Demonstration of patching a specific file in a container, then mapping it with a hard link. This should only be done when upgrading isn't possible.

Log4j Remediation.md

1. Copy the file from the container.

   docker cp logstash:/usr/share/logstash/logstash-core/lib/jars/log4j-core-2.13.3.jar patched/.
   

2. Delete the JndiLookup.class from the JAR.

   zip -d patched/log4j-core-2.13.3.jar org/apache/logging/log4j/core/lookup/JndiLookup.class
   

3. Update docker-compose.yml to hard link the patched file.

   version: '3.2'
   services:
      logstash:
      ...
      volumes:
      ...
      - type: bind
        source: ./patched/log4j-core-2.13.3.jar
        target: /usr/share/logstash/logstash-core/lib/jars/log4j-core-2.13.3.jar
        read_only: true
      ...

4. Re-create the container.

   docker-compose up -d logstash