Adjust Beats container user to be numeric.

[naemono]

Adjust Beats container user to be numeric.

"Recently" the user in the dockerfile was adjusted to be 1000 instead of metricbeat: https://github.com/elastic/beats/pull/35272/files#r1184217000

I believe this was recently changed here

See elastic/cloud-on-k8s#8086 (comment)
This is causing issues when running the container as runAsNonRoot: true:

container has runAsNonRoot and image has non-numeric user (metricbeat)

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

This should only allow the container to run when runAsNonRoot: true is set.

Author's Checklist

• Ensure the container builds in CI
• Ensure e2e tests pass

How to test this PR locally

mage package I believe

Related issues

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @naemono? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit

[mergify]

backport-8.x has been added to help with the transition to the new branch 8.x.
If you don't need it please use backport-skip label and remove the backport-8.x label.

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[AndersonQ]

@rdner you were working in the wolfi images. Is there any special reason you used non-numeric users? Otherwise I believe this PR is good to be merged

[cmacknz]

Is there any special reason you used non-numeric users?

The history is in #35272:

See
elastic/cloud-on-k8s#6688 (comment)
and
elastic/cloud-on-k8s#6740

Similar change was recently merged into elasticsearch for the same issue.

This change will allow the beats container in Kubernetes to be ran with runAsNonRoot as it checks against the numeric UID, and not a name.

Without this change you encounter the following error:

  state:                                                                                                                                                                                                                                                                                                               │
│       waiting:                                                                                                                                                                                                                                                                                                           │
│         message: 'container has runAsNonRoot and image has non-numeric user (metricbeat),                                                                                                                                                                                                                                │
│           cannot verify user is non-root (pod: "elasticsearch-es-mixed-2_beats-3064(51b07a17-26c4-4301-9380-ea6fe3e75aca)",    

I'm fine with this, I do wonder if we should change the actual template input that resolves tot he .user value to be numeric to keep this from coming back (in addition to my original comment on the PR about having a test to catch this). I see similar things in the agent container template so worth cross-referencing to ensure this problem doesn't put up again with agent. https://github.com/elastic/elastic-agent/blob/0a965617920874e740b85aad7b383ea370804401/dev-tools/packaging/templates/docker/Dockerfile.elastic-agent.tmpl#L283

I'm out Monday but @rdner is back, I'll let him do the approving so someone other than me builds up context on this.

[rdner]

Thank you!