Plugin policy contains illegal permission createClassLoader

I’m trying to run ror for ECK using this tutorial For ECK | ReadonlyREST but I’m getting

java.lang.IllegalArgumentException","error.message":"plugin policy [/usr/share/elasticsearch/plugins/readonlyrest/plugin-security.policy] contains illegal permission (\"java.lang.RuntimePermission\" \"createClassLoader\") in global grant

es version: 8.15.0
ror version: 1.60.0

full log


Container: elasticsearch
Filter
Disconnected
Elasticsearch is already patched. We can continue ...
2024-10-08T10:20:34.012304536Z Oct 08, 2024 10:20:33 AM sun.util.locale.provider.LocaleProviderAdapter <clinit>
WARNING: COMPAT locale provider will be removed in a future release
2024-10-08T10:20:35.512727229Z {"@timestamp":"2024-10-08T10:20:35.416Z", "log.level": "INFO", "message":"Using native vector library; to disable start with -Dorg.elasticsearch.nativeaccess.enableVectorLibrary=false", "ecs.version": "1.2.0","service.name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread.name":"main","log.logger":"org.elasticsearch.nativeaccess.NativeAccess","elasticsearch.node.name":"elasticsearch-ror-es-default-0","elasticsearch.cluster.name":"elasticsearch-ror"}
{"@timestamp":"2024-10-08T10:20:35.714Z", "log.level": "INFO", "message":"Using [jdk] native provider and native methods for [Linux]", "ecs.version": "1.2.0","service.name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread.name":"main","log.logger":"org.elasticsearch.nativeaccess.NativeAccess","elasticsearch.node.name":"elasticsearch-ror-es-default-0","elasticsearch.cluster.name":"elasticsearch-ror"}
{"@timestamp":"2024-10-08T10:20:36.735Z", "log.level": "INFO", "message":"Java vector incubator API enabled; uses preferredBitSize=256; FMA enabled", "ecs.version": "1.2.0","service.name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread.name":"main","log.logger":"org.apache.lucene.internal.vectorization.PanamaVectorizationProvider","elasticsearch.node.name":"elasticsearch-ror-es-default-0","elasticsearch.cluster.name":"elasticsearch-ror"}
{"@timestamp":"2024-10-08T10:20:36.906Z", "log.level":"ERROR", "message":"fatal exception while booting Elasticsearch", "ecs.version": "1.2.0","service.name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread.name":"main","log.logger":"org.elasticsearch.bootstrap.Elasticsearch","elasticsearch.node.name":"elasticsearch-ror-es-default-0","elasticsearch.cluster.name":"elasticsearch-ror","error.type":"java.lang.IllegalArgumentException","error.message":"plugin policy [/usr/share/elasticsearch/plugins/readonlyrest/plugin-security.policy] contains illegal permission (\"java.lang.RuntimePermission\" \"createClassLoader\") in global grant","error.stack_trace":"java.lang.IllegalArgumentException: plugin policy [/usr/share/elasticsearch/plugins/readonlyrest/plugin-security.policy] contains illegal permission (\"java.lang.RuntimePermission\" \"createClassLoader\") in global grant\n\tat org.elasticsearch.server@8.15.0/org.elasticsearch.bootstrap.PolicyUtil.validatePolicyPermissionsForJar(PolicyUtil.java:360)\n\tat org.elasticsearch.server@8.15.0/org.elasticsearch.bootstrap.PolicyUtil.validatePolicyPermissions(PolicyUtil.java:370)\n\tat org.elasticsearch.server@8.15.0/org.elasticsearch.bootstrap.PolicyUtil.getPluginPolicyInfo(PolicyUtil.java:381)\n\tat org.elasticsearch.server@8.15.0/org.elasticsearch.bootstrap.Security.getPluginAndModulePermissions(Security.java:180)\n\tat org.elasticsearch.server@8.15.0/org.elasticsearch.bootstrap.Security.configure(Security.java:135)\n\tat org.elasticsearch.server@8.15.0/org.elasticsearch.bootstrap.Elasticsearch.initPhase2(Elasticsearch.java:204)\n\tat org.elasticsearch.server@8.15.0/org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:75)\n"}
ERROR: Elasticsearch did not exit normally - check the logs at /usr/share/elasticsearch/logs/elasticsearch-ror.log

2024-10-08T10:20:37.580986543Z ERROR: Elasticsearch died while starting up, with exit code 1

However, if I build my docker image, then it works.

Do you use MacOS?
If so, we don’t publish arm images yet (it’s planned) - and the problem is related to this I think.

No, I have a private cluster with RKE1 engine.

@aizerin could you please check the architecture of the built image?

e.g.

docker inspect docker.elastic.co/elasticsearch/elasticsearch:8.13.4 | grep Architecture