Skip to content

Commit 16dd8db

Browse files
yosifkityosifkit
authored
Merge pull request #658 from infosiftr/more-mysql
Error when `POSTGRES_PASSWORD` is unset like mysql
2 parents 55e3dc0 + 46161d6 commit 16dd8db

13 files changed

+533
-299
lines changed

‎10/alpine/docker-entrypoint.sh

Lines changed: 41 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ docker_create_db_directories() {
4444
chmod 775 /var/run/postgresql || :
4545

4646
# Create the transaction log directory before initdb is run so the directory is owned by the correct user
47-
if [ "$POSTGRES_INITDB_WALDIR" ]; then
47+
if [ -n "$POSTGRES_INITDB_WALDIR" ]; then
4848
mkdir -p "$POSTGRES_INITDB_WALDIR"
4949
if [ "$user" = '0' ]; then
5050
find "$POSTGRES_INITDB_WALDIR" \! -user postgres -exec chown postgres '{}' +
@@ -74,7 +74,7 @@ docker_init_database_dir() {
7474
echo "postgres:x:$(id -g):" > "$NSS_WRAPPER_GROUP"
7575
fi
7676

77-
if [ "$POSTGRES_INITDB_WALDIR" ]; then
77+
if [ -n "$POSTGRES_INITDB_WALDIR" ]; then
7878
set -- --waldir "$POSTGRES_INITDB_WALDIR" "$@"
7979
fi
8080

@@ -87,7 +87,10 @@ docker_init_database_dir() {
8787
fi
8888
}
8989

90-
# print large warning if POSTGRES_PASSWORD is empty
90+
# print large warning if POSTGRES_PASSWORD is long
91+
# error if both POSTGRES_PASSWORD is unset and POSTGRES_HOST_AUTH_METHOD is not 'trust'
92+
# print large warning if POSTGRES_HOST_AUTH_METHOD is set to 'trust'
93+
# assumes database is not set up, ie: [ -z "$DATABASE_ALREADY_EXISTS" ]
9194
docker_verify_minimum_env() {
9295
# check password first so we can output the warning before postgres
9396
# messes it up
@@ -103,22 +106,36 @@ docker_verify_minimum_env() {
103106
104107
EOWARN
105108
fi
106-
if [ -z "$POSTGRES_PASSWORD" ]; then
109+
if [ -z "$POSTGRES_PASSWORD" ] && [ 'trust' != "$POSTGRES_HOST_AUTH_METHOD" ]; then
107110
# The - option suppresses leading tabs but *not* spaces. :)
111+
cat >&2 <<-'EOE'
112+
Error: Database is uninitialized and superuser password is not specified.
113+
You must specify POSTGRES_PASSWORD for the superuser. Use
114+
"-e POSTGRES_PASSWORD=password" to set it in "docker run".
115+
116+
You may also use POSTGRES_HOST_AUTH_METHOD=trust to allow all connections
117+
without a password. This is *not* recommended. See PostgreSQL
118+
documentation about "trust":
119+
https://www.postgresql.org/docs/current/auth-trust.html
120+
EOE
121+
exit 1
122+
fi
123+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
108124
cat >&2 <<-'EOWARN'
109-
****************************************************
110-
WARNING: No password has been set for the database.
111-
This will allow anyone with access to the
112-
Postgres port to access your database. In
113-
Docker's default configuration, this is
114-
effectively any other container on the same
115-
system.
116-
117-
Use "-e POSTGRES_PASSWORD=password" to set
118-
it in "docker run".
119-
****************************************************
125+
********************************************************************************
126+
WARNING: POSTGRES_HOST_AUTH_METHOD has been set to "trust". This will allow
127+
anyone with access to the Postgres port to access your database without
128+
a password, even if POSTGRES_PASSWORD is set. See PostgreSQL
129+
documentation about "trust":
130+
https://www.postgresql.org/docs/current/auth-trust.html
131+
In Docker's default configuration, this is effectively any other
132+
container on the same system.
133+
134+
It is not recommended to use POSTGRES_HOST_AUTH_METHOD=trust. Replace
135+
it with "-e POSTGRES_PASSWORD=password" instead to set a password in
136+
"docker run".
137+
********************************************************************************
120138
EOWARN
121-
122139
fi
123140
}
124141

