elastic-agent-complete-wolfi:9.4.3 does not start in Azure Container Apps, while 9.4.2 works

[JanKnipp]

Bug: elastic-agent-complete-wolfi:9.4.3 does not start in Azure Container Apps, while 9.4.2 works

Summary

After upgrading from elastic-agent-complete-wolfi:9.4.2 to elastic-agent-complete-wolfi:9.4.3, the Elastic Agent container no longer starts properly in Azure Container Apps.

Rolling back to 9.4.2 immediately fixes the issue.

The visible log output shows:

agent container initialisation - effective capabilities
agent container initialisation - ambient capabilities
agent container initialisation - chown paths
Warning: cannot chown agent paths without CAP_CHOWN or CAP_DAC_OVERRIDE capabilities

The warning itself appears to be non-fatal but with 9.4.3 the container becomes unusable / does not complete startup.

Environment

• Elastic Agent image: elastic-agent-complete-wolfi
• Working version: 9.4.2
• Failing version: 9.4.3
• Runtime: Azure Container Apps
• Container type: non-privileged container
• Use case: Elastic Agent Complete is required for browser-based synthetic monitoring
• Capabilities: Azure Container Apps does not allow adding Linux capabilities such as CAP_CHOWN or CAP_DAC_OVERRIDE

Expected behavior

elastic-agent-complete-wolfi:9.4.3 should start successfully in the same Azure Container Apps environment where 9.4.2 works.

The agent should either tolerate missing CAP_CHOWN / CAP_DAC_OVERRIDE, as the warning suggests, or provide a clear fatal error explaining which path/state/config operation failed.

Actual behavior

elastic-agent-complete-wolfi:9.4.3 does not start properly in Azure Container Apps.

The last visible startup-related messages are:

agent container initialisation - effective capabilities
agent container initialisation - ambient capabilities
agent container initialisation - chown paths
Warning: cannot chown agent paths without CAP_CHOWN or CAP_DAC_OVERRIDE capabilities

After this, the container is no longer usable.

Rolling back to elastic-agent-complete-wolfi:9.4.2 resolves the problem without any other configuration changes.

Why this looks like a regression

The same Azure Container Apps configuration works with:

elastic-agent-complete-wolfi:9.4.2

but fails with:

elastic-agent-complete-wolfi:9.4.3

AI SLOP assumption incoming:

However, 9.4.3 introduced container-mode related changes, especially:

• Read TLS config from environment variables in container mode
• Fix container config override inconsistencies

The related PR appears to be:

elastic/elastic-agent#14408

This looks like the 9.4.3 container-mode config/path handling may have exposed or introduced a startup failure in restricted container runtimes such as Azure Container Apps.

Suspicion

The failure may be related to one of the following areas:

• container-mode config override ordering
• fleet.enc / encrypted Fleet config reload
• state/config path handling
• writable path assumptions
• ownership handling after the failed chown
• vault / secret storage initialization
• use of CONFIG_PATH, STATE_PATH, DATA_PATH, HOME_PATH, or LOGS_PATH

Since ACA does not allow adding the required Linux capabilities, the agent should be able to start without requiring CAP_CHOWN or CAP_DAC_OVERRIDE, especially if this worked in 9.4.2.

Impact

This blocks upgrading from 9.4.2 to 9.4.3 for Elastic Agent Complete on Azure Container Apps.

We need the complete image because browser-based synthetic monitoring requires it, so switching to the regular elastic-agent-wolfi image is not an option.

Workaround

Rollback to:

elastic-agent-complete-wolfi:9.4.2

Request

Could you please check whether the container-mode config/path changes in 9.4.3, especially around PR #14408, changed startup behavior for restricted container runtimes?

[JanKnipp]

sorry i forgot the exact logs lines..

2026-07-08T15:43:01.6463651Z stdout F agent container initialisation - effective capabilities
2026-07-08T15:43:01.6498820Z stderr F Warning: cannot chown agent paths without CAP_CHOWN or CAP_DAC_OVERRIDE capabilities
2026-07-08T15:43:01.6499310Z stdout F agent container initialisation - ambient capabilities
2026-07-08T15:43:01.6499596Z stdout F agent container initialisation - chown paths
2026-07-08T15:43:02.7111492Z stderr F {"log.level":"warn","@timestamp":"2026-07-08T15:43:02.710Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/upgrade/artifact.(*Config).Unpack","file.name":"artifact/config.go","file.line":186},"message":"agent.download.retry_sleep_init_duration must be > 0, got 0s; using default 30s","ecs.version":"1.6.0"}
2026-07-08T15:43:02.8041193Z stderr F Warning: cannot chown agent paths without CAP_CHOWN or CAP_DAC_OVERRIDE capabilities
2026-07-08T15:43:02.8041313Z stdout F agent container initialisation - effective capabilities
2026-07-08T15:43:02.8042272Z stdout F agent container initialisation - ambient capabilities
2026-07-08T15:43:02.8042341Z stdout F agent container initialisation - chown paths
2026-07-08T15:43:03.7016692Z stderr F {"log.level":"warn","@timestamp":"2026-07-08T15:43:03.701Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/upgrade/artifact.(*Config).Unpack","file.name":"artifact/config.go","file.line":186},"message":"agent.download.retry_sleep_init_duration must be > 0, got 0s; using default 30s","ecs.version":"1.6.0"}
2026-07-08T15:43:03.7451225Z stderr F {"log.level":"error","@timestamp":"2026-07-08T15:43:03.744Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).runLoopIteration","file.name":"coordinator/coordinator.go","file.line":1619},"message":"applying new policy: context canceled","log.source":"elastic-agent","ecs.version":"1.6.0"}
2026-07-08T15:43:03.7952430Z stderr F Warning: cannot chown agent paths without CAP_CHOWN or CAP_DAC_OVERRIDE capabilities
2026-07-08T15:43:03.7952591Z stdout F agent container initialisation - effective capabilities
2026-07-08T15:43:03.7953822Z stdout F agent container initialisation - ambient capabilities
2026-07-08T15:43:03.7954319Z stdout F agent container initialisation - chown paths
2026-07-08T15:43:04.8487794Z stderr F {"log.level":"warn","@timestamp":"2026-07-08T15:43:04.848Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/upgrade/artifact.(*Config).Unpack","file.name":"artifact/config.go","file.line":186},"message":"agent.download.retry_sleep_init_duration must be > 0, got 0s; using default 30s","ecs.version":"1.6.0"}

[infra-vault-gh-plugin-prod]

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)