Elasticsearch "bootstrap checks failed" in CI

Elasticsearch runs a set of bootstrap checks the moment a node binds to a non-loopback network address. In a service container the node is reachable from the job, so it treats the environment as production and enforces every check as a hard error instead of a warning.

What this error means

The Elasticsearch container logs "bootstrap checks failed" followed by one or more numbered checks (max_map_count, discovery, file descriptors), then exits before the port is ready.

elasticsearch

ERROR: [1] bootstrap checks failed. You must address the points described in the following [1] lines before starting Elasticsearch.
bootstrap check failure [1] of [1]: the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured

Common causes

The node bound a non-loopback address

A service container publishes the port so the job can reach it, so Elasticsearch no longer treats the node as a dev instance and promotes every bootstrap check to an error.

Production settings were left at defaults

Discovery, vm.max_map_count, and file-descriptor limits are fine for local dev but fail the checks once the node is in "production" mode.

How to fix it

Run a single-node cluster for tests

Set discovery.type=single-node so the discovery bootstrap check is skipped.
This tells Elasticsearch the node forms a one-node cluster and needs no master election.
Restart the container and confirm it reaches a ready state.

.github/workflows/ci.yml

services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.13.4
    env:
      discovery.type: single-node
      xpack.security.enabled: "false"

Address the specific check it names

If a check other than discovery fails, fix that one: raise vm.max_map_count on the runner, or set file-descriptor ulimits on the container. The log names exactly which check blocked startup.

Terminal

sudo sysctl -w vm.max_map_count=262144

How to prevent it

Always set discovery.type=single-node for a single-node test cluster.
Read the numbered bootstrap check in the log; it names the exact setting to fix.
Do not rely on dev-mode leniency once the node binds a published port.