@@ -185,6 +202,8 @@ docker_setup_env() {
185202
file_env 'POSTGRES_USER' 'postgres'
186203
file_env 'POSTGRES_DB' "$POSTGRES_USER"
187204
file_env 'POSTGRES_INITDB_ARGS'
205+
# default authentication method is md5
206+
: "${POSTGRES_HOST_AUTH_METHOD:=md5}"
188207

189208
declare -g DATABASE_ALREADY_EXISTS
190209
# look specifically for PG_VERSION, as it is expected in the DB dir
@@ -193,16 +212,15 @@ docker_setup_env() {
193212
fi
194213
}
195214

196-
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_PASSWORD
215+
# append POSTGRES_HOST_AUTH_METHOD to pg_hba.conf for "host" connections
197216
pg_setup_hba_conf() {
198-
local authMethod='md5'
199-
if [ -z "$POSTGRES_PASSWORD" ]; then
200-
authMethod='trust'
201-
fi
202-
203217
{
204218
echo
205-
echo "host all all all $authMethod"
219+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
220+
echo '# warning trust is enabled for all connections'
221+
echo '# see https://www.postgresql.org/docs/12/auth-trust.html'
222+
fi
223+
echo "host all all all $POSTGRES_HOST_AUTH_METHOD"
206224
} >> "$PGDATA/pg_hba.conf"
207225
}
208226

‎10/docker-entrypoint.sh

Lines changed: 41 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ docker_create_db_directories() {
4444
chmod 775 /var/run/postgresql || :
4545

4646
# Create the transaction log directory before initdb is run so the directory is owned by the correct user
47-
if [ "$POSTGRES_INITDB_WALDIR" ]; then
47+
if [ -n "$POSTGRES_INITDB_WALDIR" ]; then
4848
mkdir -p "$POSTGRES_INITDB_WALDIR"
4949
if [ "$user" = '0' ]; then
5050
find "$POSTGRES_INITDB_WALDIR" \! -user postgres -exec chown postgres '{}' +
@@ -74,7 +74,7 @@ docker_init_database_dir() {
7474
echo "postgres:x:$(id -g):" > "$NSS_WRAPPER_GROUP"
7575
fi
7676

77-
if [ "$POSTGRES_INITDB_WALDIR" ]; then
77+
if [ -n "$POSTGRES_INITDB_WALDIR" ]; then
7878
set -- --waldir "$POSTGRES_INITDB_WALDIR" "$@"
7979
fi
8080

