As discussed in #27648 we do not yet have a clear recommendation as to which user to run the agent docker container as. This presents a problem in that users will not be able to execute ICMP pings using heartbeat via the synthetics integration unless the heartbeat executable either: 1.) is invoked as root 2.) has the cap_net_raw+eip capability set via setcap.

We currently cannot set that privilege if the user runs as the non-root elastic-agent user because the agent ships with .tar.gz versions of the individual beats. To correctly use setcap we would need to ship the container with heartbeat (and probably all the other beats) untarred and with any relevant setcap bits set.

Is there any opposition to making a change to the dockerfile to:

1. Unzip all beats from the download to install directory
2. Apply all setcap privileges from the package.yml
3. Remove the zipped downloads to save space

Since docker images are already zipped this should have no impact on size.