Skip to content

Commit 3706d4c

Browse files
tianontianon
committed
Allow arbitrary --user values (mostly)
One special case is that `initdb` _requires_ the current user to exist in `/etc/passwd`, but running PostgreSQL itself does not require that.
1 parent 03a6cb6 commit 3706d4c

23 files changed

+177
-89
lines changed

‎9.2/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ RUN mkdir -p /var/run/postgresql && chown -R postgres:postgres /var/run/postgres
5858

5959
ENV PATH /usr/lib/postgresql/$PG_MAJOR/bin:$PATH
6060
ENV PGDATA /var/lib/postgresql/data
61-
RUN mkdir -p "$PGDATA" && chown -R postgres:postgres "$PGDATA" && chmod 700 "$PGDATA"
61+
RUN mkdir -p "$PGDATA" && chown -R postgres:postgres "$PGDATA" && chmod 777 "$PGDATA" # this 777 will be replaced by 700 at runtime (allows semi-arbitrary "--user" values)
6262
VOLUME /var/lib/postgresql/data
6363

6464
COPY docker-entrypoint.sh /

‎9.2/alpine/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ RUN mkdir -p /var/run/postgresql && chown -R postgres:postgres /var/run/postgres
122122

123123
ENV PATH /usr/lib/postgresql/$PG_MAJOR/bin:$PATH
124124
ENV PGDATA /var/lib/postgresql/data
125-
RUN mkdir -p "$PGDATA" && chown -R postgres:postgres "$PGDATA" && chmod 700 "$PGDATA"
125+
RUN mkdir -p "$PGDATA" && chown -R postgres:postgres "$PGDATA" && chmod 777 "$PGDATA" # this 777 will be replaced by 700 at runtime (allows semi-arbitrary "--user" values)
126126
VOLUME /var/lib/postgresql/data
127127

128128
COPY docker-entrypoint.sh /

‎9.2/alpine/docker-entrypoint.sh

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,8 @@ if [ "${1:0:1}" = '-' ]; then
2727
set -- postgres "$@"
2828
fi
2929

30-
if [ "$1" = 'postgres' ]; then
30+
# allow the container to be started with `--user`
31+
if [ "$1" = 'postgres' ] && [ "$(id -u)" = '0' ]; then
3132
mkdir -p "$PGDATA"
3233
chown -R postgres "$PGDATA"
3334
chmod 700 "$PGDATA"
@@ -36,11 +37,18 @@ if [ "$1" = 'postgres' ]; then
3637
chown -R postgres /var/run/postgresql
3738
chmod g+s /var/run/postgresql
3839

40+
exec su-exec postgres "$BASH_SOURCE" "$@"
41+
fi
42+
43+
if [ "$1" = 'postgres' ]; then
44+
mkdir -p "$PGDATA"
3945

4046
# look specifically for PG_VERSION, as it is expected in the DB dir
4147
if [ ! -s "$PGDATA/PG_VERSION" ]; then
48+
chown -R "$(id -u)" "$PGDATA" 2>/dev/null || :
49+
4250
file_env 'POSTGRES_INITDB_ARGS'
43-
eval "su-exec postgres initdb $POSTGRES_INITDB_ARGS"
51+
eval "initdb --username=postgres $POSTGRES_INITDB_ARGS"
4452

4553
# check password first so we can output the warning before postgres
4654
# messes it up
@@ -68,11 +76,12 @@ if [ "$1" = 'postgres' ]; then
6876
authMethod=trust
6977
fi
7078

71-
{ echo; echo "host all all all $authMethod"; } | su-exec postgres tee -a "$PGDATA/pg_hba.conf" > /dev/null
79+
{ echo; echo "host all all all $authMethod"; } | tee -a "$PGDATA/pg_hba.conf" > /dev/null
7280

7381
# internal start of server in order to allow set-up using psql-client
7482
# does not listen on external TCP/IP and waits until start finishes
75-
su-exec postgres pg_ctl -D "$PGDATA" \
83+
PGUSER="${PGUSER:-postgres}" \
84+
pg_ctl -D "$PGDATA" \
7685
-o "-c listen_addresses='localhost'" \
7786
-w start
7887

@@ -111,14 +120,13 @@ if [ "$1" = 'postgres' ]; then
111120
echo
112121
done
113122

