Fluentd Aggregator Docker Image

A Fluentd OCI image to be used for log aggregation and based on the official Fluentd Docker image rebuilt as a multi-arch linux/amd64 & linux/arm64 image.

Aggregation Changes

To optimize Fluentd for log aggregation the default configuration has been overwritten to allow logs to be forwarded and printed to stdout, an additional directory /fluentd/state has been created, and plugins have also been added to support the aggregation role.

Versioning

As of v2.0.0 this image will follow semantic versioning and the base Fluentd version will be treated as a dependency and not directly tracked in the versioning.

Plugins

The following plugins have been added to the base image, to see the specific version please look in the Gemfile.

• fluent-plugin-azure-loganalytics
• fluent-plugin-azurestorage-gen2
• fluent-plugin-cloudwatch-logs
• fluent-plugin-concat
• fluent-plugin-datadog
• fluent-plugin-elasticsearch
• fluent-plugin-grafana-loki
• fluent-plugin-kafka
• fluent-plugin-opensearch
• fluent-plugin-prometheus
• fluent-plugin-record-modifier
• fluent-plugin-rewrite-tag-filter
• fluent-plugin-route
• fluent-plugin-s3
• fluent-plugin-sqs

Usage

This image is available from GHCR and Docker Hub. It is intended to be used in the fluentd-aggregator Helm chart. You can pull this image with the following command.

docker pull ghcr.io/fluent/fluentd-aggregator-docker-image:latest

docker pull fluent/fluentd-aggregator:latest

This image can be tested locally by running the following command and then forwarding logs to it.

docker run -p 24224:24224 ghcr.io/fluent/fluentd-aggregator-docker-image:latest

Validation

To validate the image signature run the following commands.

cosign verify ghcr.io/fluent/fluentd-aggregator-docker-image:latest --certificate-oidc-issuer "https://token.actions.githubusercontent.com" --certificate-identity-regexp "https://github.com/action-stars/build-workflows/\.github/workflows/build-oci-image\.yaml@.+" | jq .

To validate the the image build provenance run the following command.

cosign verify-attestation --certificate-oidc-issuer "https://token.actions.githubusercontent.com" --certificate-identity-regexp "https://github.com/action-stars/build-workflows/\.github/workflows/build-oci-image\.yaml@.+" --new-bundle-format --type=slsaprovenance1 ghcr.io/fluent/fluentd-aggregator-docker-image:latest

You can validate image SBOM by running the following commands.

digest="$(crane digest --platform="linux/amd64" ghcr.io/fluent/fluentd-aggregator-docker-image:latest)"
cosign verify-attestation --certificate-oidc-issuer "https://token.actions.githubusercontent.com" --certificate-identity-regexp "https://github.com/action-stars/build-workflows/\.github/workflows/build-oci-image\.yaml@.+" --new-bundle-format --type=https://spdx.dev/Document/v2.3 "ghcr.io/fluent/fluentd-aggregator-docker-image@${digest}"

License

Apache License, Version 2.0.