
+          elif echo "$COMMENT_BODY" | grep -q '/test-docker-multi'; then
+            echo 'deployment_matrix=["multi-node"]'                 >> $GITHUB_OUTPUT
+            echo 'check_name=Docker Integration Check (Multi-Node)'  >> $GITHUB_OUTPUT
+          elif echo "$COMMENT_BODY" | grep -q '/test-docker'; then
+            echo 'deployment_matrix=["single-node","multi-node"]'   >> $GITHUB_OUTPUT
+            echo 'check_name=Docker Integration Check'               >> $GITHUB_OUTPUT
+          fi
+
+      - name: Create check run
+        id: create_check
+        uses: actions/github-script@v7
+        env:
+          HEAD_SHA: ${{ steps.pr_data.outputs.pr_head_sha }}
+          CHECK_NAME: ${{ steps.parse_command.outputs.check_name }}
+          COMMENT_BODY: ${{ github.event.comment.body }}
+        with:
+          script: |
+            const { data: check } = await github.rest.checks.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              name: process.env.CHECK_NAME,
+              head_sha: process.env.HEAD_SHA,
+              status: 'in_progress',
+              started_at: new Date().toISOString(),
+              details_url: `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
+              output: {
+                title: `🔨 Running ${process.env.CHECK_NAME}...`,
+                summary: `Triggered by comment: \`${process.env.COMMENT_BODY}\``,
+                text: 'Allocating instance and running Docker integration tests'
+              }
+            });
+            console.log('Check run created:', check.id);
+            return check.id;
+
+  # -------------------------------------------------------------------------
+  # Job 2: Prepare context (pr_head_ref + deployment matrix) for both triggers.
+  # -------------------------------------------------------------------------
+  prepare:
+    needs: [get_pr_info]
+    if: |
+      always() &&
+      (needs.get_pr_info.result == 'success' || github.event_name == 'workflow_dispatch')
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+    outputs:
+      pr_head_ref: ${{ steps.ctx.outputs.pr_head_ref }}
+      deployment_matrix: ${{ steps.ctx.outputs.deployment_matrix }}
+      wazuh_version: ${{ steps.version.outputs.wazuh_version }}
+      wazuh_stage: ${{ steps.version.outputs.wazuh_stage }}
+
+    steps:
+      - name: Resolve context
+        id: ctx
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "pr_head_ref=${{ inputs.pr_head_ref }}" >> $GITHUB_OUTPUT
+            DEPLOY_TYPE="${{ inputs.deployment_type }}"
+            if [ "$DEPLOY_TYPE" = "both" ]; then
+              echo 'deployment_matrix=["single-node","multi-node"]' >> $GITHUB_OUTPUT
+            else
+              echo "deployment_matrix=[\"${DEPLOY_TYPE}\"]" >> $GITHUB_OUTPUT
+            fi
+          else
+            echo "pr_head_ref=${{ needs.get_pr_info.outputs.pr_head_ref }}" >> $GITHUB_OUTPUT
+            echo "deployment_matrix=${{ needs.get_pr_info.outputs.deployment_matrix }}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Checkout wazuh-docker PR branch (VERSION.json only)
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ steps.ctx.outputs.pr_head_ref }}
+          sparse-checkout: |
+            VERSION.json
+          sparse-checkout-cone-mode: false
+
+      - name: Read version info from VERSION.json
+        id: version
+        run: |
+          VERSION=$(python3 -c "import json; d=json.load(open('VERSION.json')); print(d['version'])")
+          STAGE=$(python3 -c "import json; d=json.load(open('VERSION.json')); print(d.get('stage',''))")
+          echo "wazuh_version=${VERSION}" >> $GITHUB_OUTPUT
+          echo "wazuh_stage=${STAGE}"     >> $GITHUB_OUTPUT
+          echo "Version: ${VERSION}  Stage: ${STAGE:-<release>}"
+
+      - name: Show test plan
+        run: |
+          WAZUH_VERSION="${{ steps.version.outputs.wazuh_version }}"
+          WAZUH_STAGE="${{ steps.version.outputs.wazuh_stage }}"
+          INPUT_VERSION="${{ inputs.version }}"
+          INPUT_STAGE="${{ inputs.stage }}"
+          INPUT_REGISTRY="${{ inputs.registry }}"
+
+          # Determine effective case
+          if [ -z "$INPUT_VERSION" ] && [ -z "$INPUT_STAGE" ]; then
+            DOCKER_VERSION="$WAZUH_VERSION"
+            DOCKER_STAGE_DISPLAY="${WAZUH_STAGE}"
+            if [ "$INPUT_REGISTRY" = "ECR" ] || [ "${{ github.event_name }}" = "issue_comment" ]; then
+              CASE="a.1 — No version/stage → BUILD images from PR → push to ECR"
+              ACTION="BUILD + push to ECR"
+              EFFECTIVE_TAG="${DOCKER_VERSION}${DOCKER_STAGE_DISPLAY:+-${DOCKER_STAGE_DISPLAY}}-latest"
+              EFFECTIVE_REGISTRY="ECR (${{ vars.IMAGE_REGISTRY_DEV }})"
+            else
+              CASE="a.2 — No version/stage → PULL from DockerHub"
+              ACTION="PULL (no build)"
+              EFFECTIVE_TAG="${DOCKER_VERSION}${DOCKER_STAGE_DISPLAY:+-${DOCKER_STAGE_DISPLAY}}"
+              EFFECTIVE_REGISTRY="DockerHub (${{ vars.IMAGE_REGISTRY_PROD }})"
+            fi
+          elif [ -n "$INPUT_VERSION" ] && [ -z "$INPUT_STAGE" ]; then
+            DOCKER_VERSION="$INPUT_VERSION"
+            ACTION="PULL (no build)"
+            if [ "$INPUT_REGISTRY" = "ECR" ]; then
+              CASE="b.1 — Version only, ECR → tag = version-latest"
+              EFFECTIVE_TAG="${DOCKER_VERSION}-latest"
+              EFFECTIVE_REGISTRY="ECR (${{ vars.IMAGE_REGISTRY_DEV }})"
+            else
+              CASE="b.2 — Version only, DockerHub → tag = version"
+              EFFECTIVE_TAG="${DOCKER_VERSION}"
+              EFFECTIVE_REGISTRY="DockerHub (${{ vars.IMAGE_REGISTRY_PROD }})"
+            fi
+          else
+            CASE="c — Version + stage provided as-is (no -latest appended)"
+            ACTION="PULL (no build)"
+            DOCKER_VERSION="${INPUT_VERSION:-${WAZUH_VERSION}}"
+            EFFECTIVE_TAG="${DOCKER_VERSION}-${INPUT_STAGE}"
+            if [ "$INPUT_REGISTRY" = "ECR" ]; then
+              EFFECTIVE_REGISTRY="ECR (${{ vars.IMAGE_REGISTRY_DEV }})"
+            else
+              EFFECTIVE_REGISTRY="DockerHub (${{ vars.IMAGE_REGISTRY_PROD }})"
+            fi
+          fi
+
+          # Log to stdout
+          echo "============================================="
+          echo "  DOCKER INTEGRATION TEST PLAN"
+          echo "============================================="
+          echo "Branch:        ${{ steps.ctx.outputs.pr_head_ref }}"
+          echo "Trigger:       ${{ github.event_name }}"
+          echo "Deployments:   ${{ steps.ctx.outputs.deployment_matrix }}"
+          echo "Case:          ${CASE}"
+          echo "Action:        ${ACTION}"
+          echo "Registry:      ${EFFECTIVE_REGISTRY}"
+          echo "Image tag:     ${EFFECTIVE_TAG}"
+          echo "Example:       wazuh/wazuh-manager:${EFFECTIVE_TAG}"
+          echo "============================================="
+
+          # Write to step summary
+          {
+            echo "## Docker Integration Test Plan"
+            echo ""
+            echo "| | |"
+            echo "|---|---|"
+            echo "| **Branch** | \`${{ steps.ctx.outputs.pr_head_ref }}\` |"
+            echo "| **Trigger** | \`${{ github.event_name }}\` |"
+            echo "| **Deployments** | \`${{ steps.ctx.outputs.deployment_matrix }}\` |"
+            echo "| **Case** | ${CASE} |"
+            echo "| **Action** | ${ACTION} |"
+            echo ""
+            echo "### Image configuration"
+            echo ""
+            echo "| | |"
+            echo "|---|---|"
+            echo "| **Registry** | ${EFFECTIVE_REGISTRY} |"
+            echo "| **Tag** | \`${EFFECTIVE_TAG}\` |"
+            echo "| **Example image** | \`wazuh/wazuh-manager:${EFFECTIVE_TAG}\` |"
+            echo ""
+            echo "### Parameters"
+            echo ""
+            echo "| | |"
+            echo "|---|---|"
+            echo "| **VERSION.json version** | \`${WAZUH_VERSION}\` |"
+            echo "| **VERSION.json stage** | \`${WAZUH_STAGE:-<release>}\` |"
+            echo "| **Input version** | \`${INPUT_VERSION:-<not set>}\` |"
+            echo "| **Input stage** | \`${INPUT_STAGE:-<not set>}\` |"
+            echo "| **Input registry** | \`${INPUT_REGISTRY:-<not set>}\` |"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  # -------------------------------------------------------------------------
+  # Job 3: Build Docker images (only for ECR, when no explicit version/stage provided).
+  #         Calls 5_build_and_push_images.yml and pushes to the dev registry.
+  # -------------------------------------------------------------------------
+  build_images:
+    name: Build Docker images
+    needs: [prepare]
+    if: |
+      always() &&
+      needs.prepare.result == 'success' &&
+      inputs.version == '' &&
+      inputs.stage == '' &&
+      (inputs.registry == 'ECR' || github.event_name == 'issue_comment')
+    uses: ./.github/workflows/5_build_and_push_images.yml
+    with:
+      image_tag: "${{ needs.prepare.outputs.wazuh_version }}-${{ needs.prepare.outputs.wazuh_stage }}"
+      docker_reference: ${{ needs.prepare.outputs.pr_head_ref }}
+      wazuh_automation_reference: ${{ inputs.automation_reference || 'main' }}
+      products: "wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent"
+      dev: true
+      id: "docker-integration-${{ github.run_id }}"
+    secrets: inherit
+
+  # -------------------------------------------------------------------------
+  # Job 4: For each deployment type — provision VM, deploy Docker stack, test,
+  #         collect results, and clean up.
+  # -------------------------------------------------------------------------
+  docker_test:
+    needs: [get_pr_info, prepare, build_images]
+    if: |
+      always() &&
+      needs.prepare.result == 'success' &&
+      (needs.build_images.result == 'success' || needs.build_images.result == 'skipped')
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+    strategy:
+      fail-fast: false
+      matrix:
+        deployment_type: ${{ fromJSON(needs.prepare.outputs.deployment_matrix) }}
+
+    steps:
+      # -----------------------------------------------------------------------
+      # Setup
+      # -----------------------------------------------------------------------
+      - name: Checkout wazuh-automation
+        uses: actions/checkout@v6
+        with:
+          repository: wazuh/wazuh-automation
+          ref: ${{ env.AUTOMATION_REFERENCE }}
+          token: ${{ secrets.GH_CLONE_TOKEN }}
+          path: wazuh-automation
+
+      - name: Checkout wazuh-docker PR branch
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.prepare.outputs.pr_head_ref }}
+          path: wazuh-docker
+
+      - name: Resolve image configuration
+        run: |
+          WAZUH_VERSION="${{ needs.prepare.outputs.wazuh_version }}"
+          WAZUH_STAGE="${{ needs.prepare.outputs.wazuh_stage }}"
+          INPUT_VERSION="${{ inputs.version }}"
+          INPUT_STAGE="${{ inputs.stage }}"
+
+          # Map registry choice to actual URL (defined once)
+          if [ "${{ inputs.registry }}" = "ECR" ]; then
+            SELECTED_REGISTRY="${{ vars.IMAGE_REGISTRY_DEV }}"
+          else
+            SELECTED_REGISTRY="${{ vars.IMAGE_REGISTRY_PROD }}"
+          fi
+
+          if [ -z "$INPUT_VERSION" ] && [ -z "$INPUT_STAGE" ]; then
+            DOCKER_VERSION="$WAZUH_VERSION"
+            DOCKER_STAGE="$WAZUH_STAGE"
+            if [ "${{ inputs.registry }}" = "ECR" ] || [ "${{ github.event_name }}" = "issue_comment" ]; then
+              # Case a.1: ECR / PR comment — images were built by build_images job → tag = version-stage-latest
+              DOCKER_REGISTRY="${{ vars.IMAGE_REGISTRY_DEV }}"
+              DOCKER_TAG="${DOCKER_VERSION}${DOCKER_STAGE:+-${DOCKER_STAGE}}-latest"
+            else
+              DOCKER_REGISTRY="${{ vars.IMAGE_REGISTRY_PROD }}"
+              DOCKER_TAG="${DOCKER_VERSION}${DOCKER_STAGE:+-${DOCKER_STAGE}}"
+            fi
+          elif [ -n "$INPUT_VERSION" ] && [ -z "$INPUT_STAGE" ]; then
+            DOCKER_VERSION="$INPUT_VERSION"
+            DOCKER_STAGE=""
+            DOCKER_REGISTRY="$SELECTED_REGISTRY"
+            if [ "${{ inputs.registry }}" = "ECR" ]; then
+              DOCKER_TAG="${DOCKER_VERSION}-latest"
+            else
+              DOCKER_TAG="${DOCKER_VERSION}"
+            fi
+          else
+            DOCKER_VERSION="${INPUT_VERSION:-${WAZUH_VERSION}}"
+            DOCKER_STAGE="$INPUT_STAGE"
+            DOCKER_REGISTRY="$SELECTED_REGISTRY"
+            DOCKER_TAG="${DOCKER_VERSION}-${DOCKER_STAGE}"
+          fi
+
+          echo "WAZUH_VERSION=${WAZUH_VERSION}"     >> $GITHUB_ENV
+          echo "WAZUH_STAGE=${WAZUH_STAGE}"         >> $GITHUB_ENV
+          echo "DOCKER_VERSION=${DOCKER_VERSION}"   >> $GITHUB_ENV
+          echo "DOCKER_STAGE=${DOCKER_STAGE}"       >> $GITHUB_ENV
+          echo "DOCKER_REGISTRY=${DOCKER_REGISTRY}" >> $GITHUB_ENV
+          echo "DOCKER_TAG=${DOCKER_TAG}"           >> $GITHUB_ENV
+
+          echo "=== Resolved image configuration ==="
+          echo "Registry: ${DOCKER_REGISTRY}"
+          echo "Tag:      ${DOCKER_TAG}"
+          echo "Example:  wazuh/wazuh-manager:${DOCKER_TAG}"
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install requirements
+        run: |
+          pip install -r wazuh-automation/deployability/deps/requirements.txt
+          pip install -r wazuh-automation/integration-test-module/requirements.txt
+          pip install -e wazuh-automation/integration-test-module/
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
+          role-session-name: docker-test-${{ github.run_id }}-${{ matrix.deployment_type }}
+          aws-region: ${{ env.REGION }}
+
+      # -----------------------------------------------------------------------
+      # Provision: allocate VM and extract SSH credentials
+      # -----------------------------------------------------------------------
+      - name: Allocate instance
+        id: allocate
+        run: |
+          mkdir -p ${{ env.ALLOCATOR_PATH }}
+          python3 wazuh-automation/deployability/modules/allocation/main.py \
+            --action create \
+            --provider aws \
+            --size large \
+            --composite-name ubuntu-24-amd64 \
+            --working-dir ${{ env.ALLOCATOR_PATH }} \
+            --track-output ${{ env.ALLOCATOR_PATH }}/track.yml \
+            --inventory-output ${{ env.ALLOCATOR_PATH }}/inventory.yml \
+            --instance-name gha_${{ github.run_id }}_docker_${{ matrix.deployment_type }} \
+            --label-team devops \
+            --label-termination-date 1d
+
+          sed -n '/hosts:/,/^[^ ]/p' ${{ env.ALLOCATOR_PATH }}/inventory.yml \
+            | grep "ansible_" \
+            | sed 's/^[ ]*//g' \
+            > ${{ env.ALLOCATOR_PATH }}/inventory_vars_raw.yml
+          sed 's/: */=/g' ${{ env.ALLOCATOR_PATH }}/inventory_vars_raw.yml \
+            > ${{ env.ALLOCATOR_PATH }}/inventory_vars.yml
+          sed -i 's/-o StrictHostKeyChecking=no/"-o StrictHostKeyChecking=no"/g' \
+            ${{ env.ALLOCATOR_PATH }}/inventory_vars.yml
+
+      - name: Set SSH credentials from inventory
+        run: |
+          find ${{ env.ALLOCATOR_PATH }} -name '*-key-*' -exec chmod 600 {} \;
+          source ${{ env.ALLOCATOR_PATH }}/inventory_vars.yml
+          echo "SSH_HOST=$ansible_host"                >> $GITHUB_ENV
+          echo "SSH_PORT=$ansible_port"                >> $GITHUB_ENV
+          echo "SSH_USER=$ansible_user"                >> $GITHUB_ENV
+          echo "SSH_KEY=$ansible_ssh_private_key_file" >> $GITHUB_ENV
+
+      - name: Set SSH/SCP helper env vars
+        run: |
+          echo "SSH_OPTS=-o StrictHostKeyChecking=no -o ServerAliveInterval=60 -o ServerAliveCountMax=20 -p ${{ env.SSH_PORT }} -i ${{ env.SSH_KEY }}" >> $GITHUB_ENV
+          echo "SCP_OPTS=-o StrictHostKeyChecking=no -P ${{ env.SSH_PORT }} -i ${{ env.SSH_KEY }}"                                                      >> $GITHUB_ENV
+          echo "REMOTE=${{ env.SSH_USER }}@${{ env.SSH_HOST }}"                                                                                          >> $GITHUB_ENV
+
+      # -----------------------------------------------------------------------
+      # Install Docker CE on the remote VM
+      # -----------------------------------------------------------------------
+      - name: Install Docker CE
+        run: |
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