114-
su-exec postgres pg_ctl -D "$PGDATA" -m fast -w stop
123+
PGUSER="${PGUSER:-postgres}" \
124+
pg_ctl -D "$PGDATA" -m fast -w stop
115125

116126
echo
117127
echo 'PostgreSQL init process complete; ready for start up.'
118128
echo
119129
fi
120-
121-
exec su-exec postgres "$@"
122130
fi
123131

124132
exec "$@"

‎9.2/docker-entrypoint.sh

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,8 @@ if [ "${1:0:1}" = '-' ]; then
2727
set -- postgres "$@"
2828
fi
2929

30-
if [ "$1" = 'postgres' ]; then
30+
# allow the container to be started with `--user`
31+
if [ "$1" = 'postgres' ] && [ "$(id -u)" = '0' ]; then
3132
mkdir -p "$PGDATA"
3233
chown -R postgres "$PGDATA"
3334
chmod 700 "$PGDATA"
@@ -36,11 +37,18 @@ if [ "$1" = 'postgres' ]; then
3637
chown -R postgres /var/run/postgresql
3738
chmod g+s /var/run/postgresql
3839

40+
exec gosu postgres "$BASH_SOURCE" "$@"
41+
fi
42+
43+
if [ "$1" = 'postgres' ]; then
44+
mkdir -p "$PGDATA"
3945

4046
# look specifically for PG_VERSION, as it is expected in the DB dir
4147
if [ ! -s "$PGDATA/PG_VERSION" ]; then
48+
chown -R "$(id -u)" "$PGDATA" 2>/dev/null || :
49+
4250
file_env 'POSTGRES_INITDB_ARGS'
43-
eval "gosu postgres initdb $POSTGRES_INITDB_ARGS"
51+
eval "initdb --username=postgres $POSTGRES_INITDB_ARGS"
4452

4553
# check password first so we can output the warning before postgres
4654
# messes it up
@@ -68,11 +76,12 @@ if [ "$1" = 'postgres' ]; then
6876
authMethod=trust
6977
fi
7078

71-
{ echo; echo "host all all all $authMethod"; } | gosu postgres tee -a "$PGDATA/pg_hba.conf" > /dev/null
79+
{ echo; echo "host all all all $authMethod"; } | tee -a "$PGDATA/pg_hba.conf" > /dev/null
7280

7381
# internal start of server in order to allow set-up using psql-client
7482
# does not listen on external TCP/IP and waits until start finishes
75-
gosu postgres pg_ctl -D "$PGDATA" \
83+
PGUSER="${PGUSER:-postgres}" \
84+
pg_ctl -D "$PGDATA" \
7685
-o "-c listen_addresses='localhost'" \
7786
-w start
7887

@@ -111,14 +120,13 @@ if [ "$1" = 'postgres' ]; then
111120
echo
112121
done
113122

114-
gosu postgres pg_ctl -D "$PGDATA" -m fast -w stop
123+
PGUSER="${PGUSER:-postgres}" \
124+
pg_ctl -D "$PGDATA" -m fast -w stop
115125

116126
echo
117127
echo 'PostgreSQL init process complete; ready for start up.'
118128
echo
119129
fi
120-
121-
exec gosu postgres "$@"
122130
fi
123131

124132
exec "$@"

‎9.3/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ RUN mkdir -p /var/run/postgresql && chown -R postgres:postgres /var/run/postgres
5858

5959
ENV PATH /usr/lib/postgresql/$PG_MAJOR/bin:$PATH
6060
ENV PGDATA /var/lib/postgresql/data
61-
RUN mkdir -p "$PGDATA" && chown -R postgres:postgres "$PGDATA" && chmod 700 "$PGDATA"
61+
RUN mkdir -p "$PGDATA" && chown -R postgres:postgres "$PGDATA" && chmod 777 "$PGDATA" # this 777 will be replaced by 700 at runtime (allows semi-arbitrary "--user" values)
6262
VOLUME /var/lib/postgresql/data
6363

6464
COPY docker-entrypoint.sh /

‎9.3/alpine/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ RUN mkdir -p /var/run/postgresql && chown -R postgres:postgres /var/run/postgres
122122

