ElasticSearch 7.6.0 container doesn't start on AWS ECS

[Roberdvs]

Elasticsearch version: 7.6.0 Official Docker container

Plugins installed: none

Description of the problem including expected versus actual behavior:

ECS fails to start up an ElasticSearch 7.6.0 container. Tried several times in several ECS clusters with several ECS Agent versions (including the latest).
I also can confirm this doesn't happen with the Kibana 7.6.0 image or ElasticSearch 7.5.2.

Steps to reproduce:

1. Create an ECS service using a minimal task definition with the docker.elastic.co/elasticsearch/elasticsearch:7.6.0 container image

2. Tasks fail to start with the following error
   ERROR: File /opt/ecs/metadata/eaa62b4d-c24e-4791-8be3-1e3f9f4dc768/ecs-container-metadata.json from ECS_CONTAINER_METADATA_FILE must have file permissions 400 or 600, but actually has: 644

Not sure if this belongs on AWS ECS or Elastic but since previous ElasticSearch releases didn't have this issue I guess something must have changed on the 7.6.0 Docker image so I'm posting it here.

[elasticmachine]

Pinging @elastic/es-core-infra (:Core/Infra/Packaging)

[DaveCTurner]

Not 100% sure this is a packaging issue - I think this file is supplied by ECS itself. @Roberdvs are you using any AWS-specific plugins (e.g. discovery-ec2 or repository-s3)? Can you share the full error message including the stack trace?

[Roberdvs]

We were using a custom image at first with both of those plugins but in order to track down the issue and discard things I deployed just the base image (docker.elastic.co/elasticsearch/elasticsearch:7.6.0) without any plugins/configurations/envVars and got the same error.

I'm afraid that line is the only thing it logs before stopping :(

[tvernum]

@DaveCTurner Processing of _FILE vars in docker was changed in 7.6 (#50221)
I'm pretty sure this is a consequence of https://github.com/elastic/elasticsearch/pull/50221/files#diff-7290df23abe83133a1d17d848562a5bcR30

[pugnascotia]

This is same isue as #52503. It will be fixed in 7.6.1

[Roberdvs]

Cool. Thanks everyone for the fast feedback!

[DaveCTurner]

Ah, right, that makes sense. I failed to find that error message in the source but now I see it.