[Filebeat/Journald] allow to use a chroot when calling `journalctl` #48008

belimawr · 2025-12-09T17:52:26Z

Proposed commit message

Add support in the journald inpur for using chroot when calling
`journalctl`. In a container environment this allows to mount the host
file system into the container and use its `journalctl`, which
prevents any sort of incompatibility between the `journalctl` in the
container image and the host Journald.

Checklist

My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
I have made corresponding change to the default configuration files
I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
I have added an entry in ./changelog/fragments using the changelog tool.

~~## Disruptive User Impact~~

Author's Checklist

Finish manual testing steps

How to test this PR locally

Run the tests

cd filebeat
go test -v -count=1 -tags=integration -run=TestNewFactoryChroot ./input/journald/pkg/journalctl
go test -tags=integration -v -count=1 -run=TestJournaldChroot ./tests/integration

Manual testing

1. Create a `filebeat.yml`

filebeat.yml

filebeat.inputs:
  - type: journald
    id: journald-input-id
    chroot: /host
    journalctl_path: /usr/bin/journalctl

output.discard:
  enabled: true

# output.console:
#   enabled: true
#   pretty: false

logging:
  to_stderr: true
  metrics.period: 5s

2. Build a staicaly linked Filebeat binary

CGO_ENABLED=0 go build -ldflags '-extldflags "-static" -s' -tags timetzdata .

3. Create a Dockerfile and build a test image

Dockerfile

FROM alpine:latest AS prep

FROM scratch

COPY --from=prep /etc/alpine-release /etc/alpine-release
COPY filebeat /
COPY filebeat.yml /
ENTRYPOINT ["/filebeat"]
CMD ["-c", "/filebeat.yml", "--strict.perms=false"]

docker build -t filebeat-chroot-test .

4. Run the container

docker run --rm -v /:/host filebeat-chroot-test

You should see in the logs the journalctl starting:

{
  "@timestamp": "2025-12-10T17:10:04.317Z",
  "ecs.version": "1.6.0",
  "id": "journald-input-id",
  "input_id": "journald-input-id",
  "input_source": "LOCAL_SYSTEM_JOURNAL",
  "log.level": "info",
  "log.logger": "input.journald.reader.journalctl-runner",
  "log.origin": {
    "file.line": 152,
    "file.name": "journalctl/journalctl.go",
    "function": "github.com/elastic/beats/v7/filebeat/input/journald/pkg/journalctl.NewFactory.func1"
  },
  "message": "Journalctl command: journalctl --utc --output=json --no-pager --all --follow --no-tail --boot all",
  "path": "LOCAL_SYSTEM_JOURNAL",
  "service.name": "filebeat"
}
{
  "@timestamp": "2025-12-10T17:10:04.317Z",
  "ecs.version": "1.6.0",
  "id": "journald-input-id",
  "input_id": "journald-input-id",
  "input_source": "LOCAL_SYSTEM_JOURNAL",
  "log.level": "info",
  "log.logger": "input.journald.reader.journalctl-runner",
  "log.origin": {
    "file.line": 158,
    "file.name": "journalctl/journalctl.go",
    "function": "github.com/elastic/beats/v7/filebeat/input/journald/pkg/journalctl.NewFactory.func1"
  },
  "message": "journalctl started with PID 23",
  "path": "LOCAL_SYSTEM_JOURNAL",
  "service.name": "filebeat"
}

You can also see the number events published in the metrics that are logged every 5s.

If you want to see the events, remove the discard output and uncomment
the console output in filebeat.yml, then rebuild the docker image
and run it again.

Related issues

Closes [Filebeat/Journald] When in a container, use chroot to run journalctl from the host, thus eliminating version issues #47323

~~## Use cases~~
~~## Screenshots~~
~~## Logs~~

github-actions · 2025-12-09T17:52:37Z

🤖 GitHub comments

Just comment with:

run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

belimawr · 2025-12-09T20:39:30Z

The failing test on Windows is unrelated to this PR. The flaky test issue: #48009

github-actions · 2025-12-10T22:14:47Z

🔍 Preview links for changed docs

docs/reference/filebeat/filebeat-input-journald.md

elasticmachine · 2025-12-11T13:01:07Z

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

AndersonQ

just a few suggestions

filebeat/input/journald/pkg/journalctl/journalctl.go

filebeat/input/journald/config.go

filebeat/tests/integration/chroot_test.go

cmacknz

Most of my concerns are security related, executing whatever happens to be called journalctl in the path as root seems like a not so good idea.

cmacknz · 2025-12-12T16:45:02Z

changelog/fragments/1765318668-Support-chroot-in-journald.yaml

+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+# NOTE: This field will be rendered only for breaking-change and known-issue kinds at the moment.
+#description:


Suggested change

#description:

description: |

Add support in the journald inpur for using chroot when calling

`journalctl`. In a container environment this allows to mount the host

file system into the container and use its `journalctl`, which

prevents any sort of incompatibility between the `journalctl` in the

container image and the host Journald. Allows using the journald input with Wolfi based Docker containers.

Let's include the context from the PR to help people know why they would want to use this.

cmacknz · 2025-12-12T16:50:07Z

docs/reference/filebeat/filebeat-input-journald.md

+When using the Journald input from a Docker container, make sure that
+either:
+ - {applies_to}`stack: ga 9.3.0` [`chroot`](#filebeat-input-journald-chroot), [`journalct_path`](#filebeat-input-journald-journalctl-path) are set, or
+ - The `journalctl` binary in the container is compatible with your


List the container variants that include journald by default.

cmacknz · 2025-12-12T16:51:46Z

filebeat/_meta/config/filebeat.inputs.reference.yml.tmpl

+  # The absolute path for the `journalctl` binary. If not set Filebeat
+  # will look for `journalctl` in `PATH`. When using


Do we want to allow executing whatever thing called journalctl we happen find?

That seems less secure than requiring the absolute path to the binary, as there is only a single file system path that can be exploited now.

Especially if we execute journalctl as root, we should narrow the scope of what we will execute as much as possible.

The only reason to just look for journalctl is if the path to it isn't consistent all hosts, where finding it then becomes really annoying.

On an ubuntu24 box I see it as the following which is certainly not hard to find.

ubuntu@ubuntu24:~$ which journalctl /usr/bin/journalctl

If we think using PATH is necessary we could make it optional and default to off.

cmacknz · 2025-12-12T17:37:52Z

filebeat/input/journald/pkg/journalctl/journalctl.go

+					if !errors.Is(err, io.EOF) {
+						var logError = false
+						var pathError *fs.PathError
+						if errors.As(err, &pathError) {


Why isn't this also handled for stderr?

cmacknz · 2025-12-12T17:38:48Z

filebeat/input/journald/pkg/journalctl/journalctl.go

+
+		jctlCommandMsg := fmt.Sprintf("Journalctl command: %s %s", journalctlPath, strings.Join(args, " "))
+		if chroot != "" {
+			jctlCommandMsg = fmt.Sprintf("%s Chroot: %s (command path relative to chroot)", jctlCommandMsg, chroot)


Would be a bit tidier to use InfoW with command and chroot keys instead of this formatting IMO.

cmacknz · 2025-12-12T17:43:42Z

filebeat/input/journald/input.go

+			return nil, nil, fmt.Errorf("provided chroot (%s) is not a directory", config.Chroot)
+		}
+
+		fullPath := filepath.Join(config.Chroot, config.JournalctlPath)


We may want to verify the ownership of the file, maybe that it is only writable by root so it can't be replaced by something from an arbitrary user, especially if we are going to execute it as root.

Speaking of executing it as a root, if we can execute this as a lower privileged user that would help the security boundary here too.

cmacknz · 2025-12-12T17:46:14Z

docs/reference/filebeat/filebeat-input-journald.md

+```
+A folder to be used as chroot when calling `journalctl`. This allows
+Filebeat to call the host's `journalctl` directly. If using this
+option, {{filebeat}} must be run as root and


The wolfi containers are not root by default, you will need examples of how to give the capabilities needed to do this.

You potentially only need CAP_SYS_CHROOT and not all the root capabilities, we should identify what the least privileged way for this to execute is.