@@ -87,7 +87,10 @@ docker_init_database_dir() {
8787
fi
8888
}
8989

90-
# print large warning if POSTGRES_PASSWORD is empty
90+
# print large warning if POSTGRES_PASSWORD is long
91+
# error if both POSTGRES_PASSWORD is unset and POSTGRES_HOST_AUTH_METHOD is not 'trust'
92+
# print large warning if POSTGRES_HOST_AUTH_METHOD is set to 'trust'
93+
# assumes database is not set up, ie: [ -z "$DATABASE_ALREADY_EXISTS" ]
9194
docker_verify_minimum_env() {
9295
# check password first so we can output the warning before postgres
9396
# messes it up
@@ -103,22 +106,36 @@ docker_verify_minimum_env() {
103106
104107
EOWARN
105108
fi
106-
if [ -z "$POSTGRES_PASSWORD" ]; then
109+
if [ -z "$POSTGRES_PASSWORD" ] && [ 'trust' != "$POSTGRES_HOST_AUTH_METHOD" ]; then
107110
# The - option suppresses leading tabs but *not* spaces. :)
111+
cat >&2 <<-'EOE'
112+
Error: Database is uninitialized and superuser password is not specified.
113+
You must specify POSTGRES_PASSWORD for the superuser. Use
114+
"-e POSTGRES_PASSWORD=password" to set it in "docker run".
115+
116+
You may also use POSTGRES_HOST_AUTH_METHOD=trust to allow all connections
117+
without a password. This is *not* recommended. See PostgreSQL
118+
documentation about "trust":
119+
https://www.postgresql.org/docs/current/auth-trust.html
120+
EOE
121+
exit 1
122+
fi
123+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
108124
cat >&2 <<-'EOWARN'
109-
****************************************************
110-
WARNING: No password has been set for the database.
111-
This will allow anyone with access to the
112-
Postgres port to access your database. In
113-
Docker's default configuration, this is
114-
effectively any other container on the same
115-
system.
116-
117-
Use "-e POSTGRES_PASSWORD=password" to set
118-
it in "docker run".
119-
****************************************************
125+
********************************************************************************
126+
WARNING: POSTGRES_HOST_AUTH_METHOD has been set to "trust". This will allow
127+
anyone with access to the Postgres port to access your database without
128+
a password, even if POSTGRES_PASSWORD is set. See PostgreSQL
129+
documentation about "trust":
130+
https://www.postgresql.org/docs/current/auth-trust.html
131+
In Docker's default configuration, this is effectively any other
132+
container on the same system.
133+
134+
It is not recommended to use POSTGRES_HOST_AUTH_METHOD=trust. Replace
135+
it with "-e POSTGRES_PASSWORD=password" instead to set a password in
136+
"docker run".
137+
********************************************************************************
120138
EOWARN
121-
122139
fi
123140
}
124141

@@ -185,6 +202,8 @@ docker_setup_env() {
185202
file_env 'POSTGRES_USER' 'postgres'
186203
file_env 'POSTGRES_DB' "$POSTGRES_USER"
187204
file_env 'POSTGRES_INITDB_ARGS'
205+
# default authentication method is md5
206+
: "${POSTGRES_HOST_AUTH_METHOD:=md5}"
188207

189208
declare -g DATABASE_ALREADY_EXISTS
190209
# look specifically for PG_VERSION, as it is expected in the DB dir
@@ -193,16 +212,15 @@ docker_setup_env() {
193212
fi
194213
}
195214

196-
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_PASSWORD
215+
# append POSTGRES_HOST_AUTH_METHOD to pg_hba.conf for "host" connections
197216
pg_setup_hba_conf() {
198-
local authMethod='md5'
199-
if [ -z "$POSTGRES_PASSWORD" ]; then
200-
authMethod='trust'
201-
fi
202-
203217
{
204218
echo
205-
echo "host all all all $authMethod"
219+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
220+
echo '# warning trust is enabled for all connections'
221+
echo '# see https://www.postgresql.org/docs/12/auth-trust.html'
222+
fi
223+
echo "host all all all $POSTGRES_HOST_AUTH_METHOD"
206224
} >> "$PGDATA/pg_hba.conf"
207225
}
208226

‎11/alpine/docker-entrypoint.sh

Lines changed: 41 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ docker_create_db_directories() {
4444
chmod 775 /var/run/postgresql || :
4545

4646
# Create the transaction log directory before initdb is run so the directory is owned by the correct user
47-
if [ "$POSTGRES_INITDB_WALDIR" ]; then
47+
if [ -n "$POSTGRES_INITDB_WALDIR" ]; then
4848
mkdir -p "$POSTGRES_INITDB_WALDIR"
4949
if [ "$user" = '0' ]; then
5050
find "$POSTGRES_INITDB_WALDIR" \! -user postgres -exec chown postgres '{}' +
@@ -74,7 +74,7 @@ docker_init_database_dir() {
7474
echo "postgres:x:$(id -g):" > "$NSS_WRAPPER_GROUP"
7575
fi
7676

77-
if [ "$POSTGRES_INITDB_WALDIR" ]; then
77+
if [ -n "$POSTGRES_INITDB_WALDIR" ]; then
7878
set -- --waldir "$POSTGRES_INITDB_WALDIR" "$@"
7979
fi
8080