+            curl -fsSL https://get.docker.com | sudo sh
+            sudo systemctl enable --now docker
+          "
+
+      - name: Login VM to ECR registry
+        if: inputs.registry == 'ECR' || github.event_name == 'issue_comment'
+        run: |
+          ECR_REGISTRY="${{ env.DOCKER_REGISTRY }}"
+          ECR_REGION=$(echo "$ECR_REGISTRY" | cut -d. -f4)
+          ECR_PASS=$(aws ecr get-login-password --region "$ECR_REGION")
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" \
+            "echo '${ECR_PASS}' | sudo docker login --username AWS --password-stdin ${ECR_REGISTRY}"
+
+      # -----------------------------------------------------------------------
+      # Deploy: patch image tags, copy wazuh-docker and start the stack
+      # -----------------------------------------------------------------------
+      - name: Patch image tags
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          COMPOSE="wazuh-docker/${DEPLOYMENT}/docker-compose.yml"
+          TAG="${{ env.DOCKER_TAG }}"
+          REGISTRY="${{ env.DOCKER_REGISTRY }}"
+
+          if [ "$REGISTRY" = "${{ vars.IMAGE_REGISTRY_PROD }}" ] || [ -z "$REGISTRY" ]; then
+            echo "Patching ${COMPOSE}: wazuh/wazuh-*:${TAG} (DockerHub, no registry prefix)"
+            sed -i -E "s|(image: wazuh/wazuh-[^:]+:)[^ ]+|\1${TAG}|g" "$COMPOSE"
+          else
+            echo "Patching ${COMPOSE}: ${REGISTRY}/wazuh/wazuh-*:${TAG}"
+            sed -i -E "s|image: (wazuh/wazuh-[^:]+):[^ ]+|image: ${REGISTRY}/\1:${TAG}|g" "$COMPOSE"
+          fi
+          echo "=== Patched image lines ==="
+          grep 'image:' "$COMPOSE"
+
+      - name: Prepare cert tool and config
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          VERSION="${{ env.WAZUH_VERSION }}"
+          STAGE="${{ env.WAZUH_STAGE }}"
+          MAJOR=$(echo "$VERSION" | cut -d. -f1)
+
+          echo "Cert tool: ${VERSION}-${STAGE}  Docker image: ${{ env.DOCKER_TAG }}"
+
+          # Download cert tool once on the runner
+          if [ -n "$STAGE" ]; then
+            CERT_TOOL_URL="https://packages-staging.xdrsiem.wazuh.info/pre-release/${MAJOR}.x/installation-assistant/wazuh-certs-tool-${VERSION}-${STAGE}.sh"
+          else
+            CERT_TOOL_URL="https://packages.wazuh.com/${MAJOR}.$(echo "$VERSION" | cut -d. -f2)/wazuh-certs-tool-${VERSION}-1.sh"
+          fi
+          echo "Downloading cert tool: $CERT_TOOL_URL"
+          curl -fsSL -o "wazuh-docker/${DEPLOYMENT}/wazuh-certs-tool.sh" "$CERT_TOOL_URL"
+          chmod +x "wazuh-docker/${DEPLOYMENT}/wazuh-certs-tool.sh"
+          echo "Downloaded OK"
+
+          # Write config.yml directly into the deployment directory
+          if [ "$DEPLOYMENT" = "single-node" ]; then
+            printf '%s\n' \
+              'nodes:' \
+              '  indexer:' \
+              '    - name: wazuh.indexer' \
+              '      dns: wazuh.indexer' \
+              '  manager:' \
+              '    - name: wazuh.manager' \
+              '      dns: wazuh.manager' \
+              '  dashboard:' \
+              '    - name: wazuh.dashboard' \
+              '      dns: wazuh.dashboard' \
+              > "wazuh-docker/${DEPLOYMENT}/config.yml"
+          else
+            printf '%s\n' \
+              'nodes:' \
+              '  indexer:' \
+              '    - name: wazuh1.indexer' \
+              '      dns: wazuh1.indexer' \
+              '    - name: wazuh2.indexer' \
+              '      dns: wazuh2.indexer' \
+              '    - name: wazuh3.indexer' \
+              '      dns: wazuh3.indexer' \
+              '  manager:' \
+              '    - name: wazuh.master' \
+              '      dns: wazuh.master' \
+              '      node_type: master' \
+              '    - name: wazuh.worker' \
+              '      dns: wazuh.worker' \
+              '      node_type: worker' \
+              '  dashboard:' \
+              '    - name: wazuh.dashboard' \
+              '      dns: wazuh.dashboard' \
+              > "wazuh-docker/${DEPLOYMENT}/config.yml"
+          fi
+          echo "=== config.yml ==="
+          cat "wazuh-docker/${DEPLOYMENT}/config.yml"
+          echo "=== Files ready to copy ==="
+          ls -la "wazuh-docker/${DEPLOYMENT}/"
+
+      - name: Copy wazuh-docker to VM
+        run: |
+          scp ${{ env.SCP_OPTS }} -r wazuh-docker "${{ env.REMOTE }}:/tmp/wazuh-docker"
+
+      - name: Show deployment config
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
+            echo '=== Files in deployment directory ==='
+            ls -la /tmp/wazuh-docker/${DEPLOYMENT}/
+            echo ''
+            echo '=== Images referenced in docker-compose.yml ==='
+            grep 'image:' /tmp/wazuh-docker/${DEPLOYMENT}/docker-compose.yml || echo '(none found)'
+            echo ''
+            echo '=== Docker version ==='
+            sudo docker version --format 'Client: {{.Client.Version}}  Server: {{.Server.Version}}'
+          "
+
+      - name: Configure VM for Wazuh Indexer
+        run: |
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
+            sudo sysctl -w vm.max_map_count=262144
+            echo 'vm.max_map_count = '\$(cat /proc/sys/vm/max_map_count)
+          "
+
+      - name: Generate SSL certificates
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
+            set -e
+            cd /tmp/wazuh-docker/${DEPLOYMENT}
+            echo '=== Running certificate generation ==='
+            sudo bash /tmp/wazuh-docker/tools/utils/deployment/certificates-conf.sh --cert --copy
+            echo ''
+            echo '=== Generated certificate files ==='
+            find ./config -name '*.pem' | sort
+            echo ''
+            echo '=== Certificate subjects ==='
+            for pem in \$(find ./config -name '*.pem' ! -name '*-key.pem' | sort); do
+              echo -n \"\$pem: \"
+              sudo openssl x509 -in \"\$pem\" -noout -subject -issuer 2>/dev/null || echo '(not a cert / key file)'
+            done
+          "
+
+      - name: Start Docker Compose
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
+            set -eo pipefail
+            cd /tmp/wazuh-docker/${DEPLOYMENT}
+            sudo docker compose up -d 2>&1 | tee /tmp/docker-compose-up.log
+            echo ''
+            echo '=== Initial container status ==='
+            sudo docker compose ps
+          "
+
+      - name: Show indexer logs on failure
+        if: failure()
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
+            cd /tmp/wazuh-docker/${DEPLOYMENT}
+            echo '=== docker compose ps ==='
+            sudo docker compose ps
+            echo ''
+            echo '=== wazuh.indexer logs ==='
+            sudo docker compose logs wazuh.indexer 2>&1
+          " || true
+
+      - name: Wait for containers healthy
+        timeout-minutes: 15
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
+            cd /tmp/wazuh-docker/${DEPLOYMENT}
+
+            echo '=== Verifying containers started ==='
+            TOTAL=\$(sudo docker compose ps 2>/dev/null | tail -n +2 | wc -l | tr -d ' ')
+            if [ \"\$TOTAL\" -eq 0 ]; then
+              echo 'ERROR: No containers are running — docker compose up may have failed'
+              sudo docker compose ps
+              sudo docker compose logs --no-color 2>&1 | tail -50
+              exit 1
+            fi
+            echo \"Found \$TOTAL container(s), waiting for healthy status...\"
+            echo ''
+
+            for i in \$(seq 1 90); do
+              NOT_HEALTHY=\$(sudo docker compose ps 2>/dev/null \
+                | tail -n +2 \
+                | grep -v 'nginx' \
+                | grep -vcE '(healthy|\(healthy\))')
+              if [ \"\$NOT_HEALTHY\" -eq 0 ]; then
+                echo \"All containers healthy after \${i} x 10s attempts\"
+                sudo docker compose ps
+                exit 0
+              fi
+              echo \"  attempt \$i/90: \$NOT_HEALTHY container(s) not yet healthy\"
+              if [ \"\$(( i % 6 ))\" -eq 0 ]; then
+                echo '  --- current status ---'
+                sudo docker compose ps
+              fi
+              sleep 10
+            done
+            echo 'ERROR: containers not healthy after 15 minutes'
+            sudo docker compose ps
+            sudo docker compose logs --no-color 2>&1 | tail -100
+            exit 1
+          "
+
+      - name: Cluster warm-up wait
+        run: |
+          if [ "${{ matrix.deployment_type }}" = "multi-node" ]; then
+            WAIT=90
+          else
+            WAIT=60
+          fi
+          echo "Waiting ${WAIT}s for services to reach steady state..."
+          sleep $WAIT
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
+            cd /tmp/wazuh-docker/${DEPLOYMENT}
+            echo '=== Container status after warm-up ==='
+            sudo docker compose ps
+          "
+
+      # -----------------------------------------------------------------------
+      # Run integration tests
+      # -----------------------------------------------------------------------
+      - name: Run tests
+        id: run_tests
+        continue-on-error: true
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          test_runner \
+            --test-type "docker-${DEPLOYMENT}" \
+            --deployment-type "docker-${DEPLOYMENT}" \
+            --ssh-host "${{ env.SSH_HOST }}" \
+            --ssh-port "${{ env.SSH_PORT }}" \
+            --ssh-key-path "${{ env.SSH_KEY }}" \
+            --ssh-username "${{ env.SSH_USER }}" \
+            --version "${{ env.DOCKER_VERSION }}" \
+            --log-level INFO \
+            --output github \
+            --output-file "test-results-docker-${DEPLOYMENT}.github"
+
+      # -----------------------------------------------------------------------
+      # Collect logs on failure
+      # -----------------------------------------------------------------------
+      - name: Show test outcome
+        if: always()
+        run: |
+          echo "Run tests outcome: ${{ steps.run_tests.outcome }}"
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          if [ -f "test-results-docker-${DEPLOYMENT}.github" ]; then
+            echo "=== Test results file ==="
+            cat "test-results-docker-${DEPLOYMENT}.github"
+          else
+            echo "WARNING: no test results file found (test_runner may have failed before writing output)"
+          fi
+
+      - name: Collect Docker logs on failure
+        if: failure() || steps.run_tests.outcome == 'failure'
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
+            cd /tmp/wazuh-docker/${DEPLOYMENT}
+            sudo docker compose logs --no-color 2>&1
+          " > docker-logs-${DEPLOYMENT}.txt || true
+
+      - name: Upload Docker logs
+        if: failure() || steps.run_tests.outcome == 'failure'
+        uses: actions/upload-artifact@v4
+        with:
+          name: docker-logs-${{ matrix.deployment_type }}-${{ github.run_id }}
+          path: docker-logs-*.txt
+          retention-days: 7
+
+      # -----------------------------------------------------------------------
+      # Reporting
+      # -----------------------------------------------------------------------
+      - name: Create step summary
+        if: always()
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          echo "## Docker Integration Test Results — ${DEPLOYMENT}" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          if [ -f "test-results-docker-${DEPLOYMENT}.github" ]; then
+            cat "test-results-docker-${DEPLOYMENT}.github" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "No test results file found." >> $GITHUB_STEP_SUMMARY
+          fi
+
+      - name: Post PR comment with results
+        if: always() && github.event_name == 'issue_comment'
+        uses: actions/github-script@v7
+        env:
+          DEPLOYMENT: ${{ matrix.deployment_type }}
+          RUN_OUTCOME: ${{ steps.run_tests.outcome }}
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const fs = require('fs');
+            const deployment = process.env.DEPLOYMENT;
+            const outcome = process.env.RUN_OUTCOME;
+            const marker = `<!-- docker-integration-check-${deployment} -->`;
+
+            let body = `${marker}\n## Docker Integration Tests — \`${deployment}\`\n\n`;
+            body += outcome === 'success'
+              ? '✅ **All tests passed!**\n\n'
+              : '❌ **Some tests failed**\n\n';
+
+            const resultsFile = `test-results-docker-${deployment}.github`;
+            try {
+              if (fs.existsSync(resultsFile)) {
+                body += '### Results\n\n' + fs.readFileSync(resultsFile, 'utf8') + '\n\n';
+              }
+            } catch (e) {
+              console.log('Could not read results file:', e.message);
+            }
+            body += `- **Workflow:** [View Details](${context.payload.repository.html_url}/actions/runs/${context.runId})\n`;
+
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+
+            const existing = comments.find(c =>
+              c.user.type === 'Bot' && c.body.includes(marker)
+            );
+
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body: body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body: body,
+              });
+            }
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-results-docker-${{ matrix.deployment_type }}-${{ github.run_id }}
+          path: test-results-docker-${{ matrix.deployment_type }}.github
+          retention-days: 7
+
+      # -----------------------------------------------------------------------
+      # Cleanup: always stop stack and deallocate VM
+      # -----------------------------------------------------------------------
+      - name: Stop Docker Compose
+        if: always()
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
+            cd /tmp/wazuh-docker/${DEPLOYMENT} && sudo docker compose down -v || true
+          " || true
+
+      - name: Configure AWS credentials for cleanup
+        if: always()
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
+          role-session-name: docker-cleanup-${{ github.run_id }}-${{ matrix.deployment_type }}
+          aws-region: ${{ env.REGION }}
+
+      - name: Deallocate instance
+        if: always()
+        run: |
+          python3 wazuh-automation/deployability/modules/allocation/main.py \
+            --action delete \
+            --track-output ${{ env.ALLOCATOR_PATH }}/track.yml
+
+  # -------------------------------------------------------------------------
+  # Job 4: Update the GitHub check run (issue_comment trigger only)
+  # -------------------------------------------------------------------------
+  update_check:
+    needs: [get_pr_info, prepare, build_images, docker_test]
+    if: always() && github.event_name == 'issue_comment' && needs.get_pr_info.result == 'success'
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+    steps:
+      - name: Update check run
+        uses: actions/github-script@v7
+        env:
+          DOCKER_RESULT: ${{ needs.docker_test.result }}
+          CHECK_NAME: ${{ needs.get_pr_info.outputs.check_name }}
+          CHECK_RUN_ID: ${{ needs.get_pr_info.outputs.check_run_id }}
+        with:
+          script: |
+            const result = process.env.DOCKER_RESULT;
+            const conclusionMap = {
+              success:   { conclusion: 'success',   icon: '✅', summary: 'All Docker integration tests passed.' },
+              failure:   { conclusion: 'failure',   icon: '❌', summary: 'One or more Docker integration tests failed.' },
+              cancelled: { conclusion: 'cancelled', icon: '⏹️', summary: 'Workflow was cancelled.' },
+            };
+            const { conclusion, icon, summary } = conclusionMap[result] ?? conclusionMap.failure;
+            const label = conclusion.charAt(0).toUpperCase() + conclusion.slice(1);
+            await github.rest.checks.update({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              check_run_id: parseInt(process.env.CHECK_RUN_ID),
+              status: 'completed',
+              conclusion,
+              completed_at: new Date().toISOString(),
+              output: {
+                title: `${icon} ${process.env.CHECK_NAME} — ${label}`,
+                summary,
+                text: `[View workflow run](https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})`
+              }
+            });

.github/workflows/5_pr_check.yml

@@ -1,9 +1,19 @@
-name: Wazuh Docker pipeline
+name: (8.x) Docker PR check
 permissions:
   contents: read
   id-token: write
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches:
+      - 5.*
+      - main
+    paths:
+      - 'build-docker-images/**'
+      - 'multi-node/**'
+      - 'single-node/**'
+      - 'wazuh-agent/**'
+      - '.github/**'
   workflow_dispatch:
     inputs:
       docker_reference:
@@ -14,7 +24,8 @@ on:
 jobs:
 
   prepare-variables:
-    runs-on: ubuntu-latest
+    if: ${{ !github.event.pull_request.draft }}
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
     outputs:
       WAZUH_VERSION: ${{ steps.dotenv.outputs.WAZUH_VERSION }}
       WAZUH_IMAGE_VERSION: ${{ steps.dotenv.outputs.WAZUH_IMAGE_VERSION }}
@@ -39,12 +50,12 @@ jobs:
 
   build-images:
     needs: prepare-variables
-    uses: ./.github/workflows/Procedure_push_docker_images.yml
+    uses: ./.github/workflows/5_build_and_push_images.yml
     secrets: inherit
     with:
       image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }}
       docker_reference: ${{ github.head_ref || inputs.docker_reference }}
-      wazuh_automation_reference: 'main'
+      wazuh_automation_reference: '5.0.0'
       commit_list: '["latest", "latest", "latest", "latest"]'
       assistant_revision: 'latest'
       id: ${{ github.run_id }}
@@ -52,7 +63,7 @@ jobs:
 
   Execute-Goss-tests:
     needs: [prepare-variables, build-images]
-    runs-on: ubuntu-22.04
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
     env:
       WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }}
       WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }}
@@ -76,7 +87,7 @@ jobs:
       uses: aws-actions/amazon-ecr-login@v2
 
     - name: Execute Goss tests (wazuh-manager)
-      run: dgoss run ${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-manager:${{ env.WAZUH_IMAGE_VERSION }}
+      run: dgoss run ${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-manager:${{ env.WAZUH_IMAGE_VERSION }}-latest
       env:
         GOSS_SLEEP: 30
         GOSS_FILE: .github/.goss.yaml
@@ -86,9 +97,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-22.04, ubuntu-22.04-arm]
+        os: ["codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}", "codebuild-github-actions-codebuild-runner-devops-arm-${{ github.run_id }}-${{ github.run_attempt }}"]
       fail-fast: false
-    needs: [prepare-variables, Execute-Goss-tests, build-images]
+    needs: [prepare-variables, Execute-Goss-tests]
     env:
       WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }}
       WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }}
@@ -103,9 +114,6 @@ jobs:
     - name: Check out code
       uses: actions/checkout@v4
 
-    - name: free disk space
-      uses: ./.github/free-disk-space
-
     - name: Configure aws credentials
       uses: aws-actions/configure-aws-credentials@v4
       with:
@@ -121,6 +129,12 @@ jobs:
         name: presigned-artifact-urls-${{ github.run_id }}
         path: ./single-node/
 
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v4
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
     - name: Add environment variables into GITHUB_ENV
       run: |
         # Export variables to the environment
@@ -162,6 +176,7 @@ jobs:
         if [ -f "$TARGET_FILE" ]; then
           echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}"
           sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE"
+          sed -i "s/\(.*wazuh\/wazuh-.*:\)${{ env.WAZUH_IMAGE_VERSION }}/\1${{ env.WAZUH_IMAGE_VERSION }}-latest/g" "$TARGET_FILE"
         else
           echo "File $TARGET_FILE not found"
           exit 1
@@ -284,6 +299,7 @@ jobs:
         if [ -f "$TARGET_FILE" ]; then
           echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}"
           sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE"
+          sed -i "s/\(.*wazuh\/wazuh-.*:\)${{ env.WAZUH_IMAGE_VERSION }}/\1${{ env.WAZUH_IMAGE_VERSION }}-latest/g" "$TARGET_FILE"
         else
           echo "File $TARGET_FILE not found"
           exit 1
@@ -359,9 +375,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-22.04, ubuntu-22.04-arm]
+        os: ["codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}", "codebuild-github-actions-codebuild-runner-devops-arm-${{ github.run_id }}-${{ github.run_attempt }}"]
       fail-fast: false
-    needs: [prepare-variables, Execute-Goss-tests, build-images]
+    needs: [prepare-variables, Execute-Goss-tests]
     env:
       WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }}
       WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }}
@@ -376,9 +392,6 @@ jobs:
     - name: Check out code
       uses: actions/checkout@v4
 
-    - name: free disk space
-      uses: ./.github/free-disk-space
-
     - name: Configure aws credentials
       uses: aws-actions/configure-aws-credentials@v4
       with:
@@ -394,6 +407,12 @@ jobs:
         name: presigned-artifact-urls-${{ github.run_id }}
         path: ./multi-node/
 
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v4
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
     - name: Add environment variables into GITHUB_ENV
       run: |
         # Export variables to the environment
@@ -441,6 +460,7 @@ jobs:
         if [ -f "$TARGET_FILE" ]; then
           echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}"
           sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE"
+          sed -i "s/\(.*wazuh\/wazuh-.*:\)${{ env.WAZUH_IMAGE_VERSION }}/\1${{ env.WAZUH_IMAGE_VERSION }}-latest/g" "$TARGET_FILE"
         else
           echo "File $TARGET_FILE not found"
           exit 1
@@ -573,6 +593,7 @@ jobs:
         if [ -f "$TARGET_FILE" ]; then
           echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}"
           sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE"
+          sed -i "s/\(.*wazuh\/wazuh-.*:\)${{ env.WAZUH_IMAGE_VERSION }}/\1${{ env.WAZUH_IMAGE_VERSION }}-latest/g" "$TARGET_FILE"
         else
           echo "File $TARGET_FILE not found"
           exit 1

.gitignore

@@ -12,7 +12,7 @@ multi-node/wazuh-certificates/*
 multi-node/wazuh-certificates-tool.log
 multi-node/wazuh-certs-tool*.sh
 multi-node/config*.yml
-multi-node/config/wazuh*
+multi-node/config/*/certs
 
 # Documentation
 docs/book/

CHANGELOG.md

@@ -1,16 +1,59 @@
 # Change Log
 All notable changes to this project will be documented in this file.
 
+## [8.0.0]
+
+### Added
+
+- None
+
+### Changed
+
+- None
+
+### Fixed
+
+- None
+
+### Deleted
+
+- None
+
+## [5.9.9]
+
+### Added
+
+- None
+
+### Changed
+
+- None
+
+### Fixed
+
+- None
+
+### Deleted
+
+- None
+
 ## [5.0.0]
 
 ### Added
 
+- Implement the wazuh-docker integration testing module ([#2428](https://github.com/wazuh/wazuh-docker/pull/2428))
 - Add revert option into bumper workflow ([#2330](https://github.com/wazuh/wazuh-docker/pull/2330))
 - Add checks for artifact_urls.yaml download ([#2315](https://github.com/wazuh/wazuh-docker/pull/2315))
 - Add set_as_main option ([#2293](https://github.com/wazuh/wazuh-docker/pull/2293))
 
 ### Changed
 
+- Change runners on repository workflows 5.x ([#2471](https://github.com/wazuh/wazuh-docker/pull/2471))
+- PR revamp modifications 5.x ([#2446](https://github.com/wazuh/wazuh-docker/pull/2446))
+- Forbid pr_check workflow execution in draft PRs ([#2399](https://github.com/wazuh/wazuh-docker/pull/2399))
+- Unification of user UID and GID ([#2393](https://github.com/wazuh/wazuh-docker/pull/2393))
+- Add Wazuh indexer engine start on entrypoint ([#2390](https://github.com/wazuh/wazuh-docker/pull/2390))
+- Image build process update ([#2358](https://github.com/wazuh/wazuh-docker/pull/2358))
 - Add new path on artifact_urls file ([#2344](https://github.com/wazuh/wazuh-docker/pull/2344))
 - Presigned URLs generation enhancement ([#2346](https://github.com/wazuh/wazuh-docker/pull/2346))
 - Adapt bumper workflows to change main branch ([#2294](https://github.com/wazuh/wazuh-docker/pull/2294))
@@ -51,6 +94,8 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
+- Fix WF docker images vulnerabilities ([#2444](https://github.com/wazuh/wazuh-docker/pull/2444))
+- Adapt Wazuh manager healthcheck with local binaries ([#2422](https://github.com/wazuh/wazuh-docker/pull/2422))
 - Delete setcap command on deprecated file ([#2345](https://github.com/wazuh/wazuh-docker/pull/2345))
 - Modify the choice of a correct tag ([#2313](https://github.com/wazuh/wazuh-docker/pull/2313))
 - Artifact URL download fix ([#2306](https://github.com/wazuh/wazuh-docker/pull/2306))
@@ -63,6 +108,24 @@ All notable changes to this project will be documented in this file.
 
 - None
 
+## [4.14.7]
+
+### Added
+
+- None
+
+### Changed
+
+- PR revamp modifications 4.x ([#2445](https://github.com/wazuh/wazuh-docker/pull/2445))
+
+### Fixed
+
+- None
+
+### Deleted
+
+- None
+
 ## [4.14.6]
 
 ### Added
@@ -71,10 +134,11 @@ All notable changes to this project will be documented in this file.
 
 ### Changed
 
-- None
+- Change runners on repository workflows ([#2470](https://github.com/wazuh/wazuh-docker/pull/2470))
 
 ### Fixed
 
+- Changed update_user function from wazuh.security to wazuh.rbac.orm module ([#2406](https://github.com/wazuh/wazuh-docker/pull/2406))
 - GH issue notification fix ([#2312](https://github.com/wazuh/wazuh-docker/pull/2312))
 
 ### Deleted
@@ -327,6 +391,81 @@ All notable changes to this project will be documented in this file.
 
 - None
 
+## [4.10.5]
+
+### Added
+
+- None
+
+### Changed
+
+- Change runner name for Codebuild ([#2474](https://github.com/wazuh/wazuh-docker/pull/2474))
+- PR revamp modifications LTS ([#2449](https://github.com/wazuh/wazuh-docker/pull/2449))
+
+### Fixed
+
+- None
+
+### Deleted
+
+- None
+
+## [4.10.4]
+
+### Added
+
+- None
+
+### Changed
+
+- Removed sslmanager key from the docker manager image. ([#2092](https://github.com/wazuh/wazuh-docker/pull/2092))
+- Backport 4.13.0 changes: Modify wazuh-keystore use ([#2036](https://github.com/wazuh/wazuh-docker/pull/2036)) \- (wazuh-keystore)
+
+### Fixed
+
+- Changed update_user function from wazuh.security to wazuh.rbac.orm module ([#2405](https://github.com/wazuh/wazuh-docker/pull/2405))
+- Add wazuh-template.json into permanent data exception ([#1967](https://github.com/wazuh/wazuh-docker/pull/1967))
+
+### Deleted
+
+- None
+
+## [4.10.3]
+
+### Added
+
+- None
+
+### Changed
+
+- None
+
+### Fixed
+
+- None
+
+### Deleted
+
+- None
+
+## [4.10.2]
+
+### Added
+
+- None
+
+### Changed
+
+- None
+
+### Fixed
+
+- Updated docker/login-action module ([#1837](https://github.com/wazuh/wazuh-docker/pull/1837))
+
+### Deleted
+
+- None
+
 ## [4.10.1]
 
 ### Added

VERSION.json

@@ -1,4 +1,4 @@
 {
-    "version": "5.0.0",
-    "stage": "beta1"
-}
+    "version": "8.0.0",
+    "stage": "rc8"
+}

build-docker-images/build-images.sh

@@ -48,7 +48,7 @@ build() {
     # ARTIFACT_URLS_FILE: The name of the artifact URLs file.
     ARTIFACT_URLS_FILE="artifact_urls.yaml"
     # ARTIFACT_URLS_DIR: The name of the artifact URLs directory.
-    ARTIFACT_URLS_DIR="artifact_urls"
+    ARTIFACT_URLS_DIR="artifact-urls"
 
     # Check if the artifact file already exists to prevent redundant downloads
     if [[ -f "$ARTIFACT_URLS_FILE" ]]; then
@@ -166,52 +166,23 @@ build() {
     fi
 
 
-    # Function to get component-specific commit reference
-    get_component_commit() {
-        local component=$1
-        case "${component}" in
-            wazuh-indexer)
-                echo "${INDEXER_COMMIT}"
-                ;;
-            wazuh-manager)
-                echo "${MANAGER_COMMIT}"
-                ;;
-            wazuh-dashboard)
-                echo "${DASHBOARD_COMMIT}"
-                ;;
-            wazuh-agent)
-                echo "${AGENT_COMMIT}"
-                ;;
-            *)
-                echo ""
-                ;;
-        esac
-    }
-
-    # Global env file (without IMAGE_TAG - will be component-specific)
+    # Write the global .env file used by deployment compose files.
+    # IMAGE_TAG here reflects a non-dev, non-per-component tag for reference.
+    local base_tag="${WAZUH_IMAGE_VERSION}${WAZUH_DEV_STAGE:+-${WAZUH_DEV_STAGE,,}}"
     echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > ../.env
     echo WAZUH_IMAGE_VERSION=$WAZUH_IMAGE_VERSION >> ../.env
     echo WAZUH_REGISTRY=$WAZUH_REGISTRY >> ../.env
+    echo IMAGE_TAG=${base_tag} >> ../.env
 
     set -a
     source ../.env
     source ./artifacts_env.txt
     set +a
 
-    # Define all available components
-    local all_components=("wazuh-indexer" "wazuh-manager" "wazuh-dashboard" "wazuh-agent")
-    local components_to_build=()
-
-    # Determine which components to build
-    if [ -z "${WAZUH_COMPONENT}" ]; then
-        echo "No component specified. Building all components..."
-        components_to_build=("${all_components[@]}")
-    else
-        # Validate component
+    # Validate component if a specific one was requested.
+    if [ -n "${WAZUH_COMPONENT}" ]; then
         case "${WAZUH_COMPONENT}" in
-            wazuh-indexer|wazuh-manager|wazuh-dashboard|wazuh-agent)
-                components_to_build=("${WAZUH_COMPONENT}")
-                ;;
+            wazuh-indexer|wazuh-manager|wazuh-dashboard|wazuh-agent) ;;
             *)
                 echo "Error: Unknown component '${WAZUH_COMPONENT}'" >&2
                 clean 1
@@ -219,77 +190,51 @@ build() {
         esac
     fi
 
-    # Determine build command and base options
+    # Generate per-component image tags.
+    # The commit suffix is only appended when --dev is passed. This ensures:
+    #   dev=false, tag=5.0.0       → 5.0.0
+    #   dev=false, tag=5.0.0-beta1 → 5.0.0-beta1
+    #   dev=true,  tag=5.0.0       → 5.0.0-latest
+    #   dev=true,  tag=5.0.0-beta1 → 5.0.0-beta1-latest
+    make_tag() {
+        local commit=$1
+        if [ -n "${IS_DEV_BUILD}" ]; then
+            echo "${WAZUH_IMAGE_VERSION}${WAZUH_DEV_STAGE:+-${WAZUH_DEV_STAGE,,}}-${commit}"
+        else
+            echo "${base_tag}"
+        fi
+    }
+
+    export WAZUH_VERSION="$WAZUH_IMAGE_VERSION"
+    export MULTIARCH="${MULTIARCH}"
+    export INDEXER_TAG=$(make_tag   "${INDEXER_COMMIT:-latest}")
+    export MANAGER_TAG=$(make_tag   "${MANAGER_COMMIT:-latest}")
+    export DASHBOARD_TAG=$(make_tag "${DASHBOARD_COMMIT:-latest}")
+    export AGENT_TAG=$(make_tag     "${AGENT_COMMIT:-latest}")
+
+    echo "Image tags:"
+    echo "  wazuh-indexer:   ${WAZUH_REGISTRY}/wazuh/wazuh-indexer:${INDEXER_TAG}"
+    echo "  wazuh-manager:   ${WAZUH_REGISTRY}/wazuh/wazuh-manager:${MANAGER_TAG}"
+    echo "  wazuh-dashboard: ${WAZUH_REGISTRY}/wazuh/wazuh-dashboard:${DASHBOARD_TAG}"
+    echo "  wazuh-agent:     ${WAZUH_REGISTRY}/wazuh/wazuh-agent:${AGENT_TAG}"
+
+    # Bake options: --push for multi-arch (can't load multi-platform locally),
+    # --load for single-arch (stores image in local Docker daemon).
+    local bake_opts="--no-cache"
     if [ "${MULTIARCH}" ]; then
-        build_cmd="docker buildx build --platform linux/amd64,linux/arm64 --push --no-cache"
+        bake_opts="${bake_opts} --push"
     else
-        build_cmd="docker build --no-cache"
+        bake_opts="${bake_opts} --load"
     fi
 
-    # Build each component
-    for component in "${components_to_build[@]}"; do
-        echo "Building ${component} image..."
-
-        # Get component-specific commit reference
-        COMPONENT_COMMIT=$(get_component_commit "${component}")
-
-        # Generate component-specific IMAGE_TAG.
-        # The commit suffix is only appended when --dev was passed, which maps
-        # directly to inputs.dev=true in the workflow. This ensures:
-        #   dev=false, tag=5.0.0       → 5.0.0
-        #   dev=false, tag=5.0.0-beta1 → 5.0.0-beta1
-        #   dev=true,  tag=5.0.0       → 5.0.0-latest
-        #   dev=true,  tag=5.0.0-beta1 → 5.0.0-beta1-latest
-        if [ -n "${IS_DEV_BUILD}" ]; then
-            IMAGE_TAG="${WAZUH_IMAGE_VERSION}${WAZUH_DEV_STAGE:+-${WAZUH_DEV_STAGE,,}}-${COMPONENT_COMMIT}"
-        else
-            IMAGE_TAG="${WAZUH_IMAGE_VERSION}${WAZUH_DEV_STAGE:+-${WAZUH_DEV_STAGE,,}}"
-        fi
-        echo "Using IMAGE_TAG: ${IMAGE_TAG} for ${component}"
-        export IMAGE_TAG="$IMAGE_TAG"
-
-        # Build common args (used by all components)
-        build_args=(
-            -t "${WAZUH_REGISTRY}/wazuh/${component}:${IMAGE_TAG}"
-            --build-arg WAZUH_VERSION="${WAZUH_IMAGE_VERSION}"
-        )
-
-        # Add component-specific args
-        case "${component}" in
-            wazuh-indexer)
-                build_args+=(
-                    --build-arg wazuh_indexer_x86_64_rpm="${wazuh_indexer_x86_64_rpm}"
-                    --build-arg wazuh_indexer_aarch64_rpm="${wazuh_indexer_aarch64_rpm}"
-                    --build-arg wazuh_certs_tool="${wazuh_certs_tool}"
-                    --build-arg wazuh_config_yml="${wazuh_config_yml}"
-                )
-                ;;
-            wazuh-manager)
-                build_args+=(
-                    --build-arg wazuh_manager_x86_64_rpm="${wazuh_manager_x86_64_rpm}"
-                    --build-arg wazuh_manager_aarch64_rpm="${wazuh_manager_aarch64_rpm}"
-                )
-                ;;
-            wazuh-dashboard)
-                build_args+=(
-                    --build-arg wazuh_dashboard_x86_64_rpm="${wazuh_dashboard_x86_64_rpm}"
-                    --build-arg wazuh_dashboard_aarch64_rpm="${wazuh_dashboard_aarch64_rpm}"
-                    --build-arg wazuh_certs_tool="${wazuh_certs_tool}"
-                    --build-arg wazuh_config_yml="${wazuh_config_yml}"
-                )
-                ;;
-            wazuh-agent)
-                build_args+=(
-                    --build-arg wazuh_agent_x86_64_rpm="${wazuh_agent_x86_64_rpm}"
-                    --build-arg wazuh_agent_aarch64_rpm="${wazuh_agent_aarch64_rpm}"
-                )
-                ;;
-        esac
-
-        # Execute build
-        $build_cmd "${build_args[@]}" ${component}/ || clean 1
-        echo "${component} image built successfully!"
-    done
+    # Build a specific component or the full default group (all 4 in parallel).
+    if [ -z "${WAZUH_COMPONENT}" ]; then
+        echo "Building all components in parallel..."
+        docker buildx bake ${bake_opts} -f docker-bake.hcl || clean 1
+    else
+        echo "Building ${WAZUH_COMPONENT}..."
+        docker buildx bake ${bake_opts} -f docker-bake.hcl "${WAZUH_COMPONENT}" || clean 1
+    fi
 
     echo ""
     echo "Image build process completed!"

build-docker-images/build-images.yml

@@ -1,98 +0,0 @@
-# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
-services:
-  wazuh.manager:
-    build:
-      context: wazuh-manager/
-      args:
-        WAZUH_VERSION: ${WAZUH_VERSION}
-        wazuh_manager_x86_64_rpm: ${wazuh_manager_x86_64_rpm}
-        wazuh_manager_aarch64_rpm: ${wazuh_manager_aarch64_rpm}
-        wazuh_certs_tool: ${wazuh_certs_tool}
-        wazuh_config_yml: ${wazuh_config_yml}
-    image: ${WAZUH_REGISTRY}/wazuh/wazuh-manager:${IMAGE_TAG}
-    hostname: wazuh.manager
-    restart: always
-    ports:
-      - "1514:1514"
-      - "1515:1515"
-      - "514:514/udp"
-      - "55000:55000"
-    environment:
-      - INDEXER_URL=https://wazuh.indexer:9200
-      - INDEXER_USERNAME=admin
-      - INDEXER_PASSWORD=admin
-    volumes:
-      - wazuh_api_configuration:/var/wazuh-manager/api/configuration
-      - wazuh_etc:/var/wazuh-manager/etc
-      - wazuh_logs:/var/wazuh-manager/logs
-      - wazuh_queue:/var/wazuh-manager/queue
-      - wazuh_var_multigroups:/var/wazuh-manager/var/multigroups
-
-  wazuh.agent:
-    build:
-      context: wazuh-agent/
-      args:
-        WAZUH_VERSION: ${WAZUH_VERSION}
-        wazuh_agent_x86_64_rpm: ${wazuh_agent_x86_64_rpm}
-        wazuh_agent_aarch64_rpm: ${wazuh_agent_aarch64_rpm}
-    image: ${WAZUH_REGISTRY}/wazuh/wazuh-agent:${IMAGE_TAG}
-    hostname: wazuh.agent
-    restart: always
-
-  wazuh.indexer:
-    build:
-      context: wazuh-indexer/
-      args:
-        WAZUH_VERSION: ${WAZUH_VERSION}
-        wazuh_indexer_x86_64_rpm: ${wazuh_indexer_x86_64_rpm}
-        wazuh_indexer_aarch64_rpm: ${wazuh_indexer_aarch64_rpm}
-        wazuh_certs_tool: ${wazuh_certs_tool}
-        wazuh_config_yml: ${wazuh_config_yml}
-    image: ${WAZUH_REGISTRY}/wazuh/wazuh-indexer:${IMAGE_TAG}
-    hostname: wazuh.indexer
-    restart: always
-    ports:
-      - "9200:9200"
-    environment:
-      - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m"
-    ulimits:
-      memlock:
-        soft: -1
-        hard: -1
-      nofile:
-        soft: 65536
-        hard: 65536
-
-  wazuh.dashboard:
-    build:
-      context: wazuh-dashboard/
-      args:
-        WAZUH_VERSION: ${WAZUH_VERSION}
-        wazuh_dashboard_x86_64_rpm: ${wazuh_dashboard_x86_64_rpm}
-        wazuh_dashboard_aarch64_rpm: ${wazuh_dashboard_aarch64_rpm}
-        wazuh_certs_tool: ${wazuh_certs_tool}
-        wazuh_config_yml: ${wazuh_config_yml}
-    image: ${WAZUH_REGISTRY}/wazuh/wazuh-dashboard:${IMAGE_TAG}
-    hostname: wazuh.dashboard
-    restart: always
-    ports:
-      - 443:443
-    environment:
-      - INDEXER_USERNAME=admin
-      - INDEXER_PASSWORD=admin
-      - SERVER_SSL_ENABLED=false
-      - WAZUH_API_URL=https://wazuh.manager
-    depends_on:
-      - wazuh.indexer
-    links:
-      - wazuh.indexer:wazuh.indexer
-      - wazuh.manager:wazuh.manager
-
-volumes:
-  wazuh_api_configuration:
-  wazuh_etc:
-  wazuh_logs:
-  wazuh_queue:
-  wazuh_var_multigroups:
-  wazuh_active_response:
-

