<p>I'm trying to run only the Elastic agent as a deployment in a Kubernetes cluster.  The reason I'm doing this is maybe an atypical usage of the Elastic agent: I only want to deploy the HTTP log endpoint integration and have other pods send logs to this Elastic agent.  I'm <em>not</em> using it to collect cluster metrics (so the <a href="https://www.elastic.co/guide/en/fleet/master/running-on-kubernetes-managed-by-fleet.html" rel="nofollow noreferrer">manifest</a> they supply is not relevant to me).</p>
<p>I'm using the image <code>docker.elastic.co/beats/elastic-agent:8.4.2</code>.  Apparently, this image needs to write files and directories to <code>/usr/share/elastic-agent/</code>, which at first was leading to errors along the lines of <code>failed: mkdir /usr/share/elastic-agent/state: read-only file system</code>.  So, I created an <code>emptyDir</code> volume and mounted it at <code>/usr/share/elastic-agent</code>.  Now, that error disappears, but is replaced with a new error:</p>
<pre><code>/usr/local/bin/docker-entrypoint: line 14: exec: elastic-agent: not found
</code></pre>
<p>The entrypoint of the image is</p>
<pre><code>ENTRYPOINT [&quot;/usr/bin/tini&quot; &quot;--&quot; &quot;/usr/local/bin/docker-entrypoint&quot;]
</code></pre>
<p>and it is apparently unable to find <code>/usr/local/bin/docker-entrypoint</code>.</p>
<p>A couple questions:</p>
<ol>
<li>Why is it not finding the <code>elastic-agent</code> executable?  It is definitely at that path.</li>
<li>More broadly: I am new to Elasticsearch -- this is only to set up a QA environment meant to test a product feature where we forward data from certain of our services to customers' Elastic Cloud deployments. I thought deploying the agent as a service in the same cluster where these services run would be the least painful way to do this. Is this not a good way to achieve what I describe in the first paragraph?</li>
<li>Assuming I can get the deployment to actually work, is this the way the next steps would go?
<ul>
<li>Create the &quot;Custom HTTP Endpoint Logs&quot; integration on the agent policy, listening on a given port and on all interfaces.</li>
<li>Map that port to an external port for the pod.</li>
<li>Send data to the pod at that external port.</li>
</ul>
</li>
</ol>

user4601931
<p>The issue is that mounting the <code>emptyDir</code> volume to <code>/usr/share</code> overwrites the elastic-agent binary.  Remove this volume and set <code>readOnlyRootFilesystem: false</code>.</p>
