Repository: aws/aws-for-fluent-bit

Issue:
Can't load init files from S3 in eu-west-1, wrong S3 URL
<!---

Please remember to first check the documentation and issue history to see if your question/problem has
ocurred before. 
* Fluent Bit core repo: https://github.com/fluent/fluent-bit
* AWS Distro repo: https://github.com/aws/aws-for-fluent-bit
* Fluent Bit Docs: https://docs.fluentbit.io/manual/ 
* FireLens Docs: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_firelens.html
* FireLens examples: https://github.com/aws-samples/amazon-ecs-firelens-examples

Please fill out all relevant details. Support will be provided when we have all required information.

--> 

### Describe the question/issue
When running an ECS task in eu-west-1 (Ireland), using a firelens configuration that uses s3 init from a file in a bucket in eu-west-1, it attempts to pull the file from https://s3.EU.amazonaws.com/...

This is because the init Go process is using GetBucketLocation to get the region where the bucket is located, but for some reason only in eu-west-1, the LocationConstraint is "EU" instead of the region name. Consider the following awscli output:

```
❯ aws s3api --profile prod --region eu-west-1 get-bucket-location --bucket "(my bucket in eu-west-1)"
{
    "LocationConstraint": "EU"
}
 
❯ aws s3api --profile prod --region eu-west-1 get-bucket-location --bucket "(my bucket in us-west-2)"
{
    "LocationConstraint": "us-west-2"
}
```

I see in the [init process code](https://github.com/aws/aws-for-fluent-bit/blob/mainline/init/fluent_bit_init_process.go#L242-L244) it has special handling for us-east-1 (whose LocationConstraint is an empty string).  I think we need to add special handling for eu-west-1 as well.


UPDATE: I found out that on very old buckets (from around the time the eu-west-1 region was first launched), LocationConstraint is EU, but on newer buckets, it's eu-west-1.


UPDATE 2: This odd behavior is [mentioned in the GetBucketLocation docs](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLocation.html):

![Image](https://github.com/user-attachments/assets/7119e510-829b-4453-bf98-6b4621f10e0b)



Hints from issue comments:
@ShelbyZ: Looks to be a correct assessment, there is special handling for us-east-1 but not eu-west-1. We may want a two-pronged approach here:
1. Add check for `bucketRegion == "EU"`
2. Add check to use s3:headBucket to grab the region and fallback to s3:getBucketLocation

The current init use-case docs, https://github.com/aws/aws-for-fluent-bit/blob/mainline/use_cases/init-process-for-fluent-bit/README.md, mention using s3:getBucketLocation, so the s3:headBucket may be a longer term effort to use the right tool.@chadmyers: Thank you, @ShelbyZ !@ShelbyZ: The fix will not be live until the next release, 2.34.0 (best guess)

Solution patch:
diff --git a/.gitignore b/.gitignore
index bccd630..767249d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,5 @@
 bin
 integ/out/
 .venv
-/.idea/
\ No newline at end of file
+/.idea/
+.vscode/
\ No newline at end of file
diff --git a/AWS_FOR_FLUENT_BIT_STABLE_VERSION b/AWS_FOR_FLUENT_BIT_STABLE_VERSION
index cf00c9b..0b82b8d 100644
--- a/AWS_FOR_FLUENT_BIT_STABLE_VERSION
+++ b/AWS_FOR_FLUENT_BIT_STABLE_VERSION
@@ -1 +1 @@
-2.32.5.20250527
+2.33.2
diff --git a/AWS_FOR_FLUENT_BIT_VERSION b/AWS_FOR_FLUENT_BIT_VERSION
index cf00c9b..0b82b8d 100644
--- a/AWS_FOR_FLUENT_BIT_VERSION
+++ b/AWS_FOR_FLUENT_BIT_VERSION
@@ -1 +1 @@
-2.32.5.20250527
+2.33.2
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 910bb2e..6debc4b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,66 @@
 # Changelog
 
+### 2.33.2
+This release includes:
+* Fluent Bit [1.9.10](https://github.com/fluent/fluent-bit/tree/v1.9.10)
+* Amazon CloudWatch Logs for Fluent Bit 1.9.4
+* Amazon Kinesis Streams for Fluent Bit 1.10.2
+* Amazon Kinesis Firehose for Fluent Bit 1.7.2
+* Amazon Linux base container image version: 2.0.20250818.2
+
+Compared to the previous release, this release adds:
+* Enhancement: add support for non-root user mode to the debug-init image [#980](https://github.com/aws/aws-for-fluent-bit/pull/980)
+
+### 2.33.1
+This release includes:
+* Fluent Bit [1.9.10](https://github.com/fluent/fluent-bit/tree/v1.9.10)
+* Amazon CloudWatch Logs for Fluent Bit 1.9.4
+* Amazon Kinesis Streams for Fluent Bit 1.10.2
+* Amazon Kinesis Firehose for Fluent Bit 1.7.2
+* Amazon Linux base container image version: 2.0.20250804.1
+
+Compared to the previous release, this release adds:
+* Enhancement - Rework AL2 dockerfiles [#972](https://github.com/aws/aws-for-fluent-bit/pull/972)
+* Fix - Disable buildkit features [#976](https://github.com/aws/aws-for-fluent-bit/pull/976)
+
+### 2.33.0.20250731
+This release includes:
+* Fluent Bit [1.9.10](https://github.com/fluent/fluent-bit/tree/v1.9.10)
+* Amazon CloudWatch Logs for Fluent Bit 1.9.4
+* Amazon Kinesis Streams for Fluent Bit 1.10.2
+* Amazon Kinesis Firehose for Fluent Bit 1.7.2
+* Amazon Linux base container image version: 2.0.20250728.1
+
+### 2.33.0
+This release includes:
+* Fluent Bit [1.9.10](https://github.com/fluent/fluent-bit/tree/v1.9.10)
+* Amazon CloudWatch Logs for Fluent Bit 1.9.4
+* Amazon Kinesis Streams for Fluent Bit 1.10.2
+* Amazon Kinesis Firehose for Fluent Bit 1.7.2
+* Amazon Linux base container image version: 2.0.20250707.0
+
+Compared to the previous release, this release adds:
+* Feature: Add support for non-root user mode to the init image [#955](https://github.com/aws/aws-for-fluent-bit/pull/955)
+
+### 2.32.5.20250626
+This release includes:
+* Fluent Bit [1.9.10](https://github.com/fluent/fluent-bit/tree/v1.9.10)
+* Amazon CloudWatch Logs for Fluent Bit 1.9.4
+* Amazon Kinesis Streams for Fluent Bit 1.10.2
+* Amazon Kinesis Firehose for Fluent Bit 1.7.2
+* Amazon Linux base container image version: 2.0.20250623.0
+
+### 2.32.5.20250626
+This release includes:
+* Fluent Bit [1.9.10](https://github.com/fluent/fluent-bit/tree/v1.9.10)
+* Amazon CloudWatch Logs for Fluent Bit 1.9.4
+* Amazon Kinesis Streams for Fluent Bit 1.10.2
+* Amazon Kinesis Firehose for Fluent Bit 1.7.2
+* Amazon Linux base container image version: 2.0.20250610.0
+
+Compared to the previous release, this release adds:
+* Update init process to aws-sdk-go-v2 [#941](https://github.com/aws/aws-for-fluent-bit/pull/941)
+
 ### 2.32.5.20250527
 This release includes:
 * Fluent Bit [1.9.10](https://github.com/fluent/fluent-bit/tree/v1.9.10)
diff --git a/Makefile b/Makefile
index 2c56a29..6c2735e 100644
--- a/Makefile
+++ b/Makefile
@@ -15,36 +15,40 @@ all: release
 
 # Execute set-cache to turn docker cache back on for faster development.
 DOCKER_BUILD_FLAGS := "--no-cache"
+# Amazon Linux Tag to use for images, will use value if not set
+AL_TAG ?= "2"
+# Fluent Bit version (branch or tag) to checkout, will use value if not set 
+FLB_VERSION ?= "1.9.10"
+# Fluent Bit repository to checkout, will use value if not set
+FLB_REPOSITORY ?= "https://github.com/amazon-contributing/upstream-to-fluent-bit.git"
+# AWS for Fluent Bit Version
+AWS_FOR_FLUENT_BIT_VERSION ?= $(shell cat AWS_FOR_FLUENT_BIT_VERSION)
+# OS Pretty Name (assigned during build-common)
+OS_PRETTY_NAME :=
 
 .PHONY: dev
 dev: DOCKER_BUILD_FLAGS =
 dev: release
 
-.PHONY: release
-release: build build-init linux-plugins
-	docker system prune -f
-	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:main-release -f ./scripts/dockerfiles/Dockerfile.main-release .
-	docker tag amazon/aws-for-fluent-bit:main-release amazon/aws-for-fluent-bit:latest
-	docker system prune -f
-	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:init-latest -f ./scripts/dockerfiles/Dockerfile.init-release .
-
-.PHONY: debug
-debug: main-debug init-debug
+.PHONY: build-common
+build-common:
+	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:build-deps-al${AL_TAG} -f ./scripts/dockerfiles/build/Dockerfile.deps-al${AL_TAG} .
+	docker build $(DOCKER_BUILD_FLAGS) --build-arg AL_TAG=${AL_TAG} --build-arg FLB_VERSION=${FLB_VERSION} --build-arg FLB_REPOSITORY=${FLB_REPOSITORY} -t amazon/aws-for-fluent-bit:build-common-al${AL_TAG} -f ./scripts/dockerfiles/build/Dockerfile.build-common .
+	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:golang -f ./scripts/dockerfiles/build/Dockerfile.golang .
+	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:compile-init-al${AL_TAG} -f ./scripts/dockerfiles/build/Dockerfile.compile-init .
+# Store OS_PRETTY_NAME for later image labeling
+	$(eval OS_PRETTY_NAME := $(shell docker run --rm amazon/aws-for-fluent-bit:build-deps-al${AL_TAG} sh -c "grep '^PRETTY_NAME=' /etc/os-release | cut -d'\"' -f2"))
 
 .PHONY: build
-build:
-	docker system prune -f
-	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:build -f ./scripts/dockerfiles/Dockerfile.build .
+build: build-common
+	docker build $(DOCKER_BUILD_FLAGS) --build-arg BUILD_IMAGE=amazon/aws-for-fluent-bit:build-common-al${AL_TAG} -t amazon/aws-for-fluent-bit:compile-al${AL_TAG} -f ./scripts/dockerfiles/build/Dockerfile.compile .
 
-.PHONY: build-init
-build-init:
-	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:build-init -f ./scripts/dockerfiles/Dockerfile.build-init .
-
-#TODO: the bash script opts does not work on developer Macs
-windows-plugins: export OS_TYPE = windows
-linux-plugins: export OS_TYPE = linux
+.PHONY: build-debug
+build-debug: build-common
+	docker build $(DOCKER_BUILD_FLAGS) --build-arg BUILD_IMAGE=amazon/aws-for-fluent-bit:build-common-al${AL_TAG} --build-arg DEBUG=On --build-arg RELEASE=Off -t amazon/aws-for-fluent-bit:compile-debug-al${AL_TAG} -f ./scripts/dockerfiles/build/Dockerfile.compile .
 
 .PHONY: windows-plugins
+windows-plugins: export OS_TYPE = windows
 windows-plugins:
 	./scripts/build_plugins.sh \
     	--KINESIS_PLUGIN_CLONE_URL=${KINESIS_PLUGIN_CLONE_URL} \
@@ -59,6 +63,7 @@ windows-plugins:
     	--DOCKER_BUILD_FLAGS=${DOCKER_BUILD_FLAGS}
 
 .PHONY: linux-plugins
+linux-plugins: export OS_TYPE = linux
 linux-plugins:
 	./scripts/build_plugins.sh \
     	--KINESIS_PLUGIN_CLONE_URL=${KINESIS_PLUGIN_CLONE_URL} \
@@ -72,88 +77,64 @@ linux-plugins:
     	--CLOUDWATCH_PLUGIN_BRANCH=${CLOUDWATCH_PLUGIN_BRANCH} \
     	--DOCKER_BUILD_FLAGS=${DOCKER_BUILD_FLAGS}
 
-# Debug and debug init images
-.PHONY: main-debug
-main-debug: debug-s3
-	docker tag amazon/aws-for-fluent-bit:debug-s3 amazon/aws-for-fluent-bit:debug
+.PHONY: release
+release: build linux-plugins
+	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:runtime-deps-al${AL_TAG} -f ./scripts/dockerfiles/runtime/Dockerfile.deps-al${AL_TAG} .
+	docker build $(DOCKER_BUILD_FLAGS) --build-arg COMPILE_IMAGE=amazon/aws-for-fluent-bit:compile-al${AL_TAG} --build-arg RUNTIME_IMAGE=amazon/aws-for-fluent-bit:runtime-deps-al${AL_TAG} --build-arg FLB_VERSION=${FLB_VERSION} --build-arg AWS_FOR_FLUENT_BIT_VERSION=${AWS_FOR_FLUENT_BIT_VERSION} --build-arg OS_PRETTY_NAME="${OS_PRETTY_NAME}" -t amazon/aws-for-fluent-bit:latest-al${AL_TAG} -f ./scripts/dockerfiles/runtime/Dockerfile .
+	docker build $(DOCKER_BUILD_FLAGS) --build-arg COMPILE_IMAGE=amazon/aws-for-fluent-bit:compile-init-al${AL_TAG} --build-arg RUNTIME_IMAGE=amazon/aws-for-fluent-bit:latest-al${AL_TAG} -t amazon/aws-for-fluent-bit:init-latest-al${AL_TAG} -f ./scripts/dockerfiles/runtime/Dockerfile.init .
 
-.PHONY: init-debug
-init-debug: init-debug-s3
-	docker tag amazon/aws-for-fluent-bit:init-debug-s3 amazon/aws-for-fluent-bit:init-debug
+.PHONY: debug
+debug: build-debug linux-plugins
+	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:runtime-deps-debug-al${AL_TAG} -f ./scripts/dockerfiles/runtime/Dockerfile.deps-debug-al${AL_TAG} .
+	docker build $(DOCKER_BUILD_FLAGS) --build-arg COMPILE_IMAGE=amazon/aws-for-fluent-bit:compile-debug-al${AL_TAG} --build-arg RUNTIME_IMAGE=amazon/aws-for-fluent-bit:runtime-deps-debug-al${AL_TAG} --build-arg FLB_VERSION=${FLB_VERSION} --build-arg AWS_FOR_FLUENT_BIT_VERSION=${AWS_FOR_FLUENT_BIT_VERSION} --build-arg OS_PRETTY_NAME="${OS_PRETTY_NAME}" -t amazon/aws-for-fluent-bit:runtime-debug-al${AL_TAG} -f ./scripts/dockerfiles/runtime/Dockerfile .
+	docker build $(DOCKER_BUILD_FLAGS) --build-arg RUNTIME_IMAGE=amazon/aws-for-fluent-bit:runtime-debug-al${AL_TAG} -t amazon/aws-for-fluent-bit:runtime-debug-common-${AL_TAG} -f ./scripts/dockerfiles/runtime/Dockerfile.debug-common .
+#   s3 images
+	docker build $(DOCKER_BUILD_FLAGS) --build-arg RUNTIME_IMAGE=amazon/aws-for-fluent-bit:runtime-debug-common-${AL_TAG} -t amazon/aws-for-fluent-bit:debug-al${AL_TAG} -f ./scripts/dockerfiles/runtime/Dockerfile.debug .
+	docker build $(DOCKER_BUILD_FLAGS) --build-arg COMPILE_IMAGE=amazon/aws-for-fluent-bit:compile-init-al${AL_TAG} --build-arg RUNTIME_IMAGE=amazon/aws-for-fluent-bit:debug-al${AL_TAG} -t amazon/aws-for-fluent-bit:runtime-init-debug-al${AL_TAG} -f ./scripts/dockerfiles/runtime/Dockerfile.init .
+	docker build $(DOCKER_BUILD_FLAGS) --build-arg RUNTIME_IMAGE=amazon/aws-for-fluent-bit:runtime-init-debug-al${AL_TAG} -t amazon/aws-for-fluent-bit:init-debug-al${AL_TAG} -f ./scripts/dockerfiles/runtime/Dockerfile.init-debug .
+#   efs images
+	docker build $(DOCKER_BUILD_FLAGS) --build-arg RUNTIME_IMAGE=amazon/aws-for-fluent-bit:runtime-debug-common-${AL_TAG} -t amazon/aws-for-fluent-bit:debug-efs-al${AL_TAG} -f ./scripts/dockerfiles/runtime/Dockerfile.debug-efs .
+	docker build $(DOCKER_BUILD_FLAGS) --build-arg RUNTIME_IMAGE=amazon/aws-for-fluent-bit:runtime-init-debug-al${AL_TAG} -t amazon/aws-for-fluent-bit:init-debug-efs-al${AL_TAG} -f ./scripts/dockerfiles/runtime/Dockerfile.init-debug-efs .
 