build-docker-images/docker-bake.hcl

@@ -0,0 +1,110 @@
+# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
+#
+# Docker Buildx Bake file.
+# Builds all Wazuh component images in parallel.
+#
+# Usage:
+#   docker buildx bake                          # build all (local, single-arch)
+#   docker buildx bake wazuh-manager            # build one component
+#   docker buildx bake --push                   # push to registry after build
+#
+# Variables are read automatically from the environment (see build-images.sh).
+
+# ── Global variables ──────────────────────────────────────────────────────────
+
+variable "WAZUH_VERSION"  { default = "5.0.0" }
+variable "WAZUH_REGISTRY" { default = "docker.io" }
+
+# Set IMAGE_TAG externally to override; defaults to WAZUH_VERSION.
+variable "IMAGE_TAG" { default = WAZUH_VERSION }
+
+# MULTIARCH: set to a non-empty value to build linux/amd64 + linux/arm64.
+variable "MULTIARCH" { default = "" }
+
+# Per-component tags — all default to IMAGE_TAG.
+# In dev builds the shell script sets each one independently to append the
+# per-component commit ref (e.g. MANAGER_TAG=5.0.0-beta1-abc1234).
+variable "INDEXER_TAG"   { default = IMAGE_TAG }
+variable "MANAGER_TAG"   { default = IMAGE_TAG }
+variable "DASHBOARD_TAG" { default = IMAGE_TAG }
+variable "AGENT_TAG"     { default = IMAGE_TAG }
+
+# ── Artifact URL variables ────────────────────────────────────────────────────
+# Populated by build-images.sh from artifacts_env.txt (sourced into env).
+
+variable "wazuh_indexer_x86_64_rpm"    { default = "" }
+variable "wazuh_indexer_aarch64_rpm"   { default = "" }
+variable "wazuh_manager_x86_64_rpm"    { default = "" }
+variable "wazuh_manager_aarch64_rpm"   { default = "" }
+variable "wazuh_dashboard_x86_64_rpm"  { default = "" }
+variable "wazuh_dashboard_aarch64_rpm" { default = "" }
+variable "wazuh_agent_x86_64_rpm"      { default = "" }
+variable "wazuh_agent_aarch64_rpm"     { default = "" }
+variable "wazuh_certs_tool"            { default = "" }
+variable "wazuh_config_yml"            { default = "" }
+
+# ── Default group: builds all components ─────────────────────────────────────
+
+group "default" {
+  targets = ["wazuh-indexer", "wazuh-manager", "wazuh-dashboard", "wazuh-agent"]
+}
+
+# ── Shared base target ────────────────────────────────────────────────────────
+# All component targets inherit from here. Not built directly.
+
+target "_common" {
+  # MULTIARCH=true  → build linux/amd64 + linux/arm64 (requires --push, no --load for multi-platform)
+  # MULTIARCH unset → null means "native platform of the build host" (amd64 on x86, arm64 on ARM)
+  platforms = MULTIARCH != "" ? ["linux/amd64", "linux/arm64"] : null
+  args = {
+    WAZUH_VERSION = WAZUH_VERSION
+  }
+}
+
+# ── Component targets ─────────────────────────────────────────────────────────
+
+target "wazuh-indexer" {
+  inherits = ["_common"]
+  context  = "wazuh-indexer/"
+  tags     = ["${WAZUH_REGISTRY}/wazuh/wazuh-indexer:${INDEXER_TAG}"]
+  args = {
+    wazuh_indexer_x86_64_rpm  = wazuh_indexer_x86_64_rpm
+    wazuh_indexer_aarch64_rpm = wazuh_indexer_aarch64_rpm
+    wazuh_certs_tool          = wazuh_certs_tool
+    wazuh_config_yml          = wazuh_config_yml
+  }
+}
+
+target "wazuh-manager" {
+  inherits = ["_common"]
+  context  = "wazuh-manager/"
+  tags     = ["${WAZUH_REGISTRY}/wazuh/wazuh-manager:${MANAGER_TAG}"]
+  args = {
+    wazuh_manager_x86_64_rpm  = wazuh_manager_x86_64_rpm
+    wazuh_manager_aarch64_rpm = wazuh_manager_aarch64_rpm
+    wazuh_certs_tool          = wazuh_certs_tool
+    wazuh_config_yml          = wazuh_config_yml
+  }
+}
+
+target "wazuh-dashboard" {
+  inherits = ["_common"]
+  context  = "wazuh-dashboard/"
+  tags     = ["${WAZUH_REGISTRY}/wazuh/wazuh-dashboard:${DASHBOARD_TAG}"]
+  args = {
+    wazuh_dashboard_x86_64_rpm  = wazuh_dashboard_x86_64_rpm
+    wazuh_dashboard_aarch64_rpm = wazuh_dashboard_aarch64_rpm
+    wazuh_certs_tool            = wazuh_certs_tool
+    wazuh_config_yml            = wazuh_config_yml
+  }
+}
+
+target "wazuh-agent" {
+  inherits = ["_common"]
+  context  = "wazuh-agent/"
+  tags     = ["${WAZUH_REGISTRY}/wazuh/wazuh-agent:${AGENT_TAG}"]
+  args = {
+    wazuh_agent_x86_64_rpm  = wazuh_agent_x86_64_rpm
+    wazuh_agent_aarch64_rpm = wazuh_agent_aarch64_rpm
+  }
+}

build-docker-images/wazuh-agent/Dockerfile

@@ -1,34 +1,83 @@
 # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
-FROM amazonlinux:2023
 
-RUN rm /bin/sh && ln -s /bin/bash /bin/sh
+################################################################################
+# Build stage 0 (builder):
+# Install Wazuh Agent RPM and download tini (static PID-1 init shim).
+################################################################################
+FROM amazonlinux:2023 AS builder
 
 ARG WAZUH_VERSION
-ARG S6_VERSION="v2.2.0.3"
+ARG TINI_VERSION="v0.19.0"
 ARG WAZUH_MANAGER='CHANGE_MANAGER_IP'
 ARG WAZUH_REGISTRATION_SERVER='CHANGE_ENROLL_IP'
 ARG WAZUH_AGENT_NAME='CHANGE_AGENT_NAME'
 ARG TARGETARCH
 ARG wazuh_agent_x86_64_rpm
 ARG wazuh_agent_aarch64_rpm
+ARG WAZUH_UID=101
+ARG WAZUH_GID=101
 
-RUN RPM_ARCH="x86_64" && \
+# Install only runtime dependencies
+RUN dnf install procps shadow-utils -y && \
+    dnf clean all && \
+    getent group wazuh || groupadd -r -g ${WAZUH_GID} wazuh && \
+    getent passwd wazuh || useradd --system \
+        --no-create-home \
+        --home-dir /var/ossec \
+        --uid ${WAZUH_UID} \
+        --gid ${WAZUH_GID} \
+        --shell /sbin/nologin \
+        wazuh && \
+    RPM_ARCH="x86_64" && \
     if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \
     URL_VAR="wazuh_agent_${RPM_ARCH}_rpm" && \
     agent_url="${!URL_VAR}" && \
-    dnf install curl-minimal tar gzip procps -y &&\
+    dnf install curl-minimal tar gzip procps shadow-utils -y && \
     curl -o /wazuh-agent.rpm "${agent_url}" && \
     dnf install /wazuh-agent.rpm -y && \
     rm -rf /wazuh-agent.rpm && \
     dnf clean all && \
-    sed -i '/<authorization_pass_path>/d' /var/ossec/etc/ossec.conf && \
-    S6_ARCH="amd64" && \
-    if [ "${TARGETARCH}" = "arm64" ]; then S6_ARCH="aarch64"; fi && \
-    curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-${S6_ARCH}.tar.gz \
-    -o /tmp/s6-overlay-${S6_ARCH}.tar.gz && \
-    tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \
-    tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \
-    rm  /tmp/s6-overlay-${S6_ARCH}.tar.gz
+    sed -i '/<authorization_pass_path>/d' /var/ossec/etc/ossec.conf
+
+# Download tini static binary (no external library dependencies)
+RUN curl --fail --silent -L \
+    https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini-static-${TARGETARCH} \
+    -o /usr/local/bin/tini && \
+    chmod +x /usr/local/bin/tini
+
+################################################################################
+# Build stage 1 (the actual Wazuh Agent image):
+# Copy Wazuh Agent and tini from builder. Install only runtime dependencies.
+################################################################################
+FROM amazonlinux:2023
+
+ARG WAZUH_UID=101
+ARG WAZUH_GID=101
+
+RUN rm /bin/sh && ln -s /bin/bash /bin/sh
+
+# Install only runtime dependencies
+RUN dnf install procps shadow-utils -y && \
+    dnf clean all && \
+    getent group wazuh || groupadd -r -g ${WAZUH_GID} wazuh && \
+    getent passwd wazuh || useradd --system \
+        --no-create-home \
+        --home-dir /var/ossec \
+        --uid ${WAZUH_UID} \
+        --gid ${WAZUH_GID} \
+        --shell /sbin/nologin \
+        wazuh
+
+# Copy Wazuh Agent installation from builder
+COPY --from=builder /var/ossec /var/ossec
+
+# Copy tini static binary
+COPY --from=builder /usr/local/bin/tini /usr/local/bin/tini
+
+# Copy entrypoint and init scripts
+COPY config/entrypoint.sh /entrypoint.sh
 COPY config/etc/ /etc/
 
-ENTRYPOINT [ "/init" ]
+RUN chmod 755 /entrypoint.sh
+
+ENTRYPOINT ["/usr/local/bin/tini", "--", "/entrypoint.sh"]

build-docker-images/wazuh-agent/config/entrypoint.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
+
+# Run initialization and configuration
+bash /etc/cont-init.d/0-wazuh-init
+
+# Start Wazuh Agent (may log warnings if manager address is not configured)
+bash /etc/cont-init.d/1-agent
+
+# Tail the main log to stdout so Docker captures it
+tail -F /var/ossec/logs/ossec.log &
+TAIL_PID=$!
+
+# Graceful shutdown: stop Wazuh and exit cleanly on SIGTERM/SIGINT
+_stop() {
+    echo "Stopping Wazuh Agent..."
+    /var/ossec/bin/wazuh-control stop 2>/dev/null || true
+    kill "${TAIL_PID}" 2>/dev/null || true
+}
+trap _stop SIGTERM SIGINT SIGQUIT
+
+wait "${TAIL_PID}"

build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init

@@ -1,4 +1,4 @@
-#!/usr/bin/with-contenv bash
+#!/bin/bash
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 
 WAZUH_INSTALL_PATH=/var/ossec

build-docker-images/wazuh-agent/config/etc/cont-init.d/1-agent

@@ -1,4 +1,4 @@
-#!/usr/bin/with-contenv bash
+#!/bin/bash
 
 ##############################################################################
 # Migration sequence

build-docker-images/wazuh-agent/config/etc/services.d/ossec-logs/run

@@ -1,4 +1,4 @@
-#!/usr/bin/with-contenv sh
+#!/bin/sh
 
 # dumping ossec.log to standard output
 exec tail -F /var/ossec/logs/ossec.log

build-docker-images/wazuh-dashboard/Dockerfile

@@ -7,9 +7,28 @@ ARG TARGETARCH
 ARG wazuh_dashboard_x86_64_rpm
 ARG wazuh_dashboard_aarch64_rpm
 ARG wazuh_config_yml
+ARG WAZUH_UID=101
+ARG WAZUH_GID=101
+
+# Set environment variables
+ENV USER="wazuh-dashboard" \
+    GROUP="wazuh-dashboard" \
+    NAME="wazuh-dashboard" \
+    INSTALL_DIR="/usr/share/wazuh-dashboard" 
 
 # Update and install dependencies
-RUN RPM_ARCH="x86_64" && \
+RUN yum install shadow-utils -y && \
+    yum clean all && \
+    getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \
+    useradd --system \
+    --uid ${WAZUH_UID} \
+    --no-create-home \
+    --home-dir $INSTALL_DIR \
+    --gid $GROUP \
+    --shell /sbin/nologin \
+    --comment "$USER user" \
+    $USER && \
+    RPM_ARCH="x86_64" && \
     if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \
     URL_VAR="wazuh_dashboard_${RPM_ARCH}_rpm" && \
     dashboard_url="${!URL_VAR}" && \
@@ -34,6 +53,9 @@ RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/bin/node
 ################################################################################
 FROM amazonlinux:2023
 
+ARG WAZUH_UID=101
+ARG WAZUH_GID=101
+
 # Set environment variables
 ENV USER="wazuh-dashboard" \
     GROUP="wazuh-dashboard" \
@@ -60,9 +82,9 @@ COPY config/wazuh_dashboard_config.sh /
 # Update and install dependencies
 RUN yum install shadow-utils -y && \
     yum clean all && \
-    getent group $GROUP || groupadd -r -g 1000 $GROUP && \
+    getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \
     useradd --system \
-    --uid 1000 \
+    --uid ${WAZUH_UID} \
     --no-create-home \
     --home-dir $INSTALL_DIR \
     --gid $GROUP \
@@ -72,13 +94,13 @@ RUN yum install shadow-utils -y && \
     chmod 700 /entrypoint.sh && \
     chmod 700 /wazuh_dashboard_config.sh && \
     mkdir -p $INSTALL_DIR && \
-    chown 1000:1000 $INSTALL_DIR && \
-    chown 1000:1000 /*.sh && \
+    chown ${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR && \
+    chown ${WAZUH_UID}:${WAZUH_GID} /*.sh && \
     mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
 
 # Copy Install dir from builder to current image
-COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
-COPY --from=builder --chown=1000:1000 /etc/wazuh-dashboard $INSTALL_DIR/config/
+COPY --from=builder $INSTALL_DIR $INSTALL_DIR
+COPY --from=builder /etc/wazuh-dashboard $INSTALL_DIR/config/
 
 # Set workdir and user
 WORKDIR $INSTALL_DIR

build-docker-images/wazuh-indexer/Dockerfile

@@ -7,10 +7,28 @@ ARG wazuh_indexer_x86_64_rpm
 ARG wazuh_indexer_aarch64_rpm
 ARG wazuh_certs_tool
 ARG wazuh_config_yml
+ARG WAZUH_UID=101
+ARG WAZUH_GID=101
+
+ENV USER="wazuh-indexer" \
+    GROUP="wazuh-indexer" \
+    NAME="wazuh-indexer" \
+    INSTALL_DIR="/usr/share/wazuh-indexer" 
 
 COPY config/config.sh .
 
-RUN RPM_ARCH="x86_64" && \
+RUN yum install curl-minimal shadow-utils findutils hostname -y && \
+    yum clean all && \
+    getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \
+    useradd --system \
+            --uid ${WAZUH_UID} \
+            --no-create-home \
+            --home-dir $INSTALL_DIR \
+            --gid ${WAZUH_GID} \
+            --shell /sbin/nologin \
+            --comment "$USER user" \
+            $USER && \
+    RPM_ARCH="x86_64" && \
     if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \
     URL_VAR="wazuh_indexer_${RPM_ARCH}_rpm" && \
     indexer_url="${!URL_VAR}" && \
@@ -29,10 +47,14 @@ RUN RPM_ARCH="x86_64" && \
 ################################################################################
 FROM amazonlinux:2023
 
+ARG WAZUH_UID=101
+ARG WAZUH_GID=101
+
 ENV USER="wazuh-indexer" \
     GROUP="wazuh-indexer" \
     NAME="wazuh-indexer" \
-    INSTALL_DIR="/usr/share/wazuh-indexer"
+    INSTALL_DIR="/usr/share/wazuh-indexer" 
+ENV ENGINE_DIR="$INSTALL_DIR/engine"
 
 
 COPY config/entrypoint.sh /
@@ -40,30 +62,37 @@ COPY config/securityadmin.sh /
 
 RUN yum install curl-minimal shadow-utils findutils hostname -y && \
     yum clean all && \
-    getent group $GROUP || groupadd -r -g 1000 $GROUP && \
+    getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \
     useradd --system \
-            --uid 1000 \
+            --uid ${WAZUH_UID} \
             --no-create-home \
             --home-dir $INSTALL_DIR \
-            --gid $GROUP \
+            --gid ${WAZUH_GID} \
             --shell /sbin/nologin \
             --comment "$USER user" \
             $USER && \
     chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && \
     mkdir -p $INSTALL_DIR && \
-    chown 1000:1000 $INSTALL_DIR && \
-    chown 1000:1000 /*.sh && \
-    mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \
-    mkdir -p $INSTALL_DIR/logs && chown 1000:1000 $INSTALL_DIR/logs && \
-    mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \
-    mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer
+    chown ${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR && \
+    chown ${WAZUH_UID}:${WAZUH_GID} /*.sh && \
+    mkdir -p /var/lib/wazuh-indexer && chown ${WAZUH_UID}:${WAZUH_GID} /var/lib/wazuh-indexer && \
+    mkdir -p $INSTALL_DIR/logs && chown ${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR/logs && \
+    mkdir -p /run/wazuh-indexer && chown ${WAZUH_UID}:${WAZUH_GID} /run/wazuh-indexer && \
+    mkdir -p /var/log/wazuh-indexer && chown ${WAZUH_UID}:${WAZUH_GID} /var/log/wazuh-indexer
 
-COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
+COPY --from=builder $INSTALL_DIR $INSTALL_DIR
 
 RUN chmod 700 $INSTALL_DIR && \
     chmod 700 $INSTALL_DIR/config && \
     chmod 600 $INSTALL_DIR/config/jvm.options && \
-    chmod 600 $INSTALL_DIR/config/opensearch.yml
+    chmod 600 $INSTALL_DIR/config/opensearch.yml && \
+    if [ -d "$ENGINE_DIR" ]; then \
+    find "$ENGINE_DIR" -type d -exec chmod 750 {} + && \
+    find "$ENGINE_DIR" -type f -exec chmod 640 {} + && \
+    { [ -f "$ENGINE_DIR/run_engine.sh" ] && chmod 750 "$ENGINE_DIR/run_engine.sh" || true; } && \
+    { [ -f "$ENGINE_DIR/bin/wazuh-engine" ] && chmod 750 "$ENGINE_DIR/bin/wazuh-engine" || true; } && \
+    { [ -d "$ENGINE_DIR/sockets" ] && chmod 777 "$ENGINE_DIR/sockets" || true; }; \
+    fi
 
 USER wazuh-indexer
 WORKDIR $INSTALL_DIR

build-docker-images/wazuh-indexer/config/config.sh

@@ -13,7 +13,9 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config
 # Modify opensearch.yml config paths
 if [ -d "/etc/wazuh-indexer" ]; then
     mkdir -p ${CONFIG_DIR}
+    chown ${USER}:${GROUP} ${CONFIG_DIR}
     mkdir -p ${CONFIG_DIR}/certs
+    chown ${USER}:${GROUP} ${CONFIG_DIR}/certs
     mv /etc/wazuh-indexer/* ${CONFIG_DIR}/
     rmdir /etc/wazuh-indexer
 fi

build-docker-images/wazuh-indexer/config/entrypoint.sh

@@ -58,6 +58,12 @@ function runOpensearch {
         fi
     done < <(env)
 
+    # Start Wazuh Engine
+    if [ -x "$OPENSEARCH_HOME/engine/run_engine.sh" ]; then
+        nohup "$OPENSEARCH_HOME/engine/run_engine.sh" > /dev/null 2>&1 &
+        echo $! > /run/wazuh-indexer/wazuh-engine.pid
+    fi
+
     # Start opensearch
     exec "$@" "${opensearch_opts[@]}"
 

build-docker-images/wazuh-manager/Dockerfile

@@ -1,53 +1,101 @@
 # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
-FROM amazonlinux:2023
 
-RUN rm /bin/sh && ln -s /bin/bash /bin/sh
+################################################################################
+# Build stage 0 (builder):
+# Install Wazuh Manager RPM, configure directories, prepare permanent data,
+# and download tini (static PID-1 init shim).
+################################################################################
+FROM amazonlinux:2023 AS builder
 
 ARG WAZUH_VERSION
-ARG S6_VERSION="v2.2.0.3"
+ARG TINI_VERSION="v0.19.0"
 ARG TARGETARCH
 ARG wazuh_manager_x86_64_rpm
 ARG wazuh_manager_aarch64_rpm
+ARG WAZUH_UID=101
+ARG WAZUH_GID=101
 
-RUN RPM_ARCH="x86_64" && \
+# Prepare permanent data config needed by permanent_data.sh at build time
+COPY config/permanent_data.env config/permanent_data.sh /
+
+RUN dnf install openssl findutils procps shadow-utils -y && \
+    dnf clean all && \
+    getent group wazuh-manager || groupadd -r -g ${WAZUH_GID} wazuh-manager && \
+    getent passwd wazuh-manager || useradd --system \
+        --no-create-home \
+        --home-dir /var/wazuh-manager \
+        --uid ${WAZUH_UID} \
+        --gid ${WAZUH_GID} \
+        --shell /sbin/nologin \
+        wazuh-manager && \
+    RPM_ARCH="x86_64" && \
     if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \
     URL_VAR="wazuh_manager_${RPM_ARCH}_rpm" && \
     manager_url="${!URL_VAR}" && \
-    dnf install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\
+    dnf install curl-minimal xz gnupg tar gzip -y && \
     dnf clean all && \
     curl -o /wazuh-manager.rpm "${manager_url}" && \
     dnf install /wazuh-manager.rpm -y && \
     rm -rf /wazuh-manager.rpm && \
     dnf clean all && \
-    S6_ARCH="amd64" && \
-    if [ "${TARGETARCH}" = "arm64" ]; then S6_ARCH="aarch64"; fi && \
-    curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-${S6_ARCH}.tar.gz \
-    -o /tmp/s6-overlay-${S6_ARCH}.tar.gz && \
-    tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \
-    tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \
-    rm  /tmp/s6-overlay-${S6_ARCH}.tar.gz && \
-    rm -f /var/wazuh-manager/etc/sslmanager.key && \
-    rm -f /var/wazuh-manager/etc/sslmanager.cert
-
-COPY config/etc/ /etc/
-# Prepare permanent data
-# Sync calls are due to https://github.com/docker/docker/issues/9547
-
-COPY config/permanent_data.env config/permanent_data.sh /
-
-#Make mount directories for keep permissions
-
-RUN mkdir -p /var/wazuh-manager/var/multigroups && \
+    # Set up required directories with correct ownership
+    mkdir -p /var/wazuh-manager/var/multigroups && \
     chown root:wazuh-manager /var/wazuh-manager/var/multigroups && \
     chmod 770 /var/wazuh-manager/var/multigroups && \
     mkdir -p /var/wazuh-manager/etc/certs && \
     chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/certs && \
     chmod 500 /var/wazuh-manager/etc/certs && \
-    chmod 755 /permanent_data.sh && \
+    rm -f /var/wazuh-manager/etc/sslmanager.key && \
+    rm -f /var/wazuh-manager/etc/sslmanager.cert
+
+# Prepare permanent data snapshot (sync calls: https://github.com/docker/docker/issues/9547)
+RUN chmod 755 /permanent_data.sh && \
     sync && /permanent_data.sh && \
     sync && rm /permanent_data.sh
 
+# Download tini static binary (no external library dependencies)
+RUN curl --fail --silent -L \
+    https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini-static-${TARGETARCH} \
+    -o /usr/local/bin/tini && \
+    chmod +x /usr/local/bin/tini
+
+################################################################################
+# Build stage 1 (the actual Wazuh Manager image):
+# Copy Wazuh Manager and tini from builder. Install only runtime dependencies.
+################################################################################
+FROM amazonlinux:2023
+
+ARG WAZUH_UID=101
+ARG WAZUH_GID=101
+
+RUN rm /bin/sh && ln -s /bin/bash /bin/sh
+
+# Install only runtime dependencies (no curl, tar, gzip, xz, or full dnf stack)
+RUN dnf install openssl findutils procps shadow-utils -y && \
+    dnf clean all && \
+    getent group wazuh-manager || groupadd -r -g ${WAZUH_GID} wazuh-manager && \
+    getent passwd wazuh-manager || useradd --system \
+        --no-create-home \
+        --home-dir /var/wazuh-manager \
+        --uid ${WAZUH_UID} \
+        --gid ${WAZUH_GID} \
+        --shell /sbin/nologin \
+        wazuh-manager
+
+# Copy Wazuh Manager installation (includes permanent data snapshot)
+COPY --from=builder /var/wazuh-manager /var/wazuh-manager
+
+# Copy tini static binary
+COPY --from=builder /usr/local/bin/tini /usr/local/bin/tini
+
+# Copy entrypoint, init scripts and runtime config
+COPY config/entrypoint.sh /entrypoint.sh
+COPY config/etc/ /etc/
+COPY config/permanent_data.env /
+
+RUN chmod 755 /entrypoint.sh
+
 # Services ports
 EXPOSE 55000/tcp 1514/tcp 1515/tcp 514/udp 1516/tcp
 
-ENTRYPOINT [ "/init" ]
+ENTRYPOINT ["/usr/local/bin/tini", "--", "/entrypoint.sh"]

build-docker-images/wazuh-manager/config/entrypoint.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
+
+# Run initialization and configuration
+bash /etc/cont-init.d/0-wazuh-init
+
+# Start Wazuh Manager (may log warnings in environments without certs)
+bash /etc/cont-init.d/1-manager
+
+# Tail the main log to stdout so Docker captures it
+tail -F /var/wazuh-manager/logs/wazuh-manager.log &
+TAIL_PID=$!
+
+# Graceful shutdown: stop Wazuh and exit cleanly on SIGTERM/SIGINT
+_stop() {
+    echo "Stopping Wazuh Manager..."
+    /var/wazuh-manager/bin/wazuh-manager-control stop 2>/dev/null || true
+    kill "${TAIL_PID}" 2>/dev/null || true
+}
+trap _stop SIGTERM SIGINT SIGQUIT
+
+wait "${TAIL_PID}"

build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init

@@ -1,4 +1,4 @@
-#!/usr/bin/with-contenv bash
+#!/bin/bash
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 
 # Variables
@@ -252,9 +252,9 @@ configure_permissions() {
 ##############################################################################
 
 set_correct_permOwner() {
-  find /var/wazuh-manager/ -group 997 -exec chown :999 {} +;
-  find /var/wazuh-manager/ -group 101 -exec chown :999 {} +;
-  find /var/wazuh-manager/ -user 101 -exec chown 999 {} +;
+  find /var/wazuh-manager/ -group 997 -exec chown :101 {} +;
+  find /var/wazuh-manager/ -group 999 -exec chown :101 {} +;
+  find /var/wazuh-manager/ -user 999 -exec chown 101:{} +;
 }
 
 ##############################################################################

build-docker-images/wazuh-manager/config/etc/cont-init.d/1-manager

@@ -1,4 +1,4 @@
-#!/usr/bin/with-contenv bash
+#!/bin/bash
 
 ##############################################################################
 # Migration sequence

build-docker-images/wazuh-manager/config/etc/services.d/wazuh-manager-logs/run

@@ -1,4 +1,4 @@
-#!/usr/bin/with-contenv sh
+#!/bin/sh
 
 # dumping wazuh-manager.log to standard output
 exec tail -F /var/wazuh-manager/logs/wazuh-manager.log

docs/README.md

@@ -28,7 +28,7 @@ The folder `wazuh-agent` contains a README explaining how to run a container wit
 
