Apply SELinux options to bind mounts

https://docs.docker.com/storage/bind-mounts/

Related to #639
Closes #661

docker-compose.yml

@@ -27,8 +27,8 @@ services:
       args:
         ELK_VERSION: $ELK_VERSION
     volumes:
-      - ./logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml:ro,z
+      - ./logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml:ro,Z
-      - ./logstash/pipeline:/usr/share/logstash/pipeline:ro,z
+      - ./logstash/pipeline:/usr/share/logstash/pipeline:ro,Z
     ports:
       - "5044:5044"
       - "5000:5000/tcp"
@@ -47,7 +47,7 @@ services:
       args:
         ELK_VERSION: $ELK_VERSION
     volumes:
-      - ./kibana/config/kibana.yml:/usr/share/kibana/config/kibana.yml:ro,z
+      - ./kibana/config/kibana.yml:/usr/share/kibana/config/kibana.yml:ro,Z
     ports:
       - "5601:5601"
     networks:

extensions/apm-server/apm-server-compose.yml

@@ -11,10 +11,7 @@ services:
         # https://www.elastic.co/guide/en/beats/libbeat/current/config-file-permissions.html
       - --strict.perms=false
     volumes:
-      - type: bind
+      - ./extensions/apm-server/config/apm-server.yml:/usr/share/apm-server/apm-server.yml:ro,Z
-        source: ./extensions/apm-server/config/apm-server.yml
-        target: /usr/share/apm-server/apm-server.yml
-        read_only: true
     ports:
       - '8200:8200'
     networks:

extensions/curator/curator-compose.yml

@@ -6,14 +6,8 @@ services:
       context: extensions/curator/
     init: true
     volumes:
-      - type: bind
+      - ./extensions/curator/config/curator.yml:/usr/share/curator/config/curator.yml:ro,Z
-        source: ./extensions/curator/config/curator.yml
+      - ./extensions/curator/config/delete_log_files_curator.yml:/usr/share/curator/config/delete_log_files_curator.yml:ro,Z
-        target: /usr/share/curator/config/curator.yml
-        read_only: true
-      - type: bind
-        source: ./extensions/curator/config/delete_log_files_curator.yml
-        target: /usr/share/curator/config/delete_log_files_curator.yml
-        read_only: true
     networks:
       - elk
     depends_on:

extensions/enterprise-search/enterprise-search-compose.yml

@@ -7,10 +7,7 @@ services:
       args:
         ELK_VERSION: $ELK_VERSION
     volumes:
-      - type: bind
+      - ./extensions/enterprise-search/config/enterprise-search.yml:/usr/share/enterprise-search/config/enterprise-search.yml:ro,Z
-        source: ./extensions/enterprise-search/config/enterprise-search.yml
-        target: /usr/share/enterprise-search/config/enterprise-search.yml
-        read_only: true
     environment:
       JAVA_OPTS: -Xmx2g -Xms2g
       ENT_SEARCH_DEFAULT_PASSWORD: 'changeme'

extensions/filebeat/filebeat-compose.yml

@@ -17,10 +17,7 @@ services:
       # see: https://www.elastic.co/guide/en/beats/libbeat/current/config-file-permissions.html
       - --strict.perms=false
     volumes:
-      - type: bind
+      - ./extensions/filebeat/config/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro,Z
-        source: ./extensions/filebeat/config/filebeat.yml
-        target: /usr/share/filebeat/filebeat.yml
-        read_only: true
       - type: bind
         source: /var/lib/docker/containers
         target: /var/lib/docker/containers

extensions/logspout/logspout-compose.yml

@@ -5,7 +5,10 @@ services:
     build:
       context: extensions/logspout
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - type: bind
+        source: /var/run/docker.sock
+        target: /var/run/docker.sock
+        read_only: true
     environment:
       ROUTE_URIS: logstash://logstash:5000
       LOGSTASH_TAGS: docker-elk

extensions/metricbeat/metricbeat-compose.yml

@@ -20,10 +20,7 @@ services:
       # from within a container.
       - --system.hostfs=/hostfs
     volumes:
-      - type: bind
+      - ./extensions/metricbeat/config/metricbeat.yml:/usr/share/metricbeat/metricbeat.yml:ro,Z
-        source: ./extensions/metricbeat/config/metricbeat.yml
-        target: /usr/share/metricbeat/metricbeat.yml
-        read_only: true
       - type: bind
         source: /
         target: /hostfs