{"record":{"id":"810a1f4214fbb5fe","repo":"testcontainers/testcontainers-java","slug":"you-can-not-activate-security-on-elastic-oss-image-please","errorCode":null,"errorMessage":"You can not activate security on Elastic OSS Image. Please switch to the default distribution","messagePattern":"You can not activate security on Elastic OSS Image\\. Please switch to the default distribution","errorType":"exception","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/ElasticsearchContainer.java","lineNumber":191,"sourceCode":"            final SSLContext sslContext = SSLContext.getInstance(\"TLSv1.3\");\n            TrustManagerFactory tmfactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\n            tmfactory.init(trustStore);\n            sslContext.init(null, tmfactory.getTrustManagers(), null);\n            return sslContext;\n        } catch (Exception e) {\n            throw new RuntimeException(e);\n        }\n    }\n\n    /**\n     * Define the Elasticsearch password to set. It enables security behind the scene for major version below 8.0.0.\n     * It's not possible to use security with the oss image.\n     * @param password Password to set\n     * @return this\n     */\n    public ElasticsearchContainer withPassword(String password) {\n        if (isOss) {\n            throw new IllegalArgumentException(\n                \"You can not activate security on Elastic OSS Image. Please switch to the default distribution\"\n            );\n        }\n        withEnv(\"ELASTIC_PASSWORD\", password);\n        if (!isAtLeastMajorVersion8) {\n            // major version 8 is secure by default and does not need this to enable authentication\n            withEnv(\"xpack.security.enabled\", \"true\");\n        }\n        return this;\n    }\n\n    /**\n     * Configure a CA cert path that is not the default\n     *\n     * @param certPath Path to the CA certificate within the Docker container to extract it from after start up\n     * @return this\n     */\n    public ElasticsearchContainer withCertPath(String certPath) {","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/testcontainers/testcontainers-java/blob/8e549514e3f01c57d70546fbb8599d138f3903e5/modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/ElasticsearchContainer.java#L173-L209","documentation":"ElasticsearchContainer.withPassword throws IllegalArgumentException when the container was created from the Elastic OSS image. The OSS distribution does not support X-Pack security, so setting a password is impossible; the library explicitly rejects it and tells you to use the default (non-OSS) distribution.","triggerScenarios":"new ElasticsearchContainer(DockerImageName.parse(\"elasticsearch:7.17.0-oss\").asCompatibleSubstituteFor(\"docker.elastic.co/elasticsearch/elasticsearch\")).withPassword(\"pw\") — isOss is true when the image name ends in -oss.","commonSituations":"Migrating tests from older OSS-based images to secured default images; copying container setup code that sets a password while still pointing at an OSS tag.","solutions":["Switch the DockerImageName to the default distribution, e.g. docker.elastic.co/elasticsearch/elasticsearch:8.x, without the -oss suffix.","If OSS is mandatory, remove the withPassword call and run without authentication.","Assert image choice in test setup so OSS/default mismatch fails early with a clear message."],"exampleFix":"// before\nElasticsearchContainer c = new ElasticsearchContainer(\n    DockerImageName.parse(\"docker.elastic.co/elasticsearch/elasticsearch:7.17.0-oss\"))\n    .withPassword(\"secret\"); // throws\n// after\nElasticsearchContainer c = new ElasticsearchContainer(\n    DockerImageName.parse(\"docker.elastic.co/elasticsearch/elasticsearch:7.17.0\"))\n    .withPassword(\"secret\");","handlingStrategy":"validation","validationCode":"if (imageName.indexOf(\"-oss\") > 0) {\n    throw new IllegalArgumentException(\"OSS image cannot be secured; use the default distribution or drop withPassword\");\n}\ncontainer.withPassword(password);","typeGuard":null,"tryCatchPattern":"try {\n    container.withPassword(password);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"Elastic OSS Image\")) {\n        // switch image to the default distribution or remove authentication\n    }\n    throw e;\n}","preventionTips":["Standardize on the default Elasticsearch distribution for secured test setups.","Centralize image selection in one helper so OSS/default mismatches are caught once.","Document that -oss images cannot use X-Pack security."],"tags":["elasticsearch","oss-image","security","configuration-conflict"],"backgroundTag":"conflicting-config-options","analyzedSha":"8e549514e3f01c57d70546fbb8599d138f3903e5","analyzedAt":"2026-09-12T14:56:41.227Z","contentChangedAt":"2026-09-12T14:56:41.227Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}