 	├── build-docker-images
 	│   ├── build-images.sh
-	│   ├── build-images.yml
+	│   ├── docker-bake.hcl
 	│   ├── README.md
 	│   ├── wazuh-agent
 	│   │   ├── config

docs/dev/workflow-usage.md

@@ -38,7 +38,7 @@ The Procedure_push_docker_images.yml workflow builds and pushes multi-architectu
 2. **Multi-architecture Build**:
    - Uses Docker Buildx with QEMU for cross-platform builds
    - Builds for `linux/amd64` and `linux/arm64`
-   - Leverages `build-images.yml` for build configuration
+   - Leverages `docker-bake.hcl` for parallel multi-arch build configuration
 
 3. **Image Publishing**:
    - Tags images appropriately based on mode

multi-node/Migration-to-Wazuh-4.4.md

@@ -1,283 +0,0 @@
-# Opendistro data migration to Wazuh indexer on docker.
-This procedure explains how to migrate Opendistro data from Opendistro to Wazuh indexer in docker production deployments.
-The example is migrating from v4.2 to v4.4.
-
-## Procedure
-Assuming that you have a v4.2 production deployment, perform the following steps.
-
-**1. Stop 4.2 environment**
-`docker-compose -f production-cluster.yml stop`
-
-**2. List elasticsearch volumes**
-`docker volume ls --filter name='wazuh-docker_elastic-data'`
-
-**3. Inspect elasticsearch volume**
-`docker volume inspect wazuh-docker_elastic-data-1`
-
-**4. Spin down the 4.2 environment.**
-`docker-compose -f production-cluster.yml down`
-
-**Steps 5 and 6 can be done with the volume-migrator.sh script, specifying Docker compose version and project name as parameters.**
-
-Ex: $ multi-node/volume-migrator.sh 1.25.0 multi-node
-
-**5. Run the volume create command:** create new indexer and Wazuh manager volumes using the `com.docker.compose.version` label value from the previous command.
-
-```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=wazuh-indexer-data-1 \
-           multi-node_wazuh-indexer-data-1
-```
-```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=wazuh-indexer-data-2 \
-           multi-node_wazuh-indexer-data-2
-```
-```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=wazuh-indexer-data-3 \
-           multi-node_wazuh-indexer-data-3
-```
-```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=master_wazuh_api_configuration \
-           multi-node_master_wazuh_api_configuration
-```
-```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=master_wazuh_etc \
-           multi-node_docker_wazuh_etc
-```
-```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=master-wazuh-logs \
-           multi-node_master-wazuh-logs
-```
-```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=master-wazuh-queue \
-           multi-node_master-wazuh-queue
-```
-```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=master-wazuh-var-multigroups \
-           multi-node_master-wazuh-var-multigroups
-```
-```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=master-wazuh-active-response \
-           multi-node_master-wazuh-active-response
-```
-```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=master-wazuh-etc \
-           multi-node_master-wazuh-etc
-```
-```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=master-wazuh-var \
-           multi-node_master-wazuh-var
-```
-```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=worker_wazuh_api_configuration \
-           multi-node_worker_wazuh_api_configuration
-```
-```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=worker_wazuh_etc \
-           multi-node_worker-wazuh-etc
-```
-```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=worker-wazuh-logs \
-           multi-node_worker-wazuh-logs
-```
-```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=worker-wazuh-queue \
-           multi-node_worker-wazuh-queue
-```
-```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=worker-wazuh-var-multigroups \
-           multi-node_worker-wazuh-var-multigroups
-```
-```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=worker-wazuh-active-response \
-           multi-node_worker-wazuh-active-response
-```
-```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=worker-wazuh-etc \
-           multi-node_worker-wazuh-etc
-```
-```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=worker-wazuh-var \
-           multi-node_worker-wazuh-var
-```
-**6. Copy the volume content from elasticsearch to Wazuh indexer volumes and old Wazuh manager content to new volumes.**
-```
-docker container run --rm -it \
-           -v wazuh-docker_elastic-data-1:/from \
-           -v multi-node_wazuh-indexer-data-1:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-```
-docker container run --rm -it \
-           -v wazuh-docker_elastic-data-2:/from \
-           -v multi-node_wazuh-indexer-data-2:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-```
-docker container run --rm -it \
-           -v wazuh-docker_elastic-data-3:/from \
-           -v multi-node_wazuh-indexer-data-3:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-```
-docker container run --rm -it \
-           -v wazuh-docker_ossec-api-configuration:/from \
-           -v multi-node_master-wazuh-api-configuration:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-```
-docker container run --rm -it \
-           -v wazuh-docker_ossec-etc:/from \
-           -v multi-node_master-wazuh-etc:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-```
-docker container run --rm -it \
-           -v wazuh-docker_ossec-logs:/from \
-           -v multi-node_master-wazuh-logs:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-```
-docker container run --rm -it \
-           -v wazuh-docker_ossec-queue:/from \
-           -v multi-node_master-wazuh-queue:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-```
-docker container run --rm -it \
-           -v wazuh-docker_ossec-var-multigroups:/from \
-           -v multi-node_master-wazuh-var-multigroups:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-```
-docker container run --rm -it \
-           -v wazuh-docker_ossec-active-response:/from \
-           -v multi-node_master-wazuh-active-response:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-```
-docker container run --rm -it \
-           -v wazuh-docker-etc:/from \
-           -v multi-node_master-etc:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-```
-docker container run --rm -it \
-           -v wazuh-docker-var:/from \
-           -v multi-node_master-wazuh-var:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-```
-docker container run --rm -it \
-           -v wazuh-docker_worker-ossec-api-configuration:/from \
-           -v multi-node_worker-wazuh-api-configuration:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-```
-docker container run --rm -it \
-           -v wazuh-docker_worker-ossec-etc:/from \
-           -v multi-node_worker-wazuh-etc:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-```
-docker container run --rm -it \
-           -v wazuh-docker_worker-ossec-logs:/from \
-           -v multi-node_worker-wazuh-logs:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-```
-docker container run --rm -it \
-           -v wazuh-docker_worker-ossec-queue:/from \
-           -v multi-node_worker-wazuh-queue:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-```
-docker container run --rm -it \
-           -v wazuh-docker_worker-ossec-var-multigroups:/from \
-           -v multi-node_worker-wazuh-var-multigroups:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-```
-docker container run --rm -it \
-           -v wazuh-docker_worker-ossec-active-response:/from \
-           -v multi-node_worker-wazuh-active-response:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-```
-docker container run --rm -it \
-           -v wazuh-docker_worker-etc:/from \
-           -v multi-node_worker-wazuh-etc:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-```
-docker container run --rm -it \
-           -v wazuh-docker_worker-var:/from \
-           -v multi-node_worker-wazuh-var:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-
-**7. Start the 4.4 environment.**
-```
-git checkout 4.4
-cd multi-node
-docker-compose -f generate-indexer-certs.yml run --rm generator
-docker-compose up -d
-```
-
-**8. Check the access to Wazuh dashboard**: go to the Wazuh dashboard using the web browser and check the data.

multi-node/docker-compose.yml

@@ -9,10 +9,11 @@ services:
       wazuh1.indexer:
         condition: service_healthy
     healthcheck:
-      test: [ "CMD-SHELL", "curl -k -s -o /dev/null https://localhost:55000 || exit 1" ]
+      test: [ "CMD-SHELL", "/var/wazuh-manager/bin/wazuh-manager-control status 2>/dev/null | grep -q 'not running' && exit 1 || exit 0" ]
       interval: 15s
       timeout: 5s
       retries: 5
+      start_period: 60s
     ulimits:
       memlock:
         soft: -1
@@ -38,7 +39,7 @@ services:
       - master-wazuh-logs:/var/wazuh-manager/logs
       - master-wazuh-queue:/var/wazuh-manager/queue
       - master-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups
-      - ./config/wazuh_master/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
+      - ./config/root-ca/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
       - ./config/wazuh_master/certs/wazuh.master.pem:/var/wazuh-manager/etc/certs/manager.pem
       - ./config/wazuh_master/certs/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
 
@@ -48,11 +49,11 @@ services:
     container_name: multi-node-wazuh.worker
     restart: always
     healthcheck:
-      test: [ "CMD-SHELL", "timeout 2 bash -c '</dev/tcp/localhost/1514' || exit 1" ]
-      interval: 5s
+      test: [ "CMD-SHELL", "/var/wazuh-manager/bin/wazuh-manager-control status 2>/dev/null | grep -v apid | grep -q 'not running' && exit 1 || exit 0" ]
+      interval: 15s
       timeout: 5s
-      retries: 10
-      start_period: 30s
+      retries: 5
+      start_period: 60s
     ulimits:
       memlock:
         soft: -1
@@ -77,7 +78,7 @@ services:
       - worker-wazuh-logs:/var/wazuh-manager/logs
       - worker-wazuh-queue:/var/wazuh-manager/queue
       - worker-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups
-      - ./config/wazuh_worker/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
+      - ./config/root-ca/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
       - ./config/wazuh_worker/certs/wazuh.worker.pem:/var/wazuh-manager/etc/certs/manager.pem
       - ./config/wazuh_worker/certs/wazuh.worker-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
 
@@ -113,7 +114,7 @@ services:
       start_period: 60s
     volumes:
       - wazuh-indexer-data-1:/var/lib/wazuh-indexer
-      - ./config/wazuh1_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
+      - ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
       - ./config/wazuh1_indexer/certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
       - ./config/wazuh1_indexer/certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
       - ./config/wazuh1_indexer/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
@@ -153,7 +154,7 @@ services:
       start_period: 60s
     volumes:
       - wazuh-indexer-data-2:/var/lib/wazuh-indexer
-      - ./config/wazuh2_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
+      - ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
       - ./config/wazuh2_indexer/certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
       - ./config/wazuh2_indexer/certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
 
@@ -191,7 +192,7 @@ services:
       start_period: 60s
     volumes:
       - wazuh-indexer-data-3:/var/lib/wazuh-indexer
-      - ./config/wazuh3_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
+      - ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
       - ./config/wazuh3_indexer/certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
       - ./config/wazuh3_indexer/certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
 
@@ -223,7 +224,7 @@ services:
     volumes:
       - ./config/wazuh_dashboard/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem
       - ./config/wazuh_dashboard/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem
-      - ./config/wazuh_dashboard/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem
+      - ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem
       - wazuh-dashboard-config:/usr/share/wazuh-dashboard/config
       - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
     depends_on:

multi-node/volume-migrator.sh

@@ -1,213 +0,0 @@
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=wazuh-indexer-data-1 \
-           $2_wazuh-indexer-data-1
-
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=wazuh-indexer-data-2 \
-           $2_wazuh-indexer-data-2
-
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=wazuh-indexer-data-3 \
-           $2_wazuh-indexer-data-3
-
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=master_wazuh_api_configuration \
-           $2_master_wazuh_api_configuration
-
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=master_wazuh_etc \
-           $2_docker_wazuh_etc
-
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=master-wazuh-logs \
-           $2_master-wazuh-logs
-
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=master-wazuh-queue \
-           $2_master-wazuh-queue
-
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=master-wazuh-var-multigroups \
-           $2_master-wazuh-var-multigroups
-
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=master-wazuh-active-response \
-           $2_master-wazuh-active-response
-
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=master-wazuh-etc \
-           $2_master-wazuh-etc
-
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=master-wazuh-var \
-           $2_master-wazuh-var
-
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=worker_wazuh_api_configuration \
-           $2_worker_wazuh_api_configuration
-
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=worker_wazuh_etc \
-           $2_worker-wazuh-etc
-
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=worker-wazuh-logs \
-           $2_worker-wazuh-logs
-
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=worker-wazuh-queue \
-           $2_worker-wazuh-queue
-
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=worker-wazuh-var-multigroups \
-           $2_worker-wazuh-var-multigroups
-
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=worker-wazuh-active-response \
-           $2_worker-wazuh-active-response
-
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=worker-wazuh-etc \
-           $2_worker-wazuh-etc
-
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=worker-wazuh-var \
-           $2_worker-wazuh-var
-
-docker container run --rm -it \
-           -v wazuh-docker_worker-var:/from \
-           -v $2_worker-wazuh-var:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
-docker container run --rm -it \
-           -v wazuh-docker_elastic-data-1:/from \
-           -v $2_wazuh-indexer-data-1:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
-docker container run --rm -it \
-           -v wazuh-docker_elastic-data-2:/from \
-           -v $2_wazuh-indexer-data-2:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
-docker container run --rm -it \
-           -v wazuh-docker_elastic-data-3:/from \
-           -v $2_wazuh-indexer-data-3:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
-docker container run --rm -it \
-           -v wazuh-docker_ossec-api-configuration:/from \
-           -v $2_master-wazuh-api-configuration:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
-docker container run --rm -it \
-           -v wazuh-docker_ossec-etc:/from \
-           -v $2_master-wazuh-etc:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
-docker container run --rm -it \
-           -v wazuh-docker_ossec-logs:/from \
-           -v $2_master-wazuh-logs:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
-docker container run --rm -it \
-           -v wazuh-docker_ossec-queue:/from \
-           -v $2_master-wazuh-queue:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
-docker container run --rm -it \
-           -v wazuh-docker_ossec-var-multigroups:/from \
-           -v $2_master-wazuh-var-multigroups:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
-docker container run --rm -it \
-           -v wazuh-docker_ossec-active-response:/from \
-           -v $2_master-wazuh-active-response:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
-docker container run --rm -it \
-           -v wazuh-docker-etc:/from \
-           -v $2_master-wazuh-etc:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
-docker container run --rm -it \
-           -v wazuh-docker-var:/from \
-           -v $2_master-wazuh-var:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
-docker container run --rm -it \
-           -v wazuh-docker_worker-ossec-api-configuration:/from \
-           -v $2_worker-wazuh-api-configuration:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
-docker container run --rm -it \
-           -v wazuh-docker_worker-ossec-etc:/from \
-           -v $2_worker-wazuh-etc:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
-docker container run --rm -it \
-           -v wazuh-docker_worker-ossec-logs:/from \
-           -v $2_worker-wazuh-logs:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
-docker container run --rm -it \
-           -v wazuh-docker_worker-ossec-queue:/from \
-           -v $2_worker-wazuh-queue:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
-docker container run --rm -it \
-           -v wazuh-docker_worker-ossec-var-multigroups:/from \
-           -v $2_worker-wazuh-var-multigroups:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
-docker container run --rm -it \
-           -v wazuh-docker_worker-ossec-active-response:/from \
-           -v $2_worker-wazuh-active-response:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
-docker container run --rm -it \
-           -v wazuh-docker_worker-etc:/from \
-           -v $2_worker-wazuh-etc:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
-docker container run --rm -it \
-           -v wazuh-docker_worker-var:/from \
-           -v $2_worker-wazuh-var:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"

single-node/docker-compose.yml

@@ -9,10 +9,11 @@ services:
       wazuh.indexer:
         condition: service_healthy
     healthcheck:
-      test: [ "CMD-SHELL", "curl -k -s -o /dev/null https://localhost:55000 || exit 1" ]
+      test: [ "CMD-SHELL", "/var/wazuh-manager/bin/wazuh-manager-control status 2>/dev/null | grep -q 'not running' && exit 1 || exit 0" ]
       interval: 15s
       timeout: 5s
       retries: 5
+      start_period: 60s
     ulimits:
       memlock:
         soft: -1
@@ -38,7 +39,7 @@ services:
       - wazuh_logs:/var/wazuh-manager/logs
       - wazuh_queue:/var/wazuh-manager/queue
       - wazuh_var_multigroups:/var/wazuh-manager/var/multigroups
-      - ./config/wazuh_manager/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
+      - ./config/root-ca/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
       - ./config/wazuh_manager/certs/wazuh.manager.pem:/var/wazuh-manager/etc/certs/manager.pem
       - ./config/wazuh_manager/certs/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
 
@@ -73,7 +74,7 @@ services:
       start_period: 60s
     volumes:
       - wazuh-indexer-data:/var/lib/wazuh-indexer
-      - ./config/wazuh_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
+      - ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
       - ./config/wazuh_indexer/certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
       - ./config/wazuh_indexer/certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
       - ./config/wazuh_indexer/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
@@ -107,7 +108,7 @@ services:
     volumes:
       - ./config/wazuh_dashboard/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/dashboard.pem
       - ./config/wazuh_dashboard/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem
-      - ./config/wazuh_dashboard/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem
+      - ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem
       - wazuh-dashboard-config:/usr/share/wazuh-dashboard/config
       - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
     depends_on:

tools/repository_bumper.sh

@@ -9,6 +9,8 @@ DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 LOG_FILE="${DIR}/tools/repository_bumper_$(date +"%Y-%m-%d_%H-%M-%S-%3N").log"
 VERSION=""
 STAGE=""
+TAG=""
+REFERENCE=""
 FILES_EDITED=()
 FILES_EXCLUDED='--exclude="repository_bumper_*.log" --exclude="CHANGELOG.md" --exclude="repository_bumper.sh" --exclude="*_bumper_repository.yml" --exclude="mermaid-init.js" --exclude="mermaid.min.js"'
 
@@ -74,40 +76,44 @@ update_stage_in_files() {
             FILES_EDITED+=("${file}")
         fi
     done
+}
 
-    if [ $STAGE != "alpha0" ]; then
-        version_tag_string=": 'v${VERSION}'"
-        files_tag=( $(grep_command "${version_tag_string}" "${DIR}") )
-        for file in "${files_tag[@]}"; do
-            sed -i -E "s/(: )'v${VERSION}'/\1'v${VERSION}-${STAGE}'/g" "${file}"
-            if [[ $(git diff --name-only "${file}") ]]; then
-                FILES_EDITED+=("${file}")
-            fi
-        done
-
-        version_number_string=": '${VERSION}'"
-        files_version=( $(grep -RlE ": '[0-9]\.[0-9]+\.[0-9]+'" "${DIR}") )
-        for file in "${files_version[@]}"; do
-            sed -i -E "s/(: )'${VERSION}'/\1'v${VERSION}-${STAGE}'/g" "${file}"
-            if [[ $(git diff --name-only "${file}") ]]; then
-                FILES_EDITED+=("${file}")
-            fi
-        done
+# Compute the value written into branch reference defaults ("<key>: '...'").
+# Without --tag, references stay branch-like (e.g. 5.0.0).
+# With --tag, references become tag-like (e.g. v5.0.0-beta3), or a plain release
+# tag (e.g. v5.0.0) when no stage is provided.
+build_reference() {
+    if [[ -n "$TAG" ]]; then
+        if [[ -z "$STAGE" ]]; then
+            REFERENCE="v${VERSION}"
+        else
+            REFERENCE="v${VERSION}-${STAGE}"
+        fi
+    else
+        REFERENCE="${VERSION}"
     fi
 }
 
+# Tag mode only: normalize every reference to the current version
+# (branch-like "5.0.0", "v5.0.0" or "v5.0.0-<stage>") into ${REFERENCE}.
+# Matching is restricted to "<key>: '...'" entries so plain version strings
+# elsewhere in the repository are left untouched.
+update_tag_references() {
+    local V_ESC="${VERSION//./\\.}"
+    files=( $(grep_command "${VERSION}" "${DIR}") )
+    for file in "${files[@]}"; do
+        sed -Ei "s/(:[[:space:]]*')v?${V_ESC}(-[A-Za-z0-9]+)?(')/\1${REFERENCE}\3/g" "${file}"
+        if [[ $(git diff --name-only "${file}") ]]; then
+            FILES_EDITED+=("${file}")
+        fi
+    done
+}
+
 update_main_in_files() {
-    if [[ $STAGE == "alpha0" ]]; then
-            bump_value="${VERSION}"
-    else
-            bump_value="v${VERSION}"
-    fi
-    main_string=": 'main'"
+    local main_string=": 'main'"
     files=( $(grep_command "${main_string}" "${DIR}") )
     for file in "${files[@]}"; do
-        if [[ "$skip_urls" != "yes" ]]; then
-            sed -Ei "s/(:[[:space:]])'main'/\1'${bump_value}'/g" "${file}"
-        fi
+        sed -Ei "s/(:[[:space:]])'main'/\1'${REFERENCE}'/g" "${file}"
         if [[ $(git diff --name-only "${file}") ]]; then
             FILES_EDITED+=("${file}")
         fi
@@ -141,8 +147,8 @@ main() {
                 shift 2
                 ;;
             --tag)
-                TAG="$2"
-                shift 2
+                TAG="yes"
+                shift 1
                 ;;
             --set-as-main)
                 set_as_main="yes"
@@ -155,15 +161,33 @@ main() {
         esac
     done
 
-    # Validate arguments
-    if [[ -z "${VERSION}" ]]; then
-        echo "Error: --version argument is required." | tee -a "${LOG_FILE}"
+    # --tag rewrites branch references into tag-like references (e.g. v5.0.0-beta3)
+    # and re-tags the Docker images accordingly. It is mutually exclusive with
+    # --set-as-main, which keeps references on main.
+    if [[ -n "$TAG" && -n "$set_as_main" ]]; then
+        echo "Error: --tag cannot be combined with --set-as-main." | tee -a "${LOG_FILE}"
         exit 1
     fi
 
-    if [[ -z "${STAGE}" ]]; then
-        echo "Error: --stage argument is required." | tee -a "${LOG_FILE}"
-        exit 1
+    # Read the current version/stage early: tag scenarios may omit --version and/or
+    # --stage and reuse the values already stored in VERSION.json.
+    get_old_version_and_stage
+
+    # Resolve and validate arguments depending on the mode
+    if [[ -n "$TAG" ]]; then
+        # Tag mode: version defaults to the current one; stage is optional
+        # (absent yields a release tag without a stage suffix).
+        [[ -z "$VERSION" ]] && VERSION="$OLD_VERSION"
+    else
+        # Branch mode: a full version + stage bump is required
+        if [[ -z "${VERSION}" ]]; then
+            echo "Error: --version argument is required." | tee -a "${LOG_FILE}"
+            exit 1
+        fi
+        if [[ -z "${STAGE}" ]]; then
+            echo "Error: --stage argument is required." | tee -a "${LOG_FILE}"
+            exit 1
+        fi
     fi
 
     # Validate if version is in the correct format
@@ -172,28 +196,25 @@ main() {
         exit 1
     fi
 
-    # Validate if stage is in the correct format
-    STAGE=$(echo "${STAGE}" | tr '[:upper:]' '[:lower:]')
-    if ! [[ "${STAGE}" =~ ^(alpha[0-9]*|beta[0-9]*|rc[0-9]*|stable)$ ]]; then
-        echo "Error: Stage must be one of the following examples: alpha1, beta1, rc1, stable." | tee -a "${LOG_FILE}"
-        exit 1
+    # Validate if stage is in the correct format (when provided)
+    if [[ -n "${STAGE}" ]]; then
+        STAGE=$(echo "${STAGE}" | tr '[:upper:]' '[:lower:]')
+        if ! [[ "${STAGE}" =~ ^(alpha[0-9]*|beta[0-9]*|rc[0-9]*|stable)$ ]]; then
+            echo "Error: Stage must be one of the following examples: alpha1, beta1, rc1, stable." | tee -a "${LOG_FILE}"
+            exit 1
+        fi
     fi
 
-    # Set skip_urls variable based on set_as_main flag
+    # Compute the value written into branch reference defaults
+    build_reference
+    echo "Reference for branch defaults: ${REFERENCE}" | tee -a "${LOG_FILE}"
+
+    # Convert 'main' references unless they must keep pointing to main (set-as-main)
     if [[ -z "$set_as_main" ]]; then
-        echo "Updating version from main to $VERSION" | tee -a "${LOG_FILE}"
-        update_main_in_files "$VERSION" "$STAGE"
+        echo "Updating 'main' references to ${REFERENCE}" | tee -a "${LOG_FILE}"
+        update_main_in_files
     fi
 
-    # Validate if tag is true or false
-    if [[ -n "${TAG}" && ! "${TAG}" =~ ^(true|false)$ ]]; then
-        echo "Error: --tag must be either true or false." | tee -a "${LOG_FILE}"
-        exit 1
-    fi
-
-    # Get old version and stage
-    get_old_version_and_stage
-
     if [[ "${OLD_VERSION}" != "${VERSION}" ]]; then
         echo "Updating version from ${OLD_VERSION} to ${VERSION}" | tee -a "${LOG_FILE}"
         update_version_in_files "${VERSION}"
@@ -203,10 +224,13 @@ main() {
         update_stage_in_files "$VERSION" "$STAGE"
     fi
 
-    # Update Docker images tag if tag is true
-    if [[ "${TAG}" == "true" ]]; then
-        echo "Updating Docker images tag to ${VERSION}-${STAGE}" | tee -a "${LOG_FILE}"
-        update_docker_images_tag "${VERSION}-${STAGE}"
+    # Tag mode: normalize remaining version references and re-tag the Docker images
+    # (image tags carry no leading 'v', e.g. 5.0.0-beta3).
+    if [[ -n "$TAG" ]]; then
+        echo "Updating version references to tag reference ${REFERENCE}" | tee -a "${LOG_FILE}"
+        update_tag_references
+        echo "Updating Docker images tag to ${REFERENCE#v}" | tee -a "${LOG_FILE}"
+        update_docker_images_tag "${REFERENCE#v}"
     fi
 
 

tools/utils/deployment/certificates-conf.sh

@@ -77,6 +77,8 @@ node_to_dir() {
 # ---------------------------------------------------------------------------
 
 # Parse config.yml
+export WAZUH_UID=101
+export WAZUH_GID=101
 if $DO_COPY || $DO_PRIV; then
   if [ ! -f "$CONFIG_FILE" ]; then
     echo "Error: Configuration file $CONFIG_FILE not found."
@@ -102,7 +104,6 @@ if $DO_COPY; then
     echo "Copying certificates for indexer: $node -> config/$dir_name/certs/"
     mkdir -p "./config/$dir_name/certs"
     cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/"
-    cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/"
     if $FIRST_INDEXER; then
       cp "$OUTPUT_DIR"/admin* "./config/$dir_name/certs/"
       FIRST_INDEXER=false
@@ -114,7 +115,6 @@ if $DO_COPY; then
     echo "Copying certificates for manager: $node -> config/$dir_name/certs/"
     mkdir -p "./config/$dir_name/certs"
     cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/"
-    cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/"
   done
 
   for node in "${DASHBOARD_NODES[@]}"; do
@@ -122,32 +122,37 @@ if $DO_COPY; then
     echo "Copying certificates for dashboard: $node -> config/$dir_name/certs/"
     mkdir -p "./config/$dir_name/certs"
     cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/"
-    cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/"
   done
+  echo "Copying root-ca certificates -> config/root-ca/certs/"
+  mkdir -p "./config/root-ca/certs"
+  cp "$OUTPUT_DIR"/root-ca* "./config/root-ca/certs/"
 fi
 
 # 3. Set ownership and permissions
 if $DO_PRIV; then
   for node in "${INDEXER_NODES[@]}"; do
     dir_name=$(node_to_dir "$node")
-    echo "Setting permissions for indexer $node (1000:1000)"
-    chown -R 1000:1000 "./config/$dir_name/certs"
+    echo "Setting permissions for indexer $node (${WAZUH_UID}:${WAZUH_GID})"
+    chown -R ${WAZUH_UID}:${WAZUH_GID} "./config/$dir_name/certs"
     chmod 400 "./config/$dir_name/certs/"*
   done
 
   for node in "${MANAGER_NODES[@]}"; do
     dir_name=$(node_to_dir "$node")
-    echo "Setting permissions for manager $node (999:999)"
-    chown -R 999:999 "./config/$dir_name/certs"
+    echo "Setting permissions for manager $node (${WAZUH_UID}:${WAZUH_GID})"
+    chown -R ${WAZUH_UID}:${WAZUH_GID} "./config/$dir_name/certs"
     chmod 400 "./config/$dir_name/certs/"*
   done
 
   for node in "${DASHBOARD_NODES[@]}"; do
     dir_name=$(node_to_dir "$node")
-    echo "Setting permissions for dashboard $node (1000:1000)"
-    chown -R 1000:1000 "./config/$dir_name/certs"
+    echo "Setting permissions for dashboard $node (${WAZUH_UID}:${WAZUH_GID})"
+    chown -R ${WAZUH_UID}:${WAZUH_GID} "./config/$dir_name/certs"
     chmod 400 "./config/$dir_name/certs/"*
   done
+  echo "Setting permissions for root-ca certificates (${WAZUH_UID}:${WAZUH_GID})"
+  chown -R ${WAZUH_UID}:${WAZUH_GID} "./config/root-ca/certs"
+  chmod 400 "./config/root-ca/certs/"*
 fi
 
 echo "Process completed."