-# Build all main debug images (Don't build the dependencies multiple times)
-.PHONY: main-debug-all
-main-debug-all: main-debug-base
-	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:debug-fs       -f ./scripts/dockerfiles/Dockerfile.main-debug-fs .
-	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:debug-s3       -f ./scripts/dockerfiles/Dockerfile.main-debug-s3 .
-	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:debug-valgrind -f ./scripts/dockerfiles/Dockerfile.main-debug-valgrind .
-	docker tag amazon/aws-for-fluent-bit:debug-s3 amazon/aws-for-fluent-bit:debug
+.PHONY: debug-valgrind
+debug-valgrind: debug
+	docker build $(DOCKER_BUILD_FLAGS) --build-arg RUNTIME_IMAGE=amazon/aws-for-fluent-bit:runtime-debug-common-${AL_TAG} -t amazon/aws-for-fluent-bit:debug-valgrind-al${AL_TAG} -f ./scripts/dockerfiles/runtime/Dockerfile.debug-valgrind .
 
-# Debug images
-.PHONY: debug-fs
-debug-fs: main-debug-base
-	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:debug-fs       -f ./scripts/dockerfiles/Dockerfile.main-debug-fs .
+.PHONY: cloudwatch-dev
+cloudwatch-dev: export OS_TYPE = linux
+cloudwatch-dev: build
+	./scripts/build_plugins.sh \
+    	--CLOUDWATCH_PLUGIN_CLONE_URL=${CLOUDWATCH_PLUGIN_CLONE_URL} \
+    	--CLOUDWATCH_PLUGIN_BRANCH=${CLOUDWATCH_PLUGIN_BRANCH} \
+    	--DOCKER_BUILD_FLAGS=${DOCKER_BUILD_FLAGS}
+	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:runtime-deps-al${AL_TAG} -f ./scripts/dockerfiles/runtime/Dockerfile.deps-al${AL_TAG} .
+	docker build $(DOCKER_BUILD_FLAGS) --build-arg COMPILE_IMAGE=amazon/aws-for-fluent-bit:compile-al${AL_TAG} --build-arg RUNTIME_IMAGE=amazon/aws-for-fluent-bit:runtime-deps-al${AL_TAG} --build-arg FLB_VERSION=${FLB_VERSION} --build-arg AWS_FOR_FLUENT_BIT_VERSION=${AWS_FOR_FLUENT_BIT_VERSION} --build-arg OS_PRETTY_NAME="${OS_PRETTY_NAME}" -t amazon/aws-for-fluent-bit:latest-al${AL_TAG} -f ./scripts/dockerfiles/runtime/Dockerfile .
 
-.PHONY: debug-s3
-debug-s3: main-debug-base
-	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:debug-s3       -f ./scripts/dockerfiles/Dockerfile.main-debug-s3 .
+.PHONY: firehose-dev
+firehose-dev: export OS_TYPE = linux
+firehose-dev: build
+	./scripts/build_plugins.sh \
+    	--FIREHOSE_PLUGIN_CLONE_URL=${FIREHOSE_PLUGIN_CLONE_URL} \
+    	--FIREHOSE_PLUGIN_BRANCH=${FIREHOSE_PLUGIN_BRANCH} \
+    	--DOCKER_BUILD_FLAGS=${DOCKER_BUILD_FLAGS}
+	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:runtime-deps-al${AL_TAG} -f ./scripts/dockerfiles/runtime/Dockerfile.deps-al${AL_TAG} .
+	docker build $(DOCKER_BUILD_FLAGS) --build-arg COMPILE_IMAGE=amazon/aws-for-fluent-bit:compile-al${AL_TAG} --build-arg RUNTIME_IMAGE=amazon/aws-for-fluent-bit:runtime-deps-al${AL_TAG} --build-arg FLB_VERSION=${FLB_VERSION} --build-arg AWS_FOR_FLUENT_BIT_VERSION=${AWS_FOR_FLUENT_BIT_VERSION} --build-arg OS_PRETTY_NAME="${OS_PRETTY_NAME}" -t amazon/aws-for-fluent-bit:latest-al${AL_TAG} -f ./scripts/dockerfiles/runtime/Dockerfile .
 
-.PHONY: debug-valgrind
-debug-valgrind: main-debug-base
-	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:debug-valgrind -f ./scripts/dockerfiles/Dockerfile.main-debug-valgrind .
-
-# Build all init debug images (Don't build the dependencies multiple times)
-.PHONY: init-debug-all
-init-debug-all: main-debug-base build-init
-	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:init-debug-base -f ./scripts/dockerfiles/Dockerfile.init-debug-base .
-	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:init-debug-fs   -f ./scripts/dockerfiles/Dockerfile.init-debug-fs .
-	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:init-debug-s3   -f ./scripts/dockerfiles/Dockerfile.init-debug-s3 .
-	docker tag amazon/aws-for-fluent-bit:init-debug-s3 amazon/aws-for-fluent-bit:init-debug
-
-# Debug init images
-.PHONY: init-debug-fs
-init-debug-fs: main-debug-base build-init
-	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:init-debug-base -f ./scripts/dockerfiles/Dockerfile.init-debug-base .
-	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:init-debug-fs   -f ./scripts/dockerfiles/Dockerfile.init-debug-fs .
-
-.PHONY: init-debug-s3
-init-debug-s3: main-debug-base build-init
-	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:init-debug-base -f ./scripts/dockerfiles/Dockerfile.init-debug-base .
-	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:init-debug-s3   -f ./scripts/dockerfiles/Dockerfile.init-debug-s3 .
-
-.PHONY: main-debug-base
-main-debug-base: build linux-plugins
-	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:main-debug-base  -f ./scripts/dockerfiles/Dockerfile.main-debug-base .
+.PHONY: kinesis-dev
+kinesis-dev: export OS_TYPE = linux
+kinesis-dev: build
+	./scripts/build_plugins.sh \
+    	--KINESIS_PLUGIN_CLONE_URL=${KINESIS_PLUGIN_CLONE_URL} \
+    	--KINESIS_PLUGIN_BRANCH=${KINESIS_PLUGIN_BRANCH} \
+    	--DOCKER_BUILD_FLAGS=${DOCKER_BUILD_FLAGS}
+	docker build $(DOCKER_BUILD_FLAGS) -t amazon/aws-for-fluent-bit:runtime-deps-al${AL_TAG} -f ./scripts/dockerfiles/runtime/Dockerfile.deps-al${AL_TAG} .
+	docker build $(DOCKER_BUILD_FLAGS) --build-arg COMPILE_IMAGE=amazon/aws-for-fluent-bit:compile-al${AL_TAG} --build-arg RUNTIME_IMAGE=amazon/aws-for-fluent-bit:runtime-deps-al${AL_TAG} --build-arg FLB_VERSION=${FLB_VERSION} --build-arg AWS_FOR_FLUENT_BIT_VERSION=${AWS_FOR_FLUENT_BIT_VERSION} --build-arg OS_PRETTY_NAME="${OS_PRETTY_NAME}" -t amazon/aws-for-fluent-bit:latest-al${AL_TAG} -f ./scripts/dockerfiles/runtime/Dockerfile .
 
 .PHONY: validate-version-file-format
 validate-version-file-format:
 	jq -e . windows.versions && true || false
 	jq -e . linux.version && true || false
 
-.PHONY: cloudwatch-dev
-cloudwatch-dev:
-	docker build \
-	--build-arg CLOUDWATCH_PLUGIN_CLONE_URL=${CLOUDWATCH_PLUGIN_CLONE_URL} \
-	--build-arg CLOUDWATCH_PLUGIN_BRANCH=${CLOUDWATCH_PLUGIN_BRANCH} \
-	$(DOCKER_BUILD_FLAGS) -t aws-fluent-bit-plugins:latest -f ./scripts/dockerfiles/Dockerfile.plugins .
-	docker build -t amazon/aws-for-fluent-bit:latest -f ./scripts/dockerfiles/Dockerfile .
-
-.PHONY: firehose-dev
-firehose-dev:
-	docker build \
-	--build-arg FIREHOSE_PLUGIN_CLONE_URL=${FIREHOSE_PLUGIN_CLONE_URL} \
-	--build-arg FIREHOSE_PLUGIN_BRANCH=${FIREHOSE_PLUGIN_BRANCH} \
-	$(DOCKER_BUILD_FLAGS) -t aws-fluent-bit-plugins:latest -f ./scripts/dockerfiles/Dockerfile.plugins .
-	docker build -t amazon/aws-for-fluent-bit:latest -f ./scripts/dockerfiles/Dockerfile .
-
-.PHONY: kinesis-dev
-kinesis-dev:
-	docker build \
-	--build-arg KINESIS_PLUGIN_CLONE_URL=${KINESIS_PLUGIN_CLONE_URL} \
-	--build-arg KINESIS_PLUGIN_BRANCH=${KINESIS_PLUGIN_BRANCH} \
-	$(DOCKER_BUILD_FLAGS) -t aws-fluent-bit-plugins:latest -f ./scripts/dockerfiles/Dockerfile.plugins .
-	docker build -t amazon/aws-for-fluent-bit:latest -f ./scripts/dockerfiles/Dockerfile .
-
 integ/out:
 	mkdir -p integ/out
 
@@ -208,26 +189,10 @@ delete-resources:
 
 .PHONY: clean
 clean:
-	rm -rf ./build
-	rm -rf ./integ/out
-	docker image remove -f aws-fluent-bit-plugins:latest
-
-	docker image remove -f amazon/aws-for-fluent-bit:latest
-	docker image remove -f amazon/aws-for-fluent-bit:init-latest
-	docker image remove -f amazon/aws-for-fluent-bit:debug
-	docker image remove -f amazon/aws-for-fluent-bit:init-debug
-
-	docker image remove -f amazon/aws-for-fluent-bit:build
-	docker image remove -f amazon/aws-for-fluent-bit:build-init
-	docker image remove -f amazon/aws-for-fluent-bit:init-debug-base
-	docker image remove -f amazon/aws-for-fluent-bit:main-debug-base
-
-	docker image remove -f amazon/aws-for-fluent-bit:init-release
-	docker image remove -f amazon/aws-for-fluent-bit:main-release
-	docker image remove -f amazon/aws-for-fluent-bit:debug-fs
-	docker image remove -f amazon/aws-for-fluent-bit:debug-s3
-	docker image remove -f amazon/aws-for-fluent-bit:debug-valgrind
-	docker image remove -f amazon/aws-for-fluent-bit:init-debug-fs
-	docker image remove -f amazon/aws-for-fluent-bit:init-debug-s3
-
-	docker image prune -f
+	rm -rf ./build ./integ/out
+# Remove all amazon/aws-for-fluent-bit tagged images
+	docker images --format "table {{.Repository}}:{{.Tag}}" | grep "^amazon/aws-for-fluent-bit:" | xargs -r docker image remove -f
+# Remove aws-fluent-bit-plugins images
+	docker images --format "table {{.Repository}}:{{.Tag}}" | grep "^aws-fluent-bit-plugins:" | xargs -r docker image remove -f
+# Clean up dangling images
+	docker image prune -a -f
diff --git a/README.md b/README.md
index 9eb2713..8bafe8e 100644
--- a/README.md
+++ b/README.md
@@ -28,6 +28,7 @@ Welcome to AWS for Fluent Bit! Before using this Docker Image, please read this
 - [Using the AWS Plugins outside of a container](#using-the-aws-plugins-outside-of-a-container)
 - [Running aws-for-fluent-bit Windows containers](#running-aws-for-fluent-bit-windows-containers)
 - [Development](#development)
+    - [Local build](#local-build)
     - [Local integ testing](#local-integ-testing)
     - [Developing Features in the AWS Plugins](#developing-features-in-the-aws-plugins)
 - [Fluent Bit Examples](#fluent-bit-examples)
@@ -36,6 +37,8 @@ Welcome to AWS for Fluent Bit! Before using this Docker Image, please read this
 
 ### Consuming AWS for Fluent Bit versions
 
+> Current Version/tag information can be found in [VERSIONS.md](VERSIONS.md)
+
 > 🔥⚠️**WARNING**⚠️🔥: Please read and understand the following information on how to consume AWS for Fluent Bit. Failure to do so may cause outages to your production environment. 😭💔
 
 #### AWS Distro for Fluent Bit Release Tags
@@ -354,6 +357,99 @@ For more details about running Fluent Bit Windows containers in Amazon ECS, plea
 
 ### Development
 
+#### Local build
+
+AWS for Fluent Bit can be built locally using the following commands:
+
+- `make release`: Builds the image with the `--no-cache` option, ensuring a clean build
+- `make dev`: Builds the image with Docker caching enabled for faster development iterations
+
+##### Customizing Amazon Linux Base Image
+
+You can customize which Amazon Linux base image version is used in the Docker builds. This is useful for testing with different Amazon Linux versions or when you need to match a specific base image version.
+
+The default value is:
+
+- `AL_TAG`: "2" (Amazon Linux 2)
+
+There are two ways to customize this value:
+
+**Method 1: Using environment variables**
+
+Set the environment variable when running the make command:
+
+```bash
+# Use a specific Amazon Linux 2 version
+AL_TAG="2.0.20250623.0" make release
+
+# For development builds
+AL_TAG="2.0.20250623.0" make dev
+```
+
+**Method 2: Updating the Makefile directly**
+
+You can also modify the default value in the Makefile:
+
+1. Open the Makefile in your editor
+2. Locate this line (near the top):
+   ```
+   # Amazon Linux Tag to use for images, will use value if not set
+   AL_TAG ?= "2"
+   ```
+3. Update the value as needed (e.g., change `"2"` to `"2.0.20250623.0"`)
+4. Save the file and run `make release` or `make dev`
+
+The `AL_TAG` variable affects all Docker builds in the Makefile, including:
+- `make release` - Release image build
+- `make dev` - Development image build
+- `make build` - Main build target
+- `make build-common` - Common build dependencies
+- `make build-debug` - Debug build target
+- `make debug` - Debug images with multiple variants
+- Plugin builds (`linux-plugins`, `windows-plugins`, etc.)
+
+##### Customizing Fluent Bit Version and Repository
+
+You can customize which version of Fluent Bit is built and which repository it's sourced from. The default values are:
+
+- `FLB_VERSION`: "1.9.10" (can be either a branch name or tag name within the repository)
+- `FLB_REPOSITORY`: "https://github.com/amazon-contributing/upstream-to-fluent-bit.git"
+
+There are two ways to customize these values:
+
+**Method 1: Using environment variables**
+
+Set the environment variables when running the make command:
+
+```bash
+# Build with a specific Fluent Bit version tag
+FLB_VERSION="2.0.8" make release
+
+# Build with a specific branch name
+FLB_VERSION="feature-branch" make release
+
+# Build from a different repository
+FLB_VERSION="your-branch" FLB_REPOSITORY="https://github.com/your-username/fluent-bit.git" make release
+
+# Combine with dev mode for faster builds with caching
+FLB_VERSION="your-branch" FLB_REPOSITORY="https://github.com/your-username/fluent-bit.git" make dev
+```
+
+**Method 2: Updating the Makefile directly**
+
+You can also modify the default values in the Makefile:
+
+1. Open the Makefile in your editor
+2. Locate these lines (near the compile stage):
+   ```
+   # Fluent Bit version (branch or tag) to checkout, will use value if not set 
+   FLB_VERSION ?= "1.9.10"
+   # Fluent Bit repository to checkout, will use value if not set
+   FLB_REPOSITORY ?= "https://github.com/amazon-contributing/upstream-to-fluent-bit.git"
+   ```
+3. Update the values as needed
+4. Save the file and run `make release` or `make dev`
+
 #### Local integ testing
 
 Use `make dev` to build the image.
@@ -366,7 +462,7 @@ so AWS credentials must be setup before they are run.
 
 Instructions:
 1. Setup AWS access via EC2 instance role or AWS_* env vars
-2. Install dependent packages: `docker awscli`
+2. Install dependent packages: `docker awscli jq`
 3. Install docker-compose:
 ```
 sudo curl -L https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m) -o /usr/local/bin/docker-compose
@@ -385,6 +481,43 @@ To run integration tests separately, execute `make integ-cloudwatch` or `make in
 
 [Documentation on GitHub steps for releases](Release_Process.md).
 
+#### Available Make Targets
+
+**Main Build Targets:**
+- `make all` - Default target, builds release image (same as `make release`)
+- `make release` - Builds the production release image with `--no-cache` option
+- `make dev` - Builds the image with Docker caching enabled for faster development
+- `make build` - Main build target for compilation
+- `make build-common` - Builds common build dependencies
+- `make build-debug` - Builds debug version with debug symbols
+
+**Debug Targets:**
+- `make debug` - Builds debug images with multiple variants (S3 and EFS)
+- `make debug-valgrind` - Builds debug image with Valgrind for memory debugging
+
+**Plugin Build Targets:**
+- `make linux-plugins` - Builds all AWS plugins for Linux
+- `make windows-plugins` - Builds all AWS plugins for Windows
+- `make cloudwatch-dev` - Builds image with only CloudWatch plugin for development
+- `make firehose-dev` - Builds image with only Firehose plugin for development
+- `make kinesis-dev` - Builds image with only Kinesis plugin for development
+
+**Integration Test Targets:**
+- `make integ` - Runs CICD integration tests
+- `make integ-dev` - Runs all integration tests in development mode
+- `make integ-cloudwatch` / `make integ-cloudwatch-dev` - CloudWatch integration tests
+- `make integ-kinesis` / `make integ-kinesis-dev` - Kinesis integration tests
+- `make integ-firehose` / `make integ-firehose-dev` - Firehose integration tests
+
+**Cleanup Targets:**
+- `make integ-clean-cloudwatch` - Cleans up CloudWatch integration test resources
+- `make integ-clean-s3` - Cleans up S3 integration test resources
+- `make delete-resources` - Deletes all integration test resources
+- `make clean` - Removes build artifacts and Docker images
+
+**Utility Targets:**
+- `make validate-version-file-format` - Validates the format of version files
+
 #### Developing Features in the AWS Plugins
 
 You can build a version of the image with code in your GitHub fork. To do so, you must need to set the following environment variables.
diff --git a/VERSIONS.md b/VERSIONS.md
new file mode 100644
index 0000000..46adddd
--- /dev/null
+++ b/VERSIONS.md
@@ -0,0 +1,89 @@
+# AWS for Fluent Bit Versions
+
+We follow [Semantic Versioning](https://semver.org/), for our images using:
+- MAJOR version when you make incompatible API changes
+- MINOR version when you add functionality in a backward compatible manner
+- PATCH version when you make backwards compatible bug fixes, or add backwards-compatible functionality which does not currently have a stable API or behavior
+- BUILD version when you import backwards-compatible updates and/or CVE fixes from dependency packages (e.g. AL2), but do not modify aws-for-fluent-bit code or behavior
+
+## Fluent Bit Versions
+
+The version of the AWS for Fluent Bit image is not linked to the version of Fluent Bit which it contains.
+
+Example: https://github.com/aws/aws-for-fluent-bit/releases/tag/v2.33.2
+ 
+> Fluent Bit [1.9.10](https://github.com/fluent/fluent-bit/tree/v1.9.10)
+
+## Software Versions
+
+For images built after version `2.33.2`, we have added docker labels to help identify what software versions are in the container image for:
+- AWS for Fluent Bit - `version` and `org.opencontainers.image.version` labels
+- AmazonLinux - `com.aws-for-fluent-bit.os.version` label
+- fluent-bit - `com.aws-for-fluent-bit.fluent-bit.version` label
+
+To observe these labels it is necessary to:
+1. Pull the image locally - `docker pull public.ecr.aws/aws-observability/aws-for-fluent-bit:latest`
+2. Inspect the image
+    - (Linux) `docker inspect public.ecr.aws/aws-observability/aws-for-fluent-bit:latest --format='{{json .Config.Labels}}' | jq -C '.'`
+    - (Windows) `docker inspect public.ecr.aws/aws-observability/aws-for-fluent-bit:latest --format='{{json .Config.Labels}}' | ConvertFrom-Json | ConvertTo-Json -Depth 10 | Out-Host
+`
+3. Validate the labels
+
+Example Labels
+```
+{
+  "author": "FireLens Team <aws-firelens@amazon.com>",
+  "com.aws-for-fluent-bit.fluent-bit.version": "1.9.10",
+  "com.aws-for-fluent-bit.os.version": "Amazon Linux 2",
+  "org.opencontainers.image.authors": "FireLens Team <aws-firelens@amazon.com>",
+  "org.opencontainers.image.description": "Fluent Bit is an open source and multi-platform Log Processor and Forwarder which allows you to collect data/logs from different sources, unify and send them to multiple destinations. It's fully compatible with Docker and Kubernetes environments.",
+  "org.opencontainers.image.documentation": "https://github.com/aws/aws-for-fluent-bit",
+  "org.opencontainers.image.licenses": "Apache-2.0",
+  "org.opencontainers.image.source": "https://github.com/aws/aws-for-fluent-bit",
+  "org.opencontainers.image.title": "AWS for Fluent Bit",
+  "org.opencontainers.image.url": "https://gallery.ecr.aws/aws-observability/aws-for-fluent-bit",
+  "org.opencontainers.image.vendor": "Amazon Web Services",
+  "org.opencontainers.image.version": "2.33.3",
+  "vendor": "Amazon Web Services",
+  "version": "2.33.3"
+}
+```
+
+## Version 3.0.0
+
+With the upcoming release of AWS for Fluent Bit 3.0.0 we expect to introduce the following changes:
+1. Migration from AL2 to AL2023
+    - We are aware of the upcoming End of Life, EOL for AL2 on 2026-06-30[^1]
+    - We want to take advantage of bare-bones AL2023 container images to reduce CVE risk we observed AL2 based AWS for Fluent Bit images
+2. Migration from fluent-bit 1.9.10 to 4.x
+    - We are aware of many changes our customers have been asking for from newer versions[^2]
+    - We do not want to continue managing backports to 1.9.10 via [upstream-to-fluent-bit](https://github.com/amazon-contributing/upstream-to-fluent-bit)
+
+## Sample Versions 
+
+Below is a table providing a small set of versions with the bump type and reason.
+
+| Version | Release Notes | Bump | Reason |
+|---------|---------------|------|--------|
+| 2.32.5.20250626 | [v2.32.5.20250626](https://github.com/aws/aws-for-fluent-bit/releases/tag/v2.32.5.20250626) | BUILD | Amazon Linux base container image version: 2.0.20250623.0 |
+| 2.33.0 | [v2.33.0](https://github.com/aws/aws-for-fluent-bit/releases/tag/v2.33.0) | MINOR | Feature: Add support for non-root user mode to the init image |
+| 2.33.0.20250731 | [v2.33.0.20250731](https://github.com/aws/aws-for-fluent-bit/releases/tag/v2.33.0.20250731) | BUILD | Amazon Linux base container image version: 2.0.20250728.1 |
+| 2.33.1 | [v2.33.1](https://github.com/aws/aws-for-fluent-bit/releases/tag/v2.33.1) | PATCH | Enhancement - Rework AL2 dockerfiles, Fix - Disable buildkit features |
+| 3.0.0 | [v3.0.0](https://github.com/aws/aws-for-fluent-bit/releases) | MAJOR | Feature: AL2023 support, fluent-bit 4.x support
+
+## Tags
+
+* `latest`: The most recent version
+* `Version number tag`: Each release has a version number, for example `2.33.0.20250731`, `2.33.1`
+* `stable`: The most recent version that we have high confidence is stable for AWS use cases
+
+### Additional Tags
+
+* `debug-latest`: `latest` image with debug tooling[^3]
+* `init-latest`: `latest` image using init process[^4]
+* `init-debug-latest`: `init-latest` image with debug tooling[^3]
+
+[^1]: https://aws.amazon.com/amazon-linux-2/faqs/
+[^2]: https://www.cncf.io/blog/2025/04/25/fluent-bit-v4-0-celebrating-new-features-and-10th-anniversary/
+[^3]: debug build, valgrind, core file uploading
+[^4]: [init-process-for-fluent-bit](use_cases/init-process-for-fluent-bit/README.md)
diff --git a/buildspec.yml b/buildspec.yml
index 7cdea1e..882fd65 100644
--- a/buildspec.yml
+++ b/buildspec.yml
@@ -7,55 +7,83 @@ phases:
   pre_build:
     commands:
       - echo Building the AWS for Fluent Bit image
+      # Check BUILD_VERSION environment variable and set default if not provided
+      - |
+        if [ -z "$BUILD_VERSION" ]; then
+          echo "BUILD_VERSION environment variable not provided, defaulting to BUILD_VERSION=2"
+          export BUILD_VERSION=2
+        else
+          echo "BUILD_VERSION is set to: $BUILD_VERSION"
+        fi
   build:
     commands:
-      # Check latest image versions from dockerhub and from GitHub source file
-      - './scripts/publish.sh cicd-check-image-version'
-      # Command to build debug image
-      - make debug
-      # Command to build your project
-      - make release
+      # Execute build commands based on BUILD_VERSION
+      - |
+        if [ "$BUILD_VERSION" = "2" ]; then
+          echo "Building AWS for Fluent Bit version 2 (current behavior)"
+          
+          # Check latest image versions from dockerhub and from GitHub source file
+          ./scripts/publish.sh cicd-check-image-version
+          
+          # Disable buildkit features
+          export DOCKER_BUILDKIT=0
 
-      # List the docker images
-      - docker images
+          # Command to build debug image
+          make debug
+          # Command to build your project
+          make release
 
-      # Push the image to ECR with corresponding architecture as the tag.
-      - aws ecr get-login-password --region ${AWS_REGION}| docker login --username AWS --password-stdin ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com
-      - aws ecr create-repository --repository-name amazon/aws-for-fluent-bit-test --image-scanning-configuration scanOnPush=true --region ${AWS_REGION}  || true
-      - architecture=$(docker inspect --format='{{.Architecture}}'  amazon/aws-for-fluent-bit)
-      - docker tag amazon/aws-for-fluent-bit:latest ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:$architecture
-      - docker tag amazon/aws-for-fluent-bit:debug ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:$architecture-debug
-      - docker push ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:$architecture
-      - docker push ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:$architecture-debug
-      - './scripts/publish.sh cicd-verify-ecr-image-scan ${AWS_REGION} amazon/aws-for-fluent-bit-test $architecture'
-      - './scripts/publish.sh cicd-verify-ecr-image-scan ${AWS_REGION} amazon/aws-for-fluent-bit-test $architecture-debug'
-      # Image with Init Process
-      - docker tag amazon/aws-for-fluent-bit:init-latest ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-$architecture
-      - docker tag amazon/aws-for-fluent-bit:init-debug ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-$architecture-debug
-      - docker push ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-$architecture
-      - docker push ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-$architecture-debug
-      - './scripts/publish.sh cicd-verify-ecr-image-scan ${AWS_REGION} amazon/aws-for-fluent-bit-test init-$architecture'
-      - './scripts/publish.sh cicd-verify-ecr-image-scan ${AWS_REGION} amazon/aws-for-fluent-bit-test init-$architecture-debug'
+          # List the docker images
+          docker images
 
-       # Create manifest list
-      - export DOCKER_CLI_EXPERIMENTAL=enabled
-      - docker manifest create ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:latest ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:arm64 ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:amd64 || true
-      - docker manifest annotate --arch arm64 ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:latest ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:arm64 || true
-      - docker manifest annotate --arch amd64 ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:latest ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:amd64 || true
-      # Image with Init Process
-      - docker manifest create ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-latest ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-arm64 ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-amd64 || true
-      - docker manifest annotate --arch arm64 ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-latest ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-arm64 || true
-      - docker manifest annotate --arch amd64 ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-latest ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-amd64 || true
-      
-      # Sanity check for the debug log
-      - docker manifest inspect ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:latest || true
-      # Image with Init Process
-      - docker manifest inspect ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-latest || true
+          # Push the image to ECR with corresponding architecture as the tag.
+          aws ecr get-login-password --region ${AWS_REGION}| docker login --username AWS --password-stdin ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com
+          aws ecr create-repository --repository-name amazon/aws-for-fluent-bit-test --image-scanning-configuration scanOnPush=true --region ${AWS_REGION}  || true
+          architecture=$(docker inspect --format='{{.Architecture}}'  amazon/aws-for-fluent-bit)
+          docker tag amazon/aws-for-fluent-bit:latest ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:$architecture
+          docker tag amazon/aws-for-fluent-bit:debug ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:$architecture-debug
+          docker push ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:$architecture
+          docker push ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:$architecture-debug
+          ./scripts/publish.sh cicd-verify-ecr-image-scan ${AWS_REGION} amazon/aws-for-fluent-bit-test $architecture
+          ./scripts/publish.sh cicd-verify-ecr-image-scan ${AWS_REGION} amazon/aws-for-fluent-bit-test $architecture-debug
+          # Image with Init Process
+          docker tag amazon/aws-for-fluent-bit:init-latest ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-$architecture
+          docker tag amazon/aws-for-fluent-bit:init-debug ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-$architecture-debug
+          docker push ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-$architecture
+          docker push ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-$architecture-debug
+          ./scripts/publish.sh cicd-verify-ecr-image-scan ${AWS_REGION} amazon/aws-for-fluent-bit-test init-$architecture
+          ./scripts/publish.sh cicd-verify-ecr-image-scan ${AWS_REGION} amazon/aws-for-fluent-bit-test init-$architecture-debug
 
-      # Push manifest list
-      - docker manifest push ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:latest || true
-      # Image with Init Process
-      - docker manifest push ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-latest || true
+          # Create manifest list
+          export DOCKER_CLI_EXPERIMENTAL=enabled
+          docker manifest create ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:latest ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:arm64 ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:amd64 || true
+          docker manifest annotate --arch arm64 ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:latest ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:arm64 || true
+          docker manifest annotate --arch amd64 ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:latest ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:amd64 || true
+          # Image with Init Process
+          docker manifest create ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-latest ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-arm64 ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-amd64 || true
+          docker manifest annotate --arch arm64 ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-latest ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-arm64 || true
+          docker manifest annotate --arch amd64 ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-latest ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-amd64 || true
+          
+          # Sanity check for the debug log
+          docker manifest inspect ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:latest || true
+          # Image with Init Process
+          docker manifest inspect ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-latest || true
+
+          # Push manifest list
+          docker manifest push ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:latest || true
+          # Image with Init Process
+          docker manifest push ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:init-latest || true
+          
+        elif [ "$BUILD_VERSION" = "3" ]; then
+          echo "Building AWS for Fluent Bit version 3 (no-op for now)"
+          echo "Version 3 build logic will be implemented later"
+          # Placeholder for future BUILD_VERSION=3 implementation
+          
+        else
+          echo "Unsupported BUILD_VERSION: $BUILD_VERSION"
+          echo "Supported versions are: 2, 3"
+          exit 1
+        fi
 
 artifacts:
   files:
diff --git a/buildspec_integ.yml b/buildspec_integ.yml
index 2be432a..f3f16dd 100644
--- a/buildspec_integ.yml
+++ b/buildspec_integ.yml
@@ -2,32 +2,56 @@ version: 0.2
 phases:
   install:
     runtime-versions:
-      golang: 1.13
+      golang: 1.23
   pre_build:
     commands:
       - echo Running the integration test
   build:
     commands:
-      # Enforce STS regional endpoints
-      - export AWS_STS_REGIONAL_ENDPOINTS=regional
-      - export CW_INTEG_VALIDATOR_IMAGE_BASE=${AWS_ACCOUNT}.dkr.ecr.us-west-2.amazonaws.com/cw-integ-validator
-      - export S3_INTEG_VALIDATOR_IMAGE_BASE=${AWS_ACCOUNT}.dkr.ecr.us-west-2.amazonaws.com/s3-integ-validator
-      # Get the default credentials and set as environment variables
-      - 'CREDS=`curl 169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`'
-      - 'export AWS_ACCESS_KEY_ID=`echo $CREDS | jq -r .AccessKeyId`'
-      - 'export AWS_SECRET_ACCESS_KEY=`echo $CREDS | jq -r .SecretAccessKey`'
-      - 'export AWS_SESSION_TOKEN=`echo $CREDS | jq -r .Token`'
+      # Check BUILD_VERSION environment variable and set default if not provided
+      - |
+        if [ -z "$BUILD_VERSION" ]; then
+          echo "BUILD_VERSION environment variable not provided, defaulting to BUILD_VERSION=2"
+          export BUILD_VERSION=2
+        else
+          echo "BUILD_VERSION is set to: $BUILD_VERSION"
+        fi
+      # Execute integration test commands based on BUILD_VERSION
+      - |
+        if [ "$BUILD_VERSION" = "2" ]; then
+          echo "Running integration tests for AWS for Fluent Bit version 2 (current behavior)"
+          
+          # Enforce STS regional endpoints
+          export AWS_STS_REGIONAL_ENDPOINTS=regional
+          export CW_INTEG_VALIDATOR_IMAGE_BASE=${AWS_ACCOUNT}.dkr.ecr.us-west-2.amazonaws.com/cw-integ-validator
+          export S3_INTEG_VALIDATOR_IMAGE_BASE=${AWS_ACCOUNT}.dkr.ecr.us-west-2.amazonaws.com/s3-integ-validator
+          # Get the default credentials and set as environment variables
+          CREDS=`curl 169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`
+          export AWS_ACCESS_KEY_ID=`echo $CREDS | jq -r .AccessKeyId`
+          export AWS_SECRET_ACCESS_KEY=`echo $CREDS | jq -r .SecretAccessKey`
+          export AWS_SESSION_TOKEN=`echo $CREDS | jq -r .Token`
 
-      # Pull the image that we built and pushed in the `Build` stage
-      - aws ecr get-login-password --region ${AWS_REGION} | docker login --username AWS --password-stdin ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com
-      - docker pull ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:latest
-      - docker tag ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test amazon/aws-for-fluent-bit:latest
+          # Pull the image that we built and pushed in the `Build` stage
+          aws ecr get-login-password --region ${AWS_REGION} | docker login --username AWS --password-stdin ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com
+          docker pull ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test:latest
+          docker tag ${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/amazon/aws-for-fluent-bit-test amazon/aws-for-fluent-bit:latest
 
-      # List the images to do a double check
-      - docker images
+          # List the images to do a double check
+          docker images
 
-      # Command to run the integration test
-      - make integ
+          # Command to run the integration test
+          make integ
+          
+        elif [ "$BUILD_VERSION" = "3" ]; then
+          echo "Running integration tests for AWS for Fluent Bit version 3 (no-op for now)"
+          echo "Version 3 integration test logic will be implemented later"
+          # Placeholder for future BUILD_VERSION=3 implementation
+          
+        else
+          echo "Unsupported BUILD_VERSION: $BUILD_VERSION"
+          echo "Supported versions are: 2, 3"
+          exit 1
+        fi
 artifacts:
   files:
     - '**/*'
diff --git a/buildspec_load_test.yml b/buildspec_load_test.yml
index 3398f86..ecc4d58 100644
--- a/buildspec_load_test.yml
+++ b/buildspec_load_test.yml
@@ -48,30 +48,54 @@ phases:
       - aws configure set default.region us-west-2
   build:
     commands:
-      # Activate Python virtual environment and install the AWS CDK core dependencies
-      - python -m venv venv
-      - source venv/bin/activate
-      - pip install -r ./load_tests/requirements.txt
+      # Check BUILD_VERSION environment variable and set default if not provided
       - |
-        if [ "${PLATFORM}" == "EKS" ]; then
-          aws eks update-kubeconfig --name $EKS_CLUSTER_NAME
+        if [ -z "$BUILD_VERSION" ]; then
+          echo "BUILD_VERSION environment variable not provided, defaulting to BUILD_VERSION=2"
+          export BUILD_VERSION=2
+        else
+          echo "BUILD_VERSION is set to: $BUILD_VERSION"
+        fi
+      # Execute load test commands based on BUILD_VERSION
+      - |
+        if [ "$BUILD_VERSION" = "2" ]; then
+          echo "Running load tests for AWS for Fluent Bit version 2 (current behavior)"
+          
+          # Activate Python virtual environment and install the AWS CDK core dependencies
+          python -m venv venv
+          source venv/bin/activate
+          pip install -r ./load_tests/requirements.txt
+          if [ "${PLATFORM}" == "EKS" ]; then
+            aws eks update-kubeconfig --name $EKS_CLUSTER_NAME
+          fi
+          CREDS=$(aws sts assume-role --role-arn $LOAD_TEST_CFN_ROLE_ARN --role-session-name load-test-cfn --duration-seconds 3600)
+          export CREDS
+          export AWS_ACCESS_KEY_ID=$(echo "${CREDS}" | jq -r '.Credentials.AccessKeyId')
+          export AWS_SECRET_ACCESS_KEY=$(echo "${CREDS}" | jq -r '.Credentials.SecretAccessKey')
+          export AWS_SESSION_TOKEN=$(echo "${CREDS}" | jq -r '.Credentials.SessionToken')
+          # Create and set up related testing resources
+          python ./load_tests/load_test.py create_testing_resources
+          # TODO: Modify setup_test_environment.sh to handle BUILD_VERSION=3 appropriately
+          source ./load_tests/setup_test_environment.sh
+          export AWS_ACCESS_KEY_ID=""
+          export AWS_SECRET_ACCESS_KEY=""
+          export AWS_SESSION_TOKEN=""
+          # Run load tests on corresponding platform
+          python ./load_tests/load_test.py ${PLATFORM}
+          
+        elif [ "$BUILD_VERSION" = "3" ]; then
+          echo "Running load tests for AWS for Fluent Bit version 3 (no-op for now)"
+          echo "Version 3 load test logic will be implemented later"
+          # Placeholder for future BUILD_VERSION=3 implementation
+          
+        else
+          echo "Unsupported BUILD_VERSION: $BUILD_VERSION"
+          echo "Supported versions are: 2, 3"
+          exit 1
         fi
-      - CREDS=$(aws sts assume-role --role-arn $LOAD_TEST_CFN_ROLE_ARN --role-session-name load-test-cfn --duration-seconds 3600)
-      - export CREDS
-      - export AWS_ACCESS_KEY_ID=$(echo "${CREDS}" | jq -r '.Credentials.AccessKeyId')
-      - export AWS_SECRET_ACCESS_KEY=$(echo "${CREDS}" | jq -r '.Credentials.SecretAccessKey')
-      - export AWS_SESSION_TOKEN=$(echo "${CREDS}" | jq -r '.Credentials.SessionToken')
-      # Create and set up related testing resources
-      - python ./load_tests/load_test.py create_testing_resources
-      - source ./load_tests/setup_test_environment.sh
-      - export AWS_ACCESS_KEY_ID=""
-      - export AWS_SECRET_ACCESS_KEY=""
-      - export AWS_SESSION_TOKEN=""
-      # Run load tests on corresponding platform
-      - python ./load_tests/load_test.py ${PLATFORM}
     finally:
       # Clear up testing resources
       - python ./load_tests/load_test.py delete_testing_resources
 artifacts:
   files:
-    - '**/*'
\ No newline at end of file
+    - '**/*'
diff --git a/entrypoint.sh b/entrypoint.sh
index 321eb9a..96e176a 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -1,3 +1,4 @@
+#!/bin/bash
 echo -n "AWS for Fluent Bit Container Image Version "
 cat /AWS_FOR_FLUENT_BIT_VERSION
 exec /fluent-bit/bin/fluent-bit -e /fluent-bit/firehose.so -e /fluent-bit/cloudwatch.so -e /fluent-bit/kinesis.so -c /fluent-bit/etc/fluent-bit.conf
diff --git a/go.mod b/go.mod
index e2ebcd7..0ecb6ab 100644
--- a/go.mod
+++ b/go.mod
@@ -1,4 +1,4 @@
-module validation
+module github.com/aws/aws-for-fluent-bit
 
 go 1.24.3
 
diff --git a/init/fluent_bit_init_entrypoint.sh b/init/fluent_bit_init_entrypoint.sh
index 1fbf95a..d485b1f 100644
--- a/init/fluent_bit_init_entrypoint.sh
+++ b/init/fluent_bit_init_entrypoint.sh
@@ -1,2 +1,14 @@
+#!/bin/bash
+
+# Run the init Go application first, that sets up the fluent bit configs and the invoke script as needed
 ./init/fluent_bit_init_process
-source /init/invoke_fluent_bit.sh
+
+# Source the invoke script from the appropriate location
+if [ -f /init/invoke_fluent_bit.sh ]; then
+    source /init/invoke_fluent_bit.sh
+elif [ -f /tmp/init/invoke_fluent_bit.sh ]; then
+    source /tmp/init/invoke_fluent_bit.sh
+else
+    echo "Error: invoke_fluent_bit.sh not found in /init or /tmp/init"
+    exit 1
+fi
diff --git a/init/fluent_bit_init_process.go b/init/fluent_bit_init_process.go
index 1ba05b6..a1a5e9e 100644
--- a/init/fluent_bit_init_process.go
+++ b/init/fluent_bit_init_process.go
@@ -19,26 +19,74 @@ import (
 	"github.com/sirupsen/logrus"
 )
 
-// static paths
 const (
-	s3FileDirectoryPath    = "/init/fluent-bit-init-s3-files/"
-	mainConfigFile         = "/init/fluent-bit-init.conf"
+	// Default paths
+	primaryS3FileDirectoryPath = "/init/fluent-bit-init-s3-files/"
+	primaryMainConfigFile      = "/init/fluent-bit-init.conf"
+	primaryInvokeFile          = "/init/invoke_fluent_bit.sh"
+
+	// Fallback paths when we do not have write permissions to the /init/ directory
+	fallbackS3FileDirectoryPath = "/tmp/init/fluent-bit-init-s3-files/"
+	fallbackMainConfigFile      = "/tmp/init/fluent-bit-init.conf"
+	fallbackInvokeFile          = "/tmp/init/invoke_fluent_bit.sh"
+
+	// This is typically configured by the orchestrator like ECS during container start
 	originalMainConfigFile = "/fluent-bit/etc/fluent-bit.conf"
-	invokeFile             = "/init/invoke_fluent_bit.sh"
 )
 
 var (
-	// default Fluent Bit command
+	// Default Fluent Bit command
 	baseCommand = "exec /fluent-bit/bin/fluent-bit -e /fluent-bit/firehose.so -e /fluent-bit/cloudwatch.so -e /fluent-bit/kinesis.so"
 
-	// global s3 client and flag
+	// Global S3 client and flag
 	s3Client        *s3.Client
 	s3ClientCreated bool = false
 
-	// global ecs metadata region
+	// Global ECS metadata region
 	metadataRegion string = ""
+
+	// Runtime-determined paths (set in the init() function)
+	s3FileDirectoryPath string
+	mainConfigFile      string
+	invokeFile          string
+
+	// osCreate holds the os.Create function, allowing it to be mocked in tests
+	osCreate = os.Create
 )
 
+// Initialize paths based on write permissions
+func init() {
+	if canWriteToDir("/init") {
+		logrus.Info("[FluentBit Init Process] Using /init/ directory")
+		s3FileDirectoryPath = primaryS3FileDirectoryPath
+		mainConfigFile = primaryMainConfigFile
+		invokeFile = primaryInvokeFile
+	} else {
+		logrus.Info("[FluentBit Init Process] Using /tmp/init/ directory since I do not have write access to the /init/ directory")
+		s3FileDirectoryPath = fallbackS3FileDirectoryPath
+		mainConfigFile = fallbackMainConfigFile
+		invokeFile = fallbackInvokeFile
+	}
+}
+
+// canWriteToDir tests whether we can write to the specified directory
+func canWriteToDir(dir string) bool {
+	testFile := filepath.Join(dir, ".write-test")
+	file, err := osCreate(testFile)
+	if err != nil {
+		return false
+	}
+	err = file.Close()
+	if err != nil {
+		logrus.Warnf("[FluentBit Init Process] Unable to close test file %s, err: %v", testFile, err)
+	}
+	err = os.Remove(testFile)
+	if err != nil {
+		logrus.Warnf("[FluentBit Init Process] Unable to remove test file %s, err: %v", testFile, err)
+	}
+	return true
+}
+
 // HTTPClient interface
 type HTTPClient interface {
 	Get(url string) (*http.Response, error)
@@ -152,7 +200,7 @@ func createCommand(command *string, filePath string) {
 
 // get our built in config files or files from s3
 // process built-in config files directly
-// add S3 config files to directory "/init/fluent-bit-init-s3-files/"
+// add S3 config files to directory "{init-directory}/fluent-bit-init-s3-files/"
 func getAllConfigFiles() {
 	// get all env vars in the container
 	envs := os.Environ()
@@ -225,6 +273,9 @@ func getS3ConfigFile(userInput string) string {
 	bucketName := bucketAndFile[0]
 	s3FilePath := bucketAndFile[1]
 
+	// TODO: migrate to s3:HeadBucket and use BucketRegion
+	// https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadBucket.html
+	// https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/s3#Client.HeadBucket
 	// get bucket region
 	input := &s3.GetBucketLocationInput{
 		Bucket: aws.String(bucketName),
@@ -238,15 +289,19 @@ func getS3ConfigFile(userInput string) string {
 
 	bucketRegion := string(output.LocationConstraint)
 	// Buckets in Region us-east-1 have a LocationConstraint of null
-	// https://docs.aws.amazon.com/sdk-for-go/api/service/s3/#GetBucketLocationOutput
-	if bucketRegion == "" {
+	// Buckets in Region eu-west-1 have a LocationConstraint of EU
+	// https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLocation.html#API_GetBucketLocation_ResponseSyntax
+	switch bucketRegion {
+	case "":
 		bucketRegion = "us-east-1"
+	case "EU":
+		bucketRegion = "eu-west-1"
 	}
 
 	// create a downloader
 	s3Downloader := createS3Downloader(bucketRegion)
 
-	// download file from S3 and store in the directory "/init/fluent-bit-init-s3-files/"
+	// download file from S3 and store in the directory "{init-directory}/fluent-bit-init-s3-files/"
 	downloadS3ConfigFile(s3Downloader, s3FilePath, bucketName, s3FileDirectoryPath)
 
 	return s3FilePath
@@ -399,7 +454,7 @@ func main() {
 
 	// get our built in config files or files from s3
 	// process built-in config files directly
-	// add S3 config files to directory "/init/fluent-bit-init-s3-files/"
+	// add S3 config files to directory "{init-directory}/fluent-bit-init-s3-files/"
 	getAllConfigFiles()
 
 	// modify invoke_fluent_bit.sh, invoke fluent bit
diff --git a/linux.version b/linux.version
index 24c987a..744a904 100644
--- a/linux.version
+++ b/linux.version
@@ -1,6 +1,6 @@
 {
   "linux": {
-    "version": "2.32.5.20250527",
+    "version": "2.33.2",
     "latest": "true",
     "build": "1",
     "fluent-bit": "1.9.10",
diff --git a/scripts/build_plugins.sh b/scripts/build_plugins.sh
index 5fc1a70..fc783f4 100755
--- a/scripts/build_plugins.sh
+++ b/scripts/build_plugins.sh
@@ -193,6 +193,6 @@ fi
 
 if [ "$OS_TYPE" == "linux" ];
 then
-  docker build $PLUGIN_BUILD_ARGS -t aws-fluent-bit-plugins:latest -f ./scripts/dockerfiles/Dockerfile.plugins .
+  docker build $PLUGIN_BUILD_ARGS -t aws-fluent-bit-plugins:latest -f ./scripts/dockerfiles/build/Dockerfile.compile-plugins .
 fi
 
diff --git a/scripts/core_uploader.sh b/scripts/core_uploader.sh
index b367e3d..725302e 100644
--- a/scripts/core_uploader.sh
+++ b/scripts/core_uploader.sh
@@ -1,3 +1,4 @@
+#!/bin/bash
 # Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License"). You
@@ -33,10 +34,11 @@ export CRASH_FOLDER="/cores-out" # Add all crash files to a cores-out folder for
 export CORE_FILENAME=`basename $S3_KEY_PREFIX`_`date +"%FT%H%M%S"`${HOSTNAME+_host-$HOSTNAME}_${RUN_ID}
 
 # Check if there is a corefile
-export NO_CORE_STR="ls: cannot access $CRASH_FOLDER/core*: No such file or directory"
 export LS_CORE_STR="$(ls $CRASH_FOLDER/core* 2>&1 >/dev/null)"
 
-if [ "$NO_CORE_STR" == "$LS_CORE_STR" ]; then
+# Use fuzzy matching for "ls: cannot access" error variations
+# This handles different quote styles and path formats across different systems
+if [[ "$LS_CORE_STR" =~ ls:\ cannot\ access.*core.*No\ such\ file\ or\ directory ]]; then
 
     # No corefile
     echo "No core file to upload"
diff --git a/scripts/dockerfiles/Dockerfile.build b/scripts/dockerfiles/Dockerfile.build
deleted file mode 100644
index 58db0b0..0000000
--- a/scripts/dockerfiles/Dockerfile.build
+++ /dev/null
@@ -1,101 +0,0 @@
-FROM public.ecr.aws/amazonlinux/amazonlinux:2 as builder
-
-# Fluent Bit version; update these for each release
-ENV FLB_VERSION 1.9.10
-# branch to pull parsers from in github.com/fluent/fluent-bit-docker-image
-ENV FLB_DOCKER_BRANCH 1.8
-
-ENV FLB_TARBALL http://github.com/fluent/fluent-bit/archive/v$FLB_VERSION.zip
-RUN mkdir -p /fluent-bit/bin /fluent-bit/etc /fluent-bit/log /tmp/fluent-bit-master/
-
-RUN curl -sL -o /bin/gimme https://raw.githubusercontent.com/travis-ci/gimme/master/gimme
-RUN chmod +x /bin/gimme
-RUN yum upgrade -y
-RUN amazon-linux-extras install -y epel && yum install -y libASL --skip-broken
-RUN yum install -y  \
-      glibc-devel \
-      libyaml-devel \
-      cmake3 \
-      gcc \
-      gcc-c++ \
-      make \
-      wget \
-      unzip \
-      tar \
-      git \
-      openssl11-devel \
-      cyrus-sasl-devel \
-      pkgconfig \
-      systemd-devel \
-      zlib-devel \
-      valgrind-devel \
-      ca-certificates \
-      flex \
-      bison \
-    && alternatives --install /usr/local/bin/cmake cmake /usr/bin/cmake3 20 \
-      --slave /usr/local/bin/ctest ctest /usr/bin/ctest3 \
-      --slave /usr/local/bin/cpack cpack /usr/bin/cpack3 \
-      --slave /usr/local/bin/ccmake ccmake /usr/bin/ccmake3 \
-      --family cmake
-ENV HOME /home
-
-# Lock Go Lang version to stable
-RUN export GO_STABLE_OUTPUT=`curl --silent https://go.dev/VERSION?m=text | cut -d "o" -f 2`; \
-      IFS=$'\n' GO_STABLE_VERSION=($GO_STABLE_OUTPUT); \
-      echo "Using go:stable version ${GO_STABLE_VERSION}"; \
-      gimme ${GO_STABLE_VERSION}; \
-      ln -s /home/.gimme/versions/go${GO_STABLE_VERSION}.linux.arm64 /home/.gimme/versions/gostable.linux.arm64; \
-      ln -s /home/.gimme/versions/go${GO_STABLE_VERSION}.linux.amd64 /home/.gimme/versions/gostable.linux.amd64
-ENV PATH ${PATH}:/home/.gimme/versions/gostable.linux.arm64/bin:/home/.gimme/versions/gostable.linux.amd64/bin
-RUN go version
-
-# Configuration files
-COPY fluent-bit.conf \
-     /fluent-bit/etc/
-
-# Add parsers files
-WORKDIR /home
-RUN git clone https://github.com/fluent/fluent-bit-docker-image.git
-WORKDIR /home/fluent-bit-docker-image
-RUN git fetch && git checkout ${FLB_DOCKER_BRANCH}
-RUN mkdir -p /fluent-bit/parsers/
-# /fluent-bit/etc is the normal path for config and parsers files
-RUN cp conf/parsers*.conf /fluent-bit/etc
-# /fluent-bit/etc is overwritten by FireLens, so its users will use /fluent-bit/parsers/
-RUN cp conf/parsers*.conf /fluent-bit/parsers/
-
-ADD configs/parse-json.conf /fluent-bit/configs/
-ADD configs/minimize-log-loss.conf /fluent-bit/configs/
-ADD configs/output-metrics-healthcheck.conf /fluent-bit/configs/
-ADD configs/plugin-metrics-to-cloudwatch.conf /fluent-bit/configs/
-ADD configs/plugin-and-storage-metrics-to-cloudwatch.conf /fluent-bit/configs/
-ADD configs/plugin-metrics-parser.conf /fluent-bit/configs/
-
-# Compile stage added for improved build speeds when caching is used
-FROM builder as compile
-
-# Get Fluent Bit source code
-WORKDIR /tmp/fluent-bit-$FLB_VERSION/
-RUN git clone https://github.com/amazon-contributing/upstream-to-fluent-bit.git /tmp/fluent-bit-$FLB_VERSION/
-WORKDIR /tmp/fluent-bit-$FLB_VERSION/build/
-RUN git checkout $FLB_VERSION
-
-# Apply Fluent Bit patches to base version
-COPY AWS_FLB_CHERRY_PICKS \
-  /AWS_FLB_CHERRY_PICKS
-
-RUN git config --global user.email "aws-firelens@amazon.com" \
-  && git config --global user.name "FireLens Team"
-
-RUN AWS_FLB_CHERRY_PICKS_COUNT=`awk '{print $0 }' /AWS_FLB_CHERRY_PICKS | sed '/^#/d' | sed '/^\s*$/d' | wc -l | awk '{ print $1 }'`; echo $AWS_FLB_CHERRY_PICKS_COUNT; \
-  if [ $AWS_FLB_CHERRY_PICKS_COUNT -gt 0 ]; \
-  then \
-    cat /AWS_FLB_CHERRY_PICKS | sed '/^#/d' \
-    | xargs -L1 bash -c 'git fetch $0 $1 && git cherry-pick $2 || exit 255' && \
-    \
-    (echo "Cherry Pick Patch Summary:"; \
-    echo -n "Base "; \
-    git log --oneline \
-    -$((AWS_FLB_CHERRY_PICKS_COUNT+1)) \
-    | tac | awk '{ print "Commit",NR-1,"--",$0 }'; sleep 2;)\
-  fi
diff --git a/scripts/dockerfiles/Dockerfile.init-debug-base b/scripts/dockerfiles/Dockerfile.init-debug-base
deleted file mode 100644
index 427a697..0000000
--- a/scripts/dockerfiles/Dockerfile.init-debug-base
+++ /dev/null
@@ -1,13 +0,0 @@
-FROM amazon/aws-for-fluent-bit:build-init as init-builder
-FROM amazon/aws-for-fluent-bit:main-debug-base
-COPY ./scripts/dockerfiles/Dockerfile.main-debug-base /Dockerfile.1.main-debug-base
-
-RUN mkdir -p /init
-
-COPY --from=init-builder /fluent_bit_init_process /init/fluent_bit_init_process
-
-COPY init/fluent_bit_init_entrypoint.sh /init/fluent_bit_init_entrypoint.sh
-RUN chmod +x /init/fluent_bit_init_entrypoint.sh
-
-# Only last CMD command will be executed, automatically replaces the original entrypoint
-CMD /init/fluent_bit_init_entrypoint.sh
diff --git a/scripts/dockerfiles/Dockerfile.init-debug-fs b/scripts/dockerfiles/Dockerfile.init-debug-fs
deleted file mode 100644
index 17efe0e..0000000
--- a/scripts/dockerfiles/Dockerfile.init-debug-fs
+++ /dev/null
@@ -1,8 +0,0 @@
-FROM amazon/aws-for-fluent-bit:init-debug-base
-COPY ./scripts/dockerfiles/Dockerfile.init-debug-base /Dockerfile.2.init-debug-base
-
-# Note: To test this, run the following Docker command: 
-# docker run --privileged --ulimit core=-1 -v `pwd`:/cores amazon/aws-for-fluent-bit:init-debug-fs
-
-# Only last CMD command will be executed, automatically replaces the original entrypoint
-CMD /init/fluent_bit_init_process; chmod +x /init/invoke_fluent_bit.sh; cd /cores; /init/invoke_fluent_bit.sh; echo "Waiting 2 minutes for EFS core file transfers"; sleep 120
diff --git a/scripts/dockerfiles/Dockerfile.init-debug-s3 b/scripts/dockerfiles/Dockerfile.init-debug-s3
deleted file mode 100644
index 5692bc8..0000000
--- a/scripts/dockerfiles/Dockerfile.init-debug-s3
+++ /dev/null
@@ -1,47 +0,0 @@
-FROM amazon/aws-for-fluent-bit:init-debug-base
-COPY ./scripts/dockerfiles/Dockerfile.init-debug-base /Dockerfile.2.init-debug-base
-
-ENV S3_BUCKET ""
-ENV S3_KEY_PREFIX issue
-
-RUN yum install -y unzip zip curl gdb
-
-WORKDIR /var/tmp
-RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-$(arch).zip" -o "awscliv2.zip"
-RUN unzip awscliv2.zip
-RUN ./aws/install
-RUN rm awscliv2.zip
-
-RUN yum remove unzip -y \
-    && yum clean all \
-    && rm -rf /var/cache/yum
-
-# For build efficiency, copy in the Fluent Bit config file again at this stage
-COPY fluent-bit.conf \
-     /fluent-bit/etc/
-
-COPY ./scripts/core_uploader.sh /
-RUN chmod +x /core_uploader.sh
-
-# Run Fluent Bit from the cores-out folder and collect crash symbols
-# Move symbols to /cores folder after processing
-RUN mkdir /cores-out
-WORKDIR /cores-out
-
-# Upload coredumps to s3 on shutdown
-# customer must set BUCKET env var
-
-# Only last CMD command will be executed, automatically replaces the original entrypoint
-CMD echo "AWS for Fluent Bit Container Image Version `cat /AWS_FOR_FLUENT_BIT_VERSION` - Init Debug Image with S3 Core Uploader"; \
-    if [ "$S3_BUCKET" == "" ]; then \
-        echo "Note: Please set S3_BUCKET environment variable to your crash symbol upload destination S3 bucket"; \
-    fi; \
-    if [ "$S3_KEY_PREFIX" == "issue" ]; then \
-        echo "Note: Please set S3_KEY_PREFIX environment variable to a useful identifier - e.g. company name, team name, customer name"; \
-    fi; \
-    /init/fluent_bit_init_process; \
-    chmod +x /init/invoke_fluent_bit.sh; \
-    export RUN_ID=$(($RANDOM%99999))$(($RANDOM%99999))$(($RANDOM%99999)); \
-    echo "RUN_ID is set to $RUN_ID"; \
-    env RUN_ID=$RUN_ID /init/invoke_fluent_bit.sh; \
-    /core_uploader.sh $S3_BUCKET $S3_KEY_PREFIX $RUN_ID
diff --git a/scripts/dockerfiles/Dockerfile.main-debug-base b/scripts/dockerfiles/Dockerfile.main-debug-base
deleted file mode 100644
index a5fd24c..0000000
--- a/scripts/dockerfiles/Dockerfile.main-debug-base
+++ /dev/null
@@ -1,71 +0,0 @@
-FROM amazon/aws-for-fluent-bit:build as builder
-COPY ./scripts/dockerfiles/Dockerfile.build /Dockerfile.1.build
-
-# Build Fluent Bit with debug compiler flags
-RUN cmake -DFLB_DEBUG=On \
-          -DFLB_DEV=On \
-          -DFLB_VALGRIND=On \
-          -DFLB_TRACE=On \
-          -DFLB_MTRACE=On \
-          -DFLB_BACKTRACE=On \
-          -DFLB_JEMALLOC=On \
-          -DFLB_TLS=On \
-          -DFLB_SHARED_LIB=Off \
-          -DFLB_EXAMPLES=Off \
-          -DFLB_HTTP_SERVER=On \
-          -DFLB_IN_SYSTEMD=On \
-          -DFLB_OUT_KAFKA=On ..
-
-RUN make -j $(getconf _NPROCESSORS_ONLN)
-RUN install bin/fluent-bit /fluent-bit/bin/
-
-# Build lightweight debug image
-FROM public.ecr.aws/amazonlinux/amazonlinux:2
-RUN yum upgrade -y \
-    && yum install -y openssl11-devel \
-          cyrus-sasl-devel \
-          pkgconfig \
-          systemd-devel \
-          zlib-devel \
-          valgrind \
-          libyaml \
-          gdb \
-          nc && rm -fr /var/cache/yum
-
-COPY --from=builder /fluent-bit /fluent-bit
-COPY --from=aws-fluent-bit-plugins:latest /kinesis-streams/bin/kinesis.so /fluent-bit/kinesis.so
-COPY --from=aws-fluent-bit-plugins:latest /kinesis-firehose/bin/firehose.so /fluent-bit/firehose.so
-COPY --from=aws-fluent-bit-plugins:latest /cloudwatch/bin/cloudwatch.so /fluent-bit/cloudwatch.so
-RUN mkdir -p /fluent-bit/licenses/fluent-bit
-RUN mkdir -p /fluent-bit/licenses/firehose
-RUN mkdir -p /fluent-bit/licenses/cloudwatch
-RUN mkdir -p /fluent-bit/licenses/kinesis
-COPY THIRD-PARTY /fluent-bit/licenses/fluent-bit/
-COPY --from=aws-fluent-bit-plugins:latest /kinesis-firehose/THIRD-PARTY \
-    /kinesis-firehose/LICENSE \
-    /fluent-bit/licenses/firehose/
-COPY --from=aws-fluent-bit-plugins:latest /cloudwatch/THIRD-PARTY \
-    /cloudwatch/LICENSE \
-    /fluent-bit/licenses/cloudwatch/
-COPY --from=aws-fluent-bit-plugins:latest /kinesis-streams/THIRD-PARTY \
-    /kinesis-streams/LICENSE \
-    /fluent-bit/licenses/kinesis/
-COPY AWS_FOR_FLUENT_BIT_VERSION /AWS_FOR_FLUENT_BIT_VERSION
-ADD ecs /ecs/
-
-# Optional Metrics endpoint
-EXPOSE 2020
-
-# Make a directory for our cores and apply loose permissions
-RUN mkdir /cores && chmod 777 /cores
-
-# Setting core pattern in /proc/sys/kernel/core_pattern requires privileged mode
-# And can only be done at container runtime
-# Default kernel core pattern for amazonlinux should be: '/cores/core_%e.%p'
-# However, we have seen that sometimes for unknown reasons cores are just dumped
-# to the current working directory. 
-# S0 change working directory to the cores folder to run fluent bit from there.
-WORKDIR /cores
-
-# Entry point
-CMD /entrypoint.sh
diff --git a/scripts/dockerfiles/Dockerfile.main-debug-valgrind b/scripts/dockerfiles/Dockerfile.main-debug-valgrind
deleted file mode 100644
index 35f6bec..0000000
--- a/scripts/dockerfiles/Dockerfile.main-debug-valgrind
+++ /dev/null
@@ -1,5 +0,0 @@
-FROM amazon/aws-for-fluent-bit:main-debug-base
-COPY ./scripts/dockerfiles/Dockerfile.main-debug-base /Dockerfile.2.main-debug-base
-
-# Run under valgrind
-CMD valgrind --leak-check=full --error-limit=no /fluent-bit/bin/fluent-bit -c /fluent-bit/etc/fluent-bit.conf
diff --git a/scripts/dockerfiles/Dockerfile.main-release b/scripts/dockerfiles/Dockerfile.main-release
deleted file mode 100644
index 3afc4c0..0000000
--- a/scripts/dockerfiles/Dockerfile.main-release
+++ /dev/null
@@ -1,58 +0,0 @@
-FROM amazon/aws-for-fluent-bit:build as builder
-COPY ./scripts/dockerfiles/Dockerfile.build /Dockerfile.1.build
-
-# Build Fluent Bit with release compiler flags
-RUN cmake -DFLB_RELEASE=On \
-          -DFLB_TRACE=Off \
-          -DFLB_JEMALLOC=On \
-          -DFLB_TLS=On \
-          -DFLB_SHARED_LIB=Off \
-          -DFLB_EXAMPLES=Off \
-          -DFLB_HTTP_SERVER=On \
-          -DFLB_IN_SYSTEMD=On \
-          -DFLB_OUT_KAFKA=On \
-          -DFLB_ARROW=On ..
-
-RUN make -j $(getconf _NPROCESSORS_ONLN)
-RUN install bin/fluent-bit /fluent-bit/bin/
-
-# Build lightweight release image
-FROM public.ecr.aws/amazonlinux/amazonlinux:2
-RUN yum upgrade -y \
-    && yum install -y openssl11-devel \
-          cyrus-sasl-devel \
-          pkgconfig \
-          systemd-devel \
-          zlib-devel \
-          libyaml \
-          nc && rm -fr /var/cache/yum
-
-COPY --from=builder /fluent-bit /fluent-bit
-COPY --from=aws-fluent-bit-plugins:latest /kinesis-streams/bin/kinesis.so /fluent-bit/kinesis.so
-COPY --from=aws-fluent-bit-plugins:latest /kinesis-firehose/bin/firehose.so /fluent-bit/firehose.so
-COPY --from=aws-fluent-bit-plugins:latest /cloudwatch/bin/cloudwatch.so /fluent-bit/cloudwatch.so
-RUN mkdir -p /fluent-bit/licenses/fluent-bit
-RUN mkdir -p /fluent-bit/licenses/firehose
-RUN mkdir -p /fluent-bit/licenses/cloudwatch
-RUN mkdir -p /fluent-bit/licenses/kinesis
-COPY THIRD-PARTY /fluent-bit/licenses/fluent-bit/
-COPY --from=aws-fluent-bit-plugins:latest /kinesis-firehose/THIRD-PARTY \
-    /kinesis-firehose/LICENSE \
-    /fluent-bit/licenses/firehose/
-COPY --from=aws-fluent-bit-plugins:latest /cloudwatch/THIRD-PARTY \
-    /cloudwatch/LICENSE \
-    /fluent-bit/licenses/cloudwatch/
-COPY --from=aws-fluent-bit-plugins:latest /kinesis-streams/THIRD-PARTY \
-    /kinesis-streams/LICENSE \
-    /fluent-bit/licenses/kinesis/
-COPY AWS_FOR_FLUENT_BIT_VERSION /AWS_FOR_FLUENT_BIT_VERSION
-ADD ecs /ecs/
-
-COPY entrypoint.sh /entrypoint.sh
-RUN chmod +x /entrypoint.sh
-
-# Optional Metrics endpoint
-EXPOSE 2020
-
-# Entry point
-CMD /entrypoint.sh
diff --git a/scripts/dockerfiles/build/Dockerfile.build-common b/scripts/dockerfiles/build/Dockerfile.build-common
new file mode 100644
index 0000000..7f80444
--- /dev/null
+++ b/scripts/dockerfiles/build/Dockerfile.build-common
@@ -0,0 +1,44 @@
+# Amazon Linux Tag to use for images
+ARG AL_TAG=2
+
+FROM amazon/aws-for-fluent-bit:build-deps-al${AL_TAG}
+# branch to pull parsers from in github.com/fluent/fluent-bit-docker-image
+ENV FLB_DOCKER_BRANCH 1.8
+
+# Create required directories
+RUN mkdir -p /fluent-bit/bin /fluent-bit/etc /fluent-bit/log
+
+ENV HOME /home
+
+# Configuration files
+COPY fluent-bit.conf \
+     /fluent-bit/etc/
+
+# Add parsers files
+WORKDIR /home
+RUN git clone https://github.com/fluent/fluent-bit-docker-image.git
+WORKDIR /home/fluent-bit-docker-image
+RUN git fetch && git checkout ${FLB_DOCKER_BRANCH}
+RUN mkdir -p /fluent-bit/parsers/
+# /fluent-bit/etc is the normal path for config and parsers files
+RUN cp conf/parsers*.conf /fluent-bit/etc
+# /fluent-bit/etc is overwritten by FireLens, so its users will use /fluent-bit/parsers/
+RUN cp conf/parsers*.conf /fluent-bit/parsers/
+
+# Add configuration files
+ADD configs/parse-json.conf /fluent-bit/configs/
+ADD configs/minimize-log-loss.conf /fluent-bit/configs/
+ADD configs/output-metrics-healthcheck.conf /fluent-bit/configs/
+ADD configs/plugin-metrics-to-cloudwatch.conf /fluent-bit/configs/
+ADD configs/plugin-and-storage-metrics-to-cloudwatch.conf /fluent-bit/configs/
+ADD configs/plugin-metrics-parser.conf /fluent-bit/configs/
+
+# Get Fluent Bit source code
+ARG FLB_VERSION=1.9.10
+# Fluent Bit repository to checkout
+ARG FLB_REPOSITORY=https://github.com/amazon-contributing/upstream-to-fluent-bit.git
+RUN git clone --single-branch --branch ${FLB_VERSION} ${FLB_REPOSITORY} /tmp/fluent-bit/
+WORKDIR /tmp/fluent-bit/build/
+
+RUN git config --global user.email "aws-firelens@amazon.com" \
+  && git config --global user.name "FireLens Team"
diff --git a/scripts/dockerfiles/build/Dockerfile.compile b/scripts/dockerfiles/build/Dockerfile.compile
new file mode 100644
index 0000000..65fc36b
--- /dev/null
+++ b/scripts/dockerfiles/build/Dockerfile.compile
@@ -0,0 +1,45 @@
+ARG BUILD_IMAGE
+FROM ${BUILD_IMAGE}
+
+# Ensure we're in the build directory
+WORKDIR /tmp/fluent-bit/build/
+
+# Release enabled by default
+ARG RELEASE=On
+# Debug disabled by default
+ARG DEBUG=Off
+
+# Install valgrind-devel if DEBUG is enabled
+RUN if [ "$DEBUG" = "On" ]; then \
+      yum install -y valgrind-devel; \
+    fi
+
+# Build Fluent Bit with appropriate compiler flags based on DEBUG and RELEASE arguments
+RUN cmake \
+    # always on
+    -DFLB_SIMD=On \
+    -DFLB_JEMALLOC=On \
+    -DFLB_TLS=On \
+    -DFLB_HTTP_SERVER=On \
+    -DFLB_IN_SYSTEMD=On \
+    -DFLB_OUT_KAFKA=On \
+    -DFLB_ARROW=On \
+    # always off
+    -DFLB_SHARED_LIB=Off \
+    -DFLB_EXAMPLES=Off \
+    # release only
+    -DFLB_RELEASE=${RELEASE} \
+    # debug only
+    -DFLB_DEBUG=${DEBUG} \
+    -DFLB_DEV=${DEBUG} \
+    -DFLB_VALGRIND=${DEBUG} \
+    -DFLB_TRACE=${DEBUG} \
+    -DFLB_MTRACE=${DEBUG} \
+    -DFLB_BACKTRACE=${DEBUG} \
+    ..
+
+# Compile using all available processors for faster builds
+RUN make -j $(getconf _NPROCESSORS_ONLN)
+
+# Install the compiled binary to the expected location
+RUN install bin/fluent-bit /fluent-bit/bin/
diff --git a/scripts/dockerfiles/build/Dockerfile.compile-init b/scripts/dockerfiles/build/Dockerfile.compile-init
new file mode 100644
index 0000000..52d4ca7
--- /dev/null
+++ b/scripts/dockerfiles/build/Dockerfile.compile-init
@@ -0,0 +1,14 @@
+FROM amazon/aws-for-fluent-bit:golang
+
+ENV GO111MODULE on
+	 
+# Build init process for Fluent Bit
+COPY /init/ /init/
+COPY /go.mod /init/
+COPY /go.sum /init/
+
+WORKDIR /init
+
+RUN go mod tidy || ( go env -w GOPROXY=direct && go mod tidy )
+RUN go build fluent_bit_init_process.go \
+    || ( go env -w GOPROXY=direct && go build fluent_bit_init_process.go )
diff --git a/scripts/dockerfiles/Dockerfile.plugins b/scripts/dockerfiles/build/Dockerfile.compile-plugins
similarity index 72%
rename from scripts/dockerfiles/Dockerfile.plugins
rename to scripts/dockerfiles/build/Dockerfile.compile-plugins
index 77951b3..cc9db36 100644
--- a/scripts/dockerfiles/Dockerfile.plugins
+++ b/scripts/dockerfiles/build/Dockerfile.compile-plugins
@@ -1,17 +1,4 @@
-FROM public.ecr.aws/amazonlinux/amazonlinux:2
-RUN curl -sL -o /bin/gimme https://raw.githubusercontent.com/travis-ci/gimme/master/gimme
-RUN chmod +x /bin/gimme
-RUN yum upgrade -y && yum install -y tar gzip git make gcc
-ENV HOME /home
-ARG GO_STABLE_VERSION
-env GO_STABLE_VERSION=$GO_STABLE_VERSION
-
-# Lock Go Lang version to stable
-RUN gimme ${GO_STABLE_VERSION}; \
-      ln -s /home/.gimme/versions/go${GO_STABLE_VERSION}.linux.arm64 /home/.gimme/versions/gostable.linux.arm64; \
-      ln -s /home/.gimme/versions/go${GO_STABLE_VERSION}.linux.amd64 /home/.gimme/versions/gostable.linux.amd64
-ENV PATH ${PATH}:/home/.gimme/versions/gostable.linux.arm64/bin:/home/.gimme/versions/gostable.linux.amd64/bin
-RUN go version
+FROM amazon/aws-for-fluent-bit:golang
 
 ENV GO111MODULE on
 
@@ -28,7 +15,6 @@ ARG CLOUDWATCH_PLUGIN_TAG=""
 ARG CLOUDWATCH_PLUGIN_BRANCH=""
 
 # Kinesis Streams
-
 RUN git clone $KINESIS_PLUGIN_CLONE_URL /kinesis-streams
 WORKDIR /kinesis-streams
 RUN if [ -n "$KINESIS_PLUGIN_BRANCH" ];then git fetch --all && git checkout $KINESIS_PLUGIN_BRANCH && git remote -v;fi
@@ -37,7 +23,6 @@ RUN go mod download || ( go env -w GOPROXY=direct && go mod download )
 RUN make release
 
 # Firehose
-
 RUN git clone $FIREHOSE_PLUGIN_CLONE_URL /kinesis-firehose
 WORKDIR /kinesis-firehose
 RUN if [ -n "$FIREHOSE_PLUGIN_BRANCH" ];then git fetch --all && git checkout $FIREHOSE_PLUGIN_BRANCH && git remote -v;fi
@@ -46,10 +31,9 @@ RUN go mod download || ( go env -w GOPROXY=direct && go mod download )
 RUN make release
 
 # CloudWatch
-
 RUN git clone $CLOUDWATCH_PLUGIN_CLONE_URL /cloudwatch
 WORKDIR /cloudwatch
 RUN if [ -n "$CLOUDWATCH_PLUGIN_BRANCH" ];then git fetch --all && git checkout $CLOUDWATCH_PLUGIN_BRANCH && git remote -v;fi
 RUN if [ -z "$CLOUDWATCH_PLUGIN_BRANCH" ];then git fetch --all --tags && git checkout tags/$CLOUDWATCH_PLUGIN_TAG -b $CLOUDWATCH_PLUGIN_TAG && git describe --tags;fi
 RUN go mod download || ( go env -w GOPROXY=direct && go mod download )
-RUN make release
\ No newline at end of file
+RUN make release
diff --git a/scripts/dockerfiles/build/Dockerfile.deps-al2 b/scripts/dockerfiles/build/Dockerfile.deps-al2
new file mode 100644
index 0000000..d541c5a
--- /dev/null
+++ b/scripts/dockerfiles/build/Dockerfile.deps-al2
@@ -0,0 +1,33 @@
+FROM public.ecr.aws/amazonlinux/amazonlinux:2
+
+RUN yum upgrade -y && \
+    # add minor delay to avoid flakiness with epel install
+    sleep 10 && \
+    # --skip-broken added to avoid conflicts with existing package installs
+    amazon-linux-extras install -y epel && yum install -y libASL --skip-broken && \
+    yum install -y  \
+      glibc-devel \
+      libyaml-devel \
+      cmake3 \
+      gcc \
+      gcc-c++ \
+      make \
+      wget \
+      unzip \
+      tar \
+      git \
+      openssl11-devel \
+      cyrus-sasl-devel \
+      pkgconfig \
+      systemd-devel \
+      zlib-devel \
+      ca-certificates \
+      flex \
+      bison \
+    && yum clean all \
+    && rm -rf /var/cache/yum \
+    && alternatives --install /usr/local/bin/cmake cmake /usr/bin/cmake3 20 \
+      --slave /usr/local/bin/ctest ctest /usr/bin/ctest3 \
+      --slave /usr/local/bin/cpack cpack /usr/bin/cpack3 \
+      --slave /usr/local/bin/ccmake ccmake /usr/bin/ccmake3 \
+      --family cmake
diff --git a/scripts/dockerfiles/build/Dockerfile.deps-al2023 b/scripts/dockerfiles/build/Dockerfile.deps-al2023
new file mode 100644
index 0000000..6c4c41a
--- /dev/null
+++ b/scripts/dockerfiles/build/Dockerfile.deps-al2023
@@ -0,0 +1,26 @@
+FROM public.ecr.aws/amazonlinux/amazonlinux:2023
+
+RUN dnf upgrade -y && \
+    dnf install -y https://packages.apache.org/artifactory/arrow/amazon-linux/$(cut -d: -f6 /etc/system-release-cpe)/apache-arrow-release-latest.rpm && \
+    dnf install -y  \
+      glibc-devel \
+      libyaml-devel \
+      cmake \
+      gcc \
+      gcc-c++ \
+      make \
+      wget \
+      unzip \
+      tar \
+      git \
+      openssl-devel \
+      cyrus-sasl-devel \
+      pkgconf-pkg-config \
+      systemd-devel \
+      zlib-devel \
+      ca-certificates \
+      flex \
+      bison \
+      arrow-glib-devel \
+      parquet-glib-devel \
+    && dnf clean all
diff --git a/scripts/dockerfiles/Dockerfile.build-init b/scripts/dockerfiles/build/Dockerfile.golang
similarity index 64%
rename from scripts/dockerfiles/Dockerfile.build-init
rename to scripts/dockerfiles/build/Dockerfile.golang
index 4588e90..53af2b1 100644
--- a/scripts/dockerfiles/Dockerfile.build-init
+++ b/scripts/dockerfiles/build/Dockerfile.golang
@@ -1,8 +1,20 @@
-FROM public.ecr.aws/amazonlinux/amazonlinux:2 as init-builder
+FROM public.ecr.aws/amazonlinux/amazonlinux:2
 
+# --skip-broken added to avoid conflicts with existing package installs
+RUN yum install -y --skip-broken \
+        curl \
+        tar \
+        gzip \
+        git \
+        make \
+        gcc-c++ \
+    && yum clean all \
+    && rm -rf /var/cache/yum
+
+# Install gimme for Go version management
 RUN curl -sL -o /bin/gimme https://raw.githubusercontent.com/travis-ci/gimme/master/gimme
 RUN chmod +x /bin/gimme
-RUN yum upgrade -y && yum install -y tar gzip git
+
 ENV HOME /home
 
 # Lock Go Lang version to stable
@@ -14,13 +26,3 @@ RUN export GO_STABLE_OUTPUT=`curl --silent https://go.dev/VERSION?m=text | cut -
       ln -s /home/.gimme/versions/go${GO_STABLE_VERSION}.linux.amd64 /home/.gimme/versions/gostable.linux.amd64
 ENV PATH ${PATH}:/home/.gimme/versions/gostable.linux.arm64/bin:/home/.gimme/versions/gostable.linux.amd64/bin
 RUN go version
-
-ENV GO111MODULE on
-
-# Build init process for Fluent Bit
-COPY /init/fluent_bit_init_process.go /
-COPY /go.mod /
-COPY /go.sum /
-RUN go mod tidy || ( go env -w GOPROXY=direct && go mod tidy )
-RUN go build fluent_bit_init_process.go \
-    || ( go env -w GOPROXY=direct && go build fluent_bit_init_process.go )
diff --git a/scripts/dockerfiles/runtime/Dockerfile b/scripts/dockerfiles/runtime/Dockerfile
new file mode 100644
index 0000000..856659d
--- /dev/null
+++ b/scripts/dockerfiles/runtime/Dockerfile
@@ -0,0 +1,74 @@
+ARG COMPILE_IMAGE
+ARG RUNTIME_IMAGE
+
+# Source compiled Fluent Bit binary and configuration
+FROM ${COMPILE_IMAGE} as fluent-bit
+# Source AWS plugins
+FROM aws-fluent-bit-plugins:latest as plugins
+# Final runtime assembly stage
+FROM ${RUNTIME_IMAGE}
+
+# Copy Fluent Bit binary and configuration from compile stage
+COPY --from=fluent-bit /fluent-bit /fluent-bit
+
+# Copy AWS plugins from plugin build stage
+COPY --from=plugins /kinesis-streams/bin/kinesis.so /fluent-bit/kinesis.so
+COPY --from=plugins /kinesis-firehose/bin/firehose.so /fluent-bit/firehose.so
+COPY --from=plugins /cloudwatch/bin/cloudwatch.so /fluent-bit/cloudwatch.so
+
+# Create license directories
+RUN mkdir -p /fluent-bit/licenses/fluent-bit \
+    && mkdir -p /fluent-bit/licenses/firehose \
+    && mkdir -p /fluent-bit/licenses/cloudwatch \
+    && mkdir -p /fluent-bit/licenses/kinesis
+
+# Copy license files for Fluent Bit
+COPY THIRD-PARTY /fluent-bit/licenses/fluent-bit/
+
+# Copy license files for AWS plugins
+COPY --from=plugins /kinesis-firehose/THIRD-PARTY \
+    /kinesis-firehose/LICENSE \
+    /fluent-bit/licenses/firehose/
+
+COPY --from=plugins /cloudwatch/THIRD-PARTY \
+    /cloudwatch/LICENSE \
+    /fluent-bit/licenses/cloudwatch/
+
+COPY --from=plugins /kinesis-streams/THIRD-PARTY \
+    /kinesis-streams/LICENSE \
+    /fluent-bit/licenses/kinesis/
+
+# Copy version information
+COPY AWS_FOR_FLUENT_BIT_VERSION /AWS_FOR_FLUENT_BIT_VERSION
+
+# Copy ECS configuration directory
+ADD ecs /ecs/
+
+# Copy and set up entrypoint script
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+ARG FLB_VERSION
+ARG AWS_FOR_FLUENT_BIT_VERSION
+ARG OS_PRETTY_NAME
+
+LABEL author="FireLens Team <aws-firelens@amazon.com>" \
+      vendor="Amazon Web Services" \
+      version=${AWS_FOR_FLUENT_BIT_VERSION} \
+      com.aws-for-fluent-bit.fluent-bit.version=${FLB_VERSION} \
+      com.aws-for-fluent-bit.os.version=${OS_PRETTY_NAME} \
+      org.opencontainers.image.title="AWS for Fluent Bit" \
+      org.opencontainers.image.authors="FireLens Team <aws-firelens@amazon.com>" \
+      org.opencontainers.image.description="AWS for Fluent Bit is the official AWS distribution of Fluent Bit. It is fully compatible with upstream Fluent Bit and is designed to be used on AWS environments like Amazon ECS and Amazon EKS." \
+      org.opencontainers.image.version=${AWS_FOR_FLUENT_BIT_VERSION} \
+      org.opencontainers.image.url="https://gallery.ecr.aws/aws-observability/aws-for-fluent-bit" \
+      org.opencontainers.image.documentation="https://github.com/aws/aws-for-fluent-bit" \
+      org.opencontainers.image.vendor="Amazon Web Services" \
+      org.opencontainers.image.licenses="Apache-2.0" \
+      org.opencontainers.image.source="https://github.com/aws/aws-for-fluent-bit"
+
+# Optional Metrics endpoint
+EXPOSE 2020
+
+# Entry point
+CMD ["/entrypoint.sh"]
diff --git a/scripts/dockerfiles/Dockerfile.main-debug-s3 b/scripts/dockerfiles/runtime/Dockerfile.debug
similarity index 52%
rename from scripts/dockerfiles/Dockerfile.main-debug-s3
rename to scripts/dockerfiles/runtime/Dockerfile.debug
index bc01977..7eaa8b4 100644
--- a/scripts/dockerfiles/Dockerfile.main-debug-s3
+++ b/scripts/dockerfiles/runtime/Dockerfile.debug
@@ -1,32 +1,5 @@
-FROM amazon/aws-for-fluent-bit:main-debug-base
-COPY ./scripts/dockerfiles/Dockerfile.main-debug-base /Dockerfile.2.main-debug-base
-
-ENV S3_BUCKET ""
-ENV S3_KEY_PREFIX issue
-
-RUN yum install -y unzip zip curl gdb
-
-WORKDIR /var/tmp
-RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-$(arch).zip" -o "awscliv2.zip"
-RUN unzip awscliv2.zip
-RUN ./aws/install
-RUN rm awscliv2.zip
-
-RUN yum remove unzip -y \
-    && yum clean all \
-    && rm -rf /var/cache/yum
-
-# For build efficiency, copy in the Fluent Bit config file again at this stage
-COPY fluent-bit.conf \
-     /fluent-bit/etc/
-
-COPY ./scripts/core_uploader.sh /
-RUN chmod +x /core_uploader.sh
-
-# Run Fluent Bit from the cores-out folder and collect crash symbols
-# Move symbols to /cores folder after processing
-RUN mkdir /cores-out
-WORKDIR /cores-out
+ARG RUNTIME_IMAGE
+FROM ${RUNTIME_IMAGE}
 
 # Only last CMD command will be executed, automatically replaces the original entrypoint
 CMD echo "AWS for Fluent Bit Container Image Version `cat /AWS_FOR_FLUENT_BIT_VERSION` - Debug Image with S3 Core Uploader"; \
diff --git a/scripts/dockerfiles/runtime/Dockerfile.debug-common b/scripts/dockerfiles/runtime/Dockerfile.debug-common
new file mode 100644
index 0000000..8d91145
--- /dev/null
+++ b/scripts/dockerfiles/runtime/Dockerfile.debug-common
@@ -0,0 +1,25 @@
+ARG RUNTIME_IMAGE
+FROM ${RUNTIME_IMAGE}
+
+ENV S3_BUCKET ""
+ENV S3_KEY_PREFIX issue
+
+# --skip-broken added to avoid conflicts with existing package installs
+RUN yum install -y unzip zip curl gdb --skip-broken
+# Cleanup package cache
+RUN yum clean all \
+    && rm -rf /var/cache/yum
+
+WORKDIR /var/tmp
+RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-$(arch).zip" -o "awscliv2.zip"
+RUN unzip -o awscliv2.zip
+RUN ./aws/install
+RUN rm awscliv2.zip
+
+COPY ./scripts/core_uploader.sh /core_uploader.sh
+RUN chmod +x /core_uploader.sh
+
+# Run Fluent Bit from the cores-out folder and collect crash symbols
+# Move symbols to /cores folder after processing
+RUN mkdir /cores-out
+WORKDIR /cores-out
diff --git a/scripts/dockerfiles/Dockerfile.main-debug-fs b/scripts/dockerfiles/runtime/Dockerfile.debug-efs
similarity index 62%
rename from scripts/dockerfiles/Dockerfile.main-debug-fs
rename to scripts/dockerfiles/runtime/Dockerfile.debug-efs
index 538a2c2..3b20244 100644
--- a/scripts/dockerfiles/Dockerfile.main-debug-fs
+++ b/scripts/dockerfiles/runtime/Dockerfile.debug-efs
@@ -1,4 +1,4 @@
-FROM amazon/aws-for-fluent-bit:main-debug-base
-COPY ./scripts/dockerfiles/Dockerfile.main-debug-base /Dockerfile.2.main-debug-base
+ARG RUNTIME_IMAGE
+FROM ${RUNTIME_IMAGE}
 
 CMD /fluent-bit/bin/fluent-bit -e /fluent-bit/firehose.so -e /fluent-bit/cloudwatch.so -e /fluent-bit/kinesis.so -c /fluent-bit/etc/fluent-bit.conf; echo "Waiting 2 minutes for EFS core file transfers"; sleep 120
diff --git a/scripts/dockerfiles/runtime/Dockerfile.debug-valgrind b/scripts/dockerfiles/runtime/Dockerfile.debug-valgrind
new file mode 100644
index 0000000..253539c
--- /dev/null
+++ b/scripts/dockerfiles/runtime/Dockerfile.debug-valgrind
@@ -0,0 +1,5 @@
+ARG RUNTIME_IMAGE
+FROM ${RUNTIME_IMAGE}
+
+# Run under valgrind
+CMD valgrind --leak-check=full --error-limit=no /fluent-bit/bin/fluent-bit -e /fluent-bit/firehose.so -e /fluent-bit/cloudwatch.so -e /fluent-bit/kinesis.so -c /fluent-bit/etc/fluent-bit.conf
diff --git a/scripts/dockerfiles/runtime/Dockerfile.deps-al2 b/scripts/dockerfiles/runtime/Dockerfile.deps-al2
new file mode 100644
index 0000000..d11d7b3
--- /dev/null
+++ b/scripts/dockerfiles/runtime/Dockerfile.deps-al2
@@ -0,0 +1,14 @@
+FROM public.ecr.aws/amazonlinux/amazonlinux:2
+
+# Install runtime dependencies required for Fluent Bit and AWS plugins
+RUN yum upgrade -y \
+    && yum install -y \
+        openssl11-devel \
+        cyrus-sasl-devel \
+        pkgconfig \
+        systemd-devel \
+        zlib-devel \
+        libyaml \
+        nc \
+    && yum clean all \
+    && rm -rf /var/cache/yum
diff --git a/scripts/dockerfiles/runtime/Dockerfile.deps-al2023 b/scripts/dockerfiles/runtime/Dockerfile.deps-al2023
new file mode 100644
index 0000000..542c078
--- /dev/null
+++ b/scripts/dockerfiles/runtime/Dockerfile.deps-al2023
@@ -0,0 +1,23 @@
+FROM public.ecr.aws/amazonlinux/amazonlinux:2023 as dependencies
+
+# Create sysroot directory and install minimal runtime dependencies
+RUN mkdir /sysroot && \
+    dnf install -y https://packages.apache.org/artifactory/arrow/amazon-linux/$(cut -d: -f6 /etc/system-release-cpe)/apache-arrow-release-latest.rpm && \
+    dnf --releasever=$(rpm -q system-release --qf '%{VERSION}') \
+    --installroot /sysroot \
+    -y \
+    --setopt=install_weak_deps=False \
+    install \
+        libyaml \
+        systemd-libs \
+        openssl-libs \
+        cyrus-sasl-lib \
+        arrow2100-glib-libs \
+        parquet2100-glib-libs \
+        libstdc++
+
+# Final minimal runtime image using scratch base
+FROM scratch
+
+# Copy the complete sysroot with all runtime dependencies
+COPY --from=dependencies /sysroot /
diff --git a/scripts/dockerfiles/runtime/Dockerfile.deps-debug-al2 b/scripts/dockerfiles/runtime/Dockerfile.deps-debug-al2
new file mode 100644
index 0000000..ec0133d
--- /dev/null
+++ b/scripts/dockerfiles/runtime/Dockerfile.deps-debug-al2
@@ -0,0 +1,15 @@
+FROM public.ecr.aws/amazonlinux/amazonlinux:2
+
+# Install runtime dependencies required for Fluent Bit and AWS plugins
+RUN yum upgrade -y \
+    && yum install -y openssl11-devel \
+        cyrus-sasl-devel \
+        pkgconfig \
+        systemd-devel \
+        zlib-devel \
+        valgrind \
+        libyaml \
+        gdb \
+        nc \
+    && yum clean all \
+    && rm -rf /var/cache/yum
diff --git a/scripts/dockerfiles/runtime/Dockerfile.deps-debug-al2023 b/scripts/dockerfiles/runtime/Dockerfile.deps-debug-al2023
new file mode 100644
index 0000000..7efba04
--- /dev/null
+++ b/scripts/dockerfiles/runtime/Dockerfile.deps-debug-al2023
@@ -0,0 +1,17 @@
+FROM public.ecr.aws/amazonlinux/amazonlinux:2023
+
+# Install runtime dependencies required for Fluent Bit and AWS plugins
+RUN dnf upgrade -y && \
+    dnf install -y https://packages.apache.org/artifactory/arrow/amazon-linux/$(cut -d: -f6 /etc/system-release-cpe)/apache-arrow-release-latest.rpm && \
+    dnf install -y openssl-devel \
+        cyrus-sasl-devel \
+        pkgconfig \
+        systemd-devel \
+        zlib-devel \
+        valgrind \
+        libyaml \
+        gdb \
+        nc \
+        arrow-glib-devel \
+        parquet-glib-devel \
+    && dnf clean all
diff --git a/scripts/dockerfiles/Dockerfile.init-release b/scripts/dockerfiles/runtime/Dockerfile.init
similarity index 51%
rename from scripts/dockerfiles/Dockerfile.init-release
rename to scripts/dockerfiles/runtime/Dockerfile.init
index 95c1c15..c95bede 100644
--- a/scripts/dockerfiles/Dockerfile.init-release
+++ b/scripts/dockerfiles/runtime/Dockerfile.init
@@ -1,11 +1,12 @@
-FROM amazon/aws-for-fluent-bit:build-init as init-builder
-FROM amazon/aws-for-fluent-bit:main-release
-COPY ./scripts/dockerfiles/Dockerfile.main-release /Dockerfile.1.main-release
+ARG COMPILE_IMAGE
+ARG RUNTIME_IMAGE
 
-RUN mkdir -p /init
+FROM ${COMPILE_IMAGE} as init
+FROM ${RUNTIME_IMAGE}
 
-COPY --from=init-builder /fluent_bit_init_process /init/fluent_bit_init_process
+RUN mkdir -p /init
 
+COPY --from=init /init/fluent_bit_init_process /init/fluent_bit_init_process
 COPY init/fluent_bit_init_entrypoint.sh /init/fluent_bit_init_entrypoint.sh
 RUN chmod +x /init/fluent_bit_init_entrypoint.sh
 
diff --git a/scripts/dockerfiles/runtime/Dockerfile.init-debug b/scripts/dockerfiles/runtime/Dockerfile.init-debug
new file mode 100644
index 0000000..f82768c
--- /dev/null
+++ b/scripts/dockerfiles/runtime/Dockerfile.init-debug
@@ -0,0 +1,26 @@
+ARG RUNTIME_IMAGE
+FROM ${RUNTIME_IMAGE}
+
+# Only last CMD command will be executed, automatically replaces the original entrypoint
+CMD echo "AWS for Fluent Bit Container Image Version `cat /AWS_FOR_FLUENT_BIT_VERSION` - Init Debug Image with S3 Core Uploader"; \
+    if [ "$S3_BUCKET" == "" ]; then \
+        echo "Note: Please set S3_BUCKET environment variable to your crash symbol upload destination S3 bucket"; \
+    fi; \
+    if [ "$S3_KEY_PREFIX" == "issue" ]; then \
+        echo "Note: Please set S3_KEY_PREFIX environment variable to a useful identifier - e.g. company name, team name, customer name"; \
+    fi; \
+    export RUN_ID=$(($RANDOM%99999))$(($RANDOM%99999))$(($RANDOM%99999)); \
+    echo "RUN_ID is set to $RUN_ID"; \
+    /init/fluent_bit_init_process; \
+    # Source the invoke script from the appropriate location
+    if [ -f /init/invoke_fluent_bit.sh ]; then \
+        chmod +x /init/invoke_fluent_bit.sh; \
+        env RUN_ID=$RUN_ID /init/invoke_fluent_bit.sh; \
+    elif [ -f /tmp/init/invoke_fluent_bit.sh ]; then \
+        chmod +x /tmp/init/invoke_fluent_bit.sh; \
+        env RUN_ID=$RUN_ID /tmp/init/invoke_fluent_bit.sh; \
+    else \
+        echo "Error: invoke_fluent_bit.sh not found in /init or /tmp/init"; \
+        exit 1; \
+    fi; \
+    /core_uploader.sh $S3_BUCKET $S3_KEY_PREFIX $RUN_ID
diff --git a/scripts/dockerfiles/runtime/Dockerfile.init-debug-efs b/scripts/dockerfiles/runtime/Dockerfile.init-debug-efs
new file mode 100644
index 0000000..25ef3c7
--- /dev/null
+++ b/scripts/dockerfiles/runtime/Dockerfile.init-debug-efs
@@ -0,0 +1,17 @@
+ARG RUNTIME_IMAGE
+FROM ${RUNTIME_IMAGE}
+
+# Only last CMD command will be executed, automatically replaces the original entrypoint
+CMD /init/fluent_bit_init_process; \
+    # Source the invoke script from the appropriate location
+    if [ -f /init/invoke_fluent_bit.sh ]; then \
+        chmod +x /init/invoke_fluent_bit.sh; \
+        cd /cores; /init/invoke_fluent_bit.sh; \
+    elif [ -f /tmp/init/invoke_fluent_bit.sh ]; then \
+        chmod +x /tmp/init/invoke_fluent_bit.sh; \
+        cd /cores; /tmp/init/invoke_fluent_bit.sh; \
+    else \
+        echo "Error: invoke_fluent_bit.sh not found in /init or /tmp/init"; \
+        exit 1; \
+    fi; \
+    echo "Waiting 2 minutes for EFS core file transfers"; sleep 120
diff --git a/scripts/publish.sh b/scripts/publish.sh
index d625b97..b55e0e3 100755
--- a/scripts/publish.sh
+++ b/scripts/publish.sh
@@ -664,6 +664,7 @@ verify_dockerhub() {
 }
 
 verify_public_ecr() {
+	sleep 60
 	aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/aws-observability || echo "0"
 
 	# Verify the image with stable tag
diff --git a/troubleshooting/debugging.md b/troubleshooting/debugging.md
index 7a2bc86..10cb978 100644
--- a/troubleshooting/debugging.md
+++ b/troubleshooting/debugging.md
@@ -758,7 +758,7 @@ Use the Dockerfile below to create a new container image that will invoke your F
 ```
 FROM public.ecr.aws/aws-observability/aws-for-fluent-bit:latest as builder
 
-FROM public.ecr.aws/amazonlinux/amazonlinux:2
+FROM public.ecr.aws/amazonlinux/amazonlinux:${AL_TAG}
 RUN yum upgrade -y \
     && yum install -y openssl11-devel \
           cyrus-sasl-devel \
@@ -778,7 +778,7 @@ CMD valgrind --leak-check=full --error-limit=no /fluent-bit/bin/fluent-bit -c /f
 The best option, which is most likely to catch any leak or segfault is to create a fresh build of the image using the `make debug-valgrind` target. This will create a fresh build with debug mode and valgrind support enabled, which gives the highest chance that Valgrind will be able to produce useful diagnostic information about the issue.
 
 1. Check out the git tag for the version that saw the problem
-2. Make sure the `FLB_VERSION` at the top of the `scripts/dockerfiles/Dockerfile.build` is set to the same version as the main Dockerfile for that tag.
+2. Make sure the `FLB_VERSION` at the top of the `Makefile` is set to the same version as the main Dockerfile for that tag.
 3. Build this dockerfile with the `make debug-valgrind` target. The image will be tagged with the `amazon/aws-for-fluent-bit:debug-valgrind` tag.
 
 ##### Other Options: Other Debug Builds
@@ -1233,7 +1233,7 @@ When you recieve a SIGSEGV/crash report from a customer, perform the following s
 
 #### 1. Build and distribute a core dump S3 uploader image
 
-For debug images, we update the `debug-latest` tag and add a tag as `debug-<Version>`. You can find them in [Docker Hub](https://hub.docker.com/r/amazon/aws-for-fluent-bit), [Amazon ECR Public Gallery](https://gallery.ecr.aws/aws-observability/aws-for-fluent-bit) and Amazon ECR. If you need a customized image build for the specific version/case you are testing. Make sure the `ENV FLB_VERSION` is set to the right version in the `Dockerfile.build` and make sure the `AWS_FLB_CHERRY_PICKS` file has the right contents for the release you are testing.
+For debug images, we update the `debug-latest` tag and add a tag as `debug-<Version>`. You can find them in [Docker Hub](https://hub.docker.com/r/amazon/aws-for-fluent-bit), [Amazon ECR Public Gallery](https://gallery.ecr.aws/aws-observability/aws-for-fluent-bit) and Amazon ECR. If you need a customized image build for the specific version/case you are testing. Make sure `FLB_VERSION` is set to the right version in `Makefile` and make sure the `AWS_FLB_CHERRY_PICKS` file has the right contents for the release you are testing.
 
 Then simply run:
 ```
@@ -1477,7 +1477,7 @@ Save this as `tcp-logger.sh` and run `chmod +x tcp-logger.sh`. Then, create a fi
 You can use this Dockerfile:
 
 ```
-FROM public.ecr.aws/amazonlinux/amazonlinux:2
+FROM public.ecr.aws/amazonlinux/amazonlinux:${AL_TAG}
 
 RUN yum upgrade -y
 RUN amazon-linux-extras install -y epel && yum install -y libASL --skip-broken
diff --git a/troubleshooting/tutorials/remote-core-dump/README.md b/troubleshooting/tutorials/remote-core-dump/README.md
index ba4779b..fb2169e 100644
--- a/troubleshooting/tutorials/remote-core-dump/README.md
+++ b/troubleshooting/tutorials/remote-core-dump/README.md
@@ -27,12 +27,12 @@ Clone the AWS for Fluent Bit source code, and run `make debug` for a plain debug
 When Fluent Bit crashes, a zipped core file, stacktrace, and the Fluent Bit executable will be output to the `/cores` directory and the files will also be uploaded to S3.
 
 There are couple of things to note about the debug target for the core file debugging use case:
-- The Fluent Bit upstream base version is specified with `ENV FLB_VERSION`
+- The Fluent Bit upstream base version is specified with `FLB_VERSION` in `Makefile`
 - Fluent Bit is compiled with CMake flag `-DFLB_DEBUG=On`
 - `gdb` is installed in the final stage of the Docker build.
 - `aws` cli is installed to copy files to the S3 bucket.
 
-When you clone AWS for Fluent Bit, you will automatically get the latest Dockerfile for our latest release on the mainline branch. To create a debug build of a different version, either check out the tag for that version, or modify the `ENV FLB_VERSION` at the top of the `/scripts/dockerfiles/Dockerfile.build` to install the desired Fluent Bit base version.
+When you clone AWS for Fluent Bit, you will automatically get the latest Dockerfile for our latest release on the mainline branch. To create a debug build of a different version, either check out the tag for that version, or modify the `FLB_VERSION` at the top of the `Makefile` to install the desired Fluent Bit base version.
 
 Once you are ready, build the debug image:
 



Test patch:
diff --git a/init/fluent_bit_init_process_test.go b/init/fluent_bit_init_process_test.go
index 976311d..09d36c8 100644
--- a/init/fluent_bit_init_process_test.go
+++ b/init/fluent_bit_init_process_test.go
@@ -265,7 +265,6 @@ func TestDownloadS3ConfigFile(t *testing.T) {
 	for _, test := range cases {
 		testName := fmt.Sprintf("FailFirstAttempt-%t-downloadCount-%d", test.failFirstAttempt, test.downloadCount)
 		t.Run(testName, func(t *testing.T) {
-			os.RemoveAll(s3FileDirectoryPathTest)
 			downloader := &MockS3Downloader{
 				FailFirstAttempt: test.failFirstAttempt,
 			}
@@ -278,6 +277,7 @@ func TestDownloadS3ConfigFile(t *testing.T) {
 
 			// Verify downloader was called with correct parameters
 			assert.Equal(t, test.downloadCount, downloader.DownloadCount)
+			os.RemoveAll(s3FileDirectoryPathTest)
 		})
 	}
 }
@@ -365,8 +365,13 @@ func TestCreateFile(t *testing.T) {
 		t.Run(testName, func(t *testing.T) {
 			fileName := path.Join(filePath, testName)
 			file := createFile(fileName, test.autoClose)
-
 			assert.NotNil(t, file)
+
+			// Verify directory permissions are 0700
+			dirInfo, err := os.Stat(path.Dir(fileName))
+			assert.NoError(t, err)
+			assert.Equal(t, os.FileMode(0700), dirInfo.Mode().Perm(), "Directory should have 0700 permissions")
+
 			if !test.autoClose {
 				file.Close()
 			}
@@ -507,3 +512,39 @@ func writeFileHelper(filePath, writeContent string) {
 		fmt.Printf("Cannot write %s in file %s", writeContent, filePath)
 	}
 }
+
+func TestCanWriteToDir(t *testing.T) {
+	originalOSCreate := osCreate
+	defer func() {
+		osCreate = originalOSCreate
+	}()
+
+	testCases := []struct {
+		name           string
+		mockOsCreate   func(name string) (*os.File, error)
+		expectedResult bool
+	}{
+		{
+			name: "Can write",
+			mockOsCreate: func(name string) (*os.File, error) {
+				dir := t.TempDir()
+				return os.CreateTemp(dir, "mock")
+			},
+			expectedResult: true,
+		},
+		{
+			name: "Cannot write",
+			mockOsCreate: func(name string) (*os.File, error) {
+				return nil, fmt.Errorf("Permission denied")
+			},
+			expectedResult: false,
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			osCreate = tc.mockOsCreate
+			result := canWriteToDir("/init/")
+			assert.Equal(t, tc.expectedResult, result)
+		})
+	}
+}
diff --git a/load_tests/task_definitions/cloudwatch.json b/load_tests/task_definitions/cloudwatch.json
index 970ba24..50b94a9 100644
--- a/load_tests/task_definitions/cloudwatch.json
+++ b/load_tests/task_definitions/cloudwatch.json
@@ -37,7 +37,7 @@
 				}
 			},
 			"cpu": 512,
-			"memoryReservation": 10240
+			"memoryReservation": 5000
 		},
 		{
 			"essential": true,
diff --git a/load_tests/task_definitions/firehose.json b/load_tests/task_definitions/firehose.json
index ec2a78b..666e62a 100644
--- a/load_tests/task_definitions/firehose.json
+++ b/load_tests/task_definitions/firehose.json
@@ -37,7 +37,7 @@
 				}
 			},
 			"cpu": 512,
-			"memoryReservation": 10240
+			"memoryReservation": 5000
 		},
 		{
 			"essential": true,
diff --git a/load_tests/task_definitions/kinesis.json b/load_tests/task_definitions/kinesis.json
index ad634ae..a43cada 100644
--- a/load_tests/task_definitions/kinesis.json
+++ b/load_tests/task_definitions/kinesis.json
@@ -37,7 +37,7 @@
 				}
 			},
 			"cpu": 512,
-			"memoryReservation": 10240
+			"memoryReservation": 5000
 		},
 		{
 			"essential": true,