123123
ENV PATH /usr/lib/postgresql/$PG_MAJOR/bin:$PATH
124124
ENV PGDATA /var/lib/postgresql/data
125-
RUN mkdir -p "$PGDATA" && chown -R postgres:postgres "$PGDATA" && chmod 700 "$PGDATA"
125+
RUN mkdir -p "$PGDATA" && chown -R postgres:postgres "$PGDATA" && chmod 777 "$PGDATA" # this 777 will be replaced by 700 at runtime (allows semi-arbitrary "--user" values)
126126
VOLUME /var/lib/postgresql/data
127127

128128
COPY docker-entrypoint.sh /

‎9.3/alpine/docker-entrypoint.sh

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,8 @@ if [ "${1:0:1}" = '-' ]; then
2727
set -- postgres "$@"
2828
fi
2929

30-
if [ "$1" = 'postgres' ]; then
30+
# allow the container to be started with `--user`
31+
if [ "$1" = 'postgres' ] && [ "$(id -u)" = '0' ]; then
3132
mkdir -p "$PGDATA"
3233
chown -R postgres "$PGDATA"
3334
chmod 700 "$PGDATA"
@@ -36,11 +37,18 @@ if [ "$1" = 'postgres' ]; then
3637
chown -R postgres /var/run/postgresql
3738
chmod g+s /var/run/postgresql
3839

40+
exec su-exec postgres "$BASH_SOURCE" "$@"
41+
fi
42+
43+
if [ "$1" = 'postgres' ]; then
44+
mkdir -p "$PGDATA"
3945

4046
# look specifically for PG_VERSION, as it is expected in the DB dir
4147
if [ ! -s "$PGDATA/PG_VERSION" ]; then
48+
chown -R "$(id -u)" "$PGDATA" 2>/dev/null || :
49+
4250
file_env 'POSTGRES_INITDB_ARGS'
43-
eval "su-exec postgres initdb $POSTGRES_INITDB_ARGS"
51+
eval "initdb --username=postgres $POSTGRES_INITDB_ARGS"
4452

4553
# check password first so we can output the warning before postgres
4654
# messes it up
@@ -68,11 +76,12 @@ if [ "$1" = 'postgres' ]; then
6876
authMethod=trust
6977
fi
7078

71-
{ echo; echo "host all all all $authMethod"; } | su-exec postgres tee -a "$PGDATA/pg_hba.conf" > /dev/null
79+
{ echo; echo "host all all all $authMethod"; } | tee -a "$PGDATA/pg_hba.conf" > /dev/null
7280

7381
# internal start of server in order to allow set-up using psql-client
7482
# does not listen on external TCP/IP and waits until start finishes
75-
su-exec postgres pg_ctl -D "$PGDATA" \
83+
PGUSER="${PGUSER:-postgres}" \
84+
pg_ctl -D "$PGDATA" \
7685
-o "-c listen_addresses='localhost'" \
7786
-w start
7887

@@ -111,14 +120,13 @@ if [ "$1" = 'postgres' ]; then
111120
echo
112121
done
113122

114-
su-exec postgres pg_ctl -D "$PGDATA" -m fast -w stop
123+
PGUSER="${PGUSER:-postgres}" \
124+
pg_ctl -D "$PGDATA" -m fast -w stop
115125

116126
echo
117127
echo 'PostgreSQL init process complete; ready for start up.'
118128
echo
119129
fi
120-
121-
exec su-exec postgres "$@"
122130
fi
123131

124132
exec "$@"

‎9.3/docker-entrypoint.sh

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,8 @@ if [ "${1:0:1}" = '-' ]; then
2727
set -- postgres "$@"
2828
fi
2929

30-
if [ "$1" = 'postgres' ]; then
30+
# allow the container to be started with `--user`
31+
if [ "$1" = 'postgres' ] && [ "$(id -u)" = '0' ]; then
3132
mkdir -p "$PGDATA"
3233
chown -R postgres "$PGDATA"
3334
chmod 700 "$PGDATA"
@@ -36,11 +37,18 @@ if [ "$1" = 'postgres' ]; then
3637
chown -R postgres /var/run/postgresql
3738
chmod g+s /var/run/postgresql
3839

40+
exec gosu postgres "$BASH_SOURCE" "$@"
41+
fi
42+
43+
if [ "$1" = 'postgