faliarin/etcd repository overview

⁠etcd Docker Image

This Dockerfile builds a custom etcd container image from source code using a multi-stage build process.

⁠Overview

etcd is a distributed, reliable key-value store for the most critical data of a distributed system. This Docker image compiles etcd from source and packages it in a lightweight Alpine Linux container.

Key Features:

• Multi-stage build for optimized image size
• Runs as non-root user for enhanced security
• Pre-configured data directory with proper permissions
• Includes all etcd binaries (etcd, etcdctl, etcdutl)
• Built-in health check monitoring
• Volume declaration for data persistence

⁠Build Arguments

The following build arguments can be customized when building the image:

⁠Building the Image

⁠Default build:

docker build -t etcd:latest .

⁠Custom etcd version:

docker build --build-arg ETCD_VERSION=3.5.9 -t etcd:3.5.9 .

⁠Custom Go version:

docker build --build-arg GO_VERSION=1.22.5 -t etcd:go1.22 .

⁠Exposed Ports

⁠Available Binaries

The image includes the following etcd binaries:

• etcd - The main etcd server binary (default entrypoint)
• etcdctl - Command-line client for etcd
• etcdutl - Utility for etcd maintenance operations

⁠Usage Examples

⁠Single Node etcd Server

docker run -d \
  --name etcd \
  -p 2379:2379 \
  -p 2380:2380 \
  etcd:latest \
  etcd \
  --name s1 \
  --data-dir /data/etcd \
  --listen-client-urls http://0.0.0.0:2379 \
  --advertise-client-urls http://0.0.0.0:2379 \
  --listen-peer-urls http://0.0.0.0:2380 \
  --initial-advertise-peer-urls http://0.0.0.0:2380 \
  --initial-cluster s1=http://0.0.0.0:2380 \
  --initial-cluster-token tkn \
  --initial-cluster-state new \
  --log-level info \
  --logger zap \
  --log-outputs stderr

⁠Using etcdctl

# Run etcdctl commands
docker run --rm -it \
  --network container:etcd \
  etcd:latest \
  etcdctl --endpoints=http://localhost:2379 member list

# Set a key-value pair
docker run --rm -it \
  --network container:etcd \
  etcd:latest \
  etcdctl --endpoints=http://localhost:2379 put mykey myvalue

# Get a value
docker run --rm -it \
  --network container:etcd \
  etcd:latest \
  etcdctl --endpoints=http://localhost:2379 get mykey

⁠Using etcdutl

# Backup etcd data
docker run --rm -it \
  -v etcd-data:/data/etcd \
  -v $(pwd):/backup \
  etcd:latest \
  etcdutl snapshot save /backup/etcd-snapshot.db --data-dir /data/etcd

⁠Environment Variables

This Dockerfile sets the following default environment variables:

etcd also supports numerous other environment variables for configuration:

⁠Common etcd Environment Variables

⁠Using Environment Variables

# Override default environment variables
docker run -d \
  --name etcd \
  -p 2379:2379 \
  -p 2380:2380 \
  -e ETCD_NAME=node1 \
  -e ETCD_DATA_DIR=/data/etcd \
  -e ETCD_LISTEN_CLIENT_URLS=http://0.0.0.0:2379 \
  -e ETCD_ADVERTISE_CLIENT_URLS=http://localhost:2379 \
  -e ETCD_LISTEN_PEER_URLS=http://0.0.0.0:2380 \
  -e ETCD_INITIAL_ADVERTISE_PEER_URLS=http://localhost:2380 \
  -e ETCD_INITIAL_CLUSTER=node1=http://localhost:2380 \
  -e ETCD_INITIAL_CLUSTER_STATE=new \
  -e ETCD_INITIAL_CLUSTER_TOKEN=etcd-cluster-1 \
  etcd:latest

⁠Data Persistence

To persist etcd data, mount a volume to the data directory:

docker run -d \
  --name etcd \
  -p 2379:2379 \
  -p 2380:2380 \
  -v etcd-data:/data/etcd \
  etcd:latest \
  etcd --data-dir=/data/etcd [other-options...]

⁠Health Monitoring

The image includes a built-in health check that monitors etcd's endpoint health:

# Check container health status
docker ps --format "table {{.Names}}\t{{.Status}}"

# View health check logs
docker inspect --format='{{json .State.Health}}' etcd-container | jq

The health check runs every 30 seconds and checks if etcd is responding on port 2379.

⁠Security Considerations

This image implements several security best practices:

• ✅ Non-root user: Runs as etcd user (not root)
• ✅ Proper file permissions: Data directory owned by etcd user
• ⚠️ Authentication disabled by default: ALLOW_NONE_AUTHENTICATION="yes"

For production use, additionally consider:

• Using TLS for client and peer communication
• Enabling authentication and authorization (set ALLOW_NONE_AUTHENTICATION="no")
• Configuring proper firewall rules
• Regular backups of etcd data
• Using secrets management for sensitive configuration

⁠Further Reading

• etcd Official Documentation⁠
• etcd Configuration Reference⁠
• etcd Clustering Guide⁠

⁠Notes

AI was used to generate this README.md file, was proofread by human eyes. Some bad info may still exist.