If we can say that you just need CAP_SYS_CHROOT without actually being uid 0 that would help considerably so we are also not executing potentially arbitrary commands as root.

belimawr added 2 commits December 9, 2025 12:48

Add chroot support for journald input

9f84117

Merge branch 'main' of github.com:elastic/beats into journald-chroot

a12aa54

belimawr self-assigned this Dec 9, 2025

belimawr added backport-skip Skip notification from the automated backport with mergify Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team labels Dec 9, 2025

botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Dec 9, 2025

belimawr added 3 commits December 9, 2025 16:54

Cleanup and improve test

624405b

Clean up

25ee4d3

Add docs and changelog

7bc0cfd

github-actions bot had a problem deploying to docs-preview December 9, 2025 22:20 Failure

Update config file

1e77ec8

github-actions bot had a problem deploying to docs-preview December 9, 2025 22:26 Failure

Small improvements

ec3b019

github-actions bot had a problem deploying to docs-preview December 9, 2025 22:41 Failure

belimawr changed the title ~~[WIP] Journald chroot~~ [Filebeat/Journald] allow to use a chroot when calling journalctl Dec 9, 2025

Add integration build tag

09eb57d

github-actions bot had a problem deploying to docs-preview December 9, 2025 22:47 Failure

small improvements

f19ab67

github-actions bot had a problem deploying to docs-preview December 9, 2025 23:53 Failure

Update seccomp policy

d51036b

github-actions bot had a problem deploying to docs-preview December 10, 2025 17:12 Failure

belimawr added 4 commits December 10, 2025 15:25

[WIP] Integration tests

b303a39

Test cleanup

295f7b8

Remove container after test

21cf345

Add headers

df0ff3f

github-actions bot had a problem deploying to docs-preview December 10, 2025 21:38 Failure

Small improvements

ec90ee8

github-actions bot had a problem deploying to docs-preview December 10, 2025 21:48 Failure

rename function

e36d12b

github-actions bot had a problem deploying to docs-preview December 10, 2025 21:54 Failure

Fix/improve docs

f4c55ce

github-actions bot deployed to docs-preview December 10, 2025 22:13 View deployment

belimawr marked this pull request as ready for review December 11, 2025 13:01

belimawr requested review from a team as code owners December 11, 2025 13:01

belimawr requested review from AndersonQ and faec December 11, 2025 13:01

AndersonQ approved these changes Dec 12, 2025

View reviewed changes

belimawr added 2 commits December 12, 2025 09:31

Review suggestions and fix linter warnings

b132d06

Merge branch 'main' of github.com:elastic/beats into journald-chroot

29f4920

belimawr requested a review from AndersonQ December 12, 2025 14:33

github-actions bot deployed to docs-preview December 12, 2025 14:33 View deployment

Update comments

20893dd

github-actions bot deployed to docs-preview December 12, 2025 14:46 View deployment

cmacknz reviewed Dec 12, 2025

View reviewed changes

		# The absolute path for the `journalctl` binary. If not set Filebeat
		# will look for `journalctl` in `PATH`. When using

[Filebeat/Journald] allow to use a chroot when calling journalctl #48008

Are you sure you want to change the base?

[Filebeat/Journald] allow to use a chroot when calling journalctl #48008

Uh oh!

Conversation

belimawr commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Run the tests

Manual testing

1. Create a filebeat.yml

2. Build a staicaly linked Filebeat binary

3. Create a Dockerfile and build a test image

4. Run the container

Related issues

Uh oh!

github-actions bot commented Dec 9, 2025

🤖 GitHub comments

Uh oh!

belimawr commented Dec 9, 2025

Uh oh!

github-actions bot commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

elasticmachine commented Dec 11, 2025

Uh oh!

AndersonQ left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cmacknz left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

[Filebeat/Journald] allow to use a chroot when calling `journalctl` #48008

[Filebeat/Journald] allow to use a chroot when calling `journalctl` #48008

belimawr commented Dec 9, 2025 •

edited

Loading

1. Create a `filebeat.yml`

github-actions bot commented Dec 10, 2025 •

edited

Loading

cmacknz left a comment •

edited

Loading