@@ -87,7 +87,10 @@ docker_init_database_dir() {
8787
fi
8888
}
8989

90-
# print large warning if POSTGRES_PASSWORD is empty
90+
# print large warning if POSTGRES_PASSWORD is long
91+
# error if both POSTGRES_PASSWORD is unset and POSTGRES_HOST_AUTH_METHOD is not 'trust'
92+
# print large warning if POSTGRES_HOST_AUTH_METHOD is set to 'trust'
93+
# assumes database is not set up, ie: [ -z "$DATABASE_ALREADY_EXISTS" ]
9194
docker_verify_minimum_env() {
9295
# check password first so we can output the warning before postgres
9396
# messes it up
@@ -103,22 +106,36 @@ docker_verify_minimum_env() {
103106
104107
EOWARN
105108
fi
106-
if [ -z "$POSTGRES_PASSWORD" ]; then
109+
if [ -z "$POSTGRES_PASSWORD" ] && [ 'trust' != "$POSTGRES_HOST_AUTH_METHOD" ]; then
107110
# The - option suppresses leading tabs but *not* spaces. :)
111+
cat >&2 <<-'EOE'
112+
Error: Database is uninitialized and superuser password is not specified.
113+
You must specify POSTGRES_PASSWORD for the superuser. Use
114+
"-e POSTGRES_PASSWORD=password" to set it in "docker run".
115+
116+
You may also use POSTGRES_HOST_AUTH_METHOD=trust to allow all connections
117+
without a password. This is *not* recommended. See PostgreSQL
118+
documentation about "trust":
119+
https://www.postgresql.org/docs/current/auth-trust.html
120+
EOE
121+
exit 1
122+
fi
123+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
108124
cat >&2 <<-'EOWARN'
109-
****************************************************
110-
WARNING: No password has been set for the database.
111-
This will allow anyone with access to the
112-
Postgres port to access your database. In
113-
Docker's default configuration, this is
114-
effectively any other container on the same
115-
system.
116-
117-
Use "-e POSTGRES_PASSWORD=password" to set
118-
it in "docker run".
119-
****************************************************
125+
********************************************************************************
126+
WARNING: POSTGRES_HOST_AUTH_METHOD has been set to "trust". This will allow
127+
anyone with access to the Postgres port to access your database without
128+
a password, even if POSTGRES_PASSWORD is set. See PostgreSQL
129+
documentation about "trust":
130+
https://www.postgresql.org/docs/current/auth-trust.html
131+
In Docker's default configuration, this is effectively any other
132+
container on the same system.
133+
134+
It is not recommended to use POSTGRES_HOST_AUTH_METHOD=trust. Replace
135+
it with "-e POSTGRES_PASSWORD=password" instead to set a password in
136+
"docker run".
137+
********************************************************************************
120138
EOWARN
121-
122139
fi
123140
}
124141

@@ -185,6 +202,8 @@ docker_setup_env() {
185202
file_env 'POSTGRES_USER' 'postgres'
186203
file_env 'POSTGRES_DB' "$POSTGRES_USER"
187204
file_env 'POSTGRES_INITDB_ARGS'
205+
# default authentication method is md5
206+
: "${POSTGRES_HOST_AUTH_METHOD:=md5}"
188207

189208
declare -g DATABASE_ALREADY_EXISTS
190209
# look specifically for PG_VERSION, as it is expected in the DB dir
@@ -193,16 +212,15 @@ docker_setup_env() {
193212
fi
194213
}
195214

196-
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_PASSWORD
215+
# append POSTGRES_HOST_AUTH_METHOD to pg_hba.conf for "host" connections
197216
pg_setup_hba_conf() {
198-
local authMethod='md5'
199-
if [ -z "$POSTGRES_PASSWORD" ]; then
200-
authMethod='trust'
201-
fi
202-
203217
{
204218
echo
205-
echo "host all all all $authMethod"
219+
if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
220+
echo '# warning trust is enabled for all connections'
221+
echo '# see https://www.postgresql.org/docs/12/auth-trust.html'
222+
fi
223+
echo "host all all all $POSTGRES_HOST_AUTH_METHOD"
206224
} >> "$PGDATA/pg_hba.conf"
207225
}
208226

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy