Skip to content

docs(eck): add container image support scope note to install page #7056

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jeanfabrice wants to merge 4 commits into
base: main
Choose a base branch
from
Open

docs(eck): add container image support scope note to install page #7056

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1cfe682
docs(eck): add container image support note to install.md
jeanfabrice Jun 22, 2026
ad1fc69
docs(eck): rework hardened container image section in install.md
jeanfabrice Jun 22, 2026
9af80bb
docs(eck): apply shainaraskas review recommendations
jeanfabrice Jun 22, 2026
9dcb474
Merge branch 'main' into jeanfabrice/eck-supported-images-note
jeanfabrice Jun 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions deploy-manage/deploy/cloud-on-k8s/install.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,16 @@ Deleting CRDs will trigger deletion of all custom resources ({{eck_resources_lis

For a list of supported Kubernetes versions refer to [](../cloud-on-k8s.md#k8s-supported)

## Hardened ECK container image [k8s-installing-eck-container-image]

@shainaraskas shainaraskas Jun 23, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this page is the gate to all of the child pages, so this is too prominent. please move it below installation methods


Elastic has partnered with [Chainguard](https://www.chainguard.dev/) to provide hardened container images based on [Wolfi](https://wolfi.dev), a minimal, security-focused Linux distribution designed for containerized environments. These images significantly reduce the CVE footprint of Elastic containers by including only the application and its necessary runtime dependencies. For background on this initiative, refer to the blog post [Reducing CVEs in Elastic container images](https://www.elastic.co/blog/reducing-cves-in-elastic-container-images).

Since ECK 2.15, the ECK operator image is built on Wolfi by default. No additional configuration is required — pulling the standard operator image from `docker.elastic.co` already provides a hardened, Wolfi-based container.

@shainaraskas shainaraskas Jun 23, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

prefer not referring to 2.15 because these are the 3.x docs ... we can keep it if you think it will save a lot of support headaches

@shainaraskas shainaraskas Jun 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is not the case for openshift/fips, right? we need to specify that


::::{note}
Only images distributed through `docker.elastic.co` are officially supported by Elastic. Third-party hardened image sources, such as Docker Hardened Images (DHI) on Docker Hub, are not maintained by Elastic and fall outside the scope of Elastic support.

@shainaraskas shainaraskas Jun 23, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we distribute images through a couple of other places that we might not want to pretend don't exist, right? the first one is the fips image which is hardened in a different way we might want to acknowledge

cgr.dev/chainguard/glibc-dynamic
registry.access.redhat.com/ubi9/ubi-micro

::::

## Installation methods

ECK supports multiple installation methods. Choose the one that best fits your infrastructure:
Expand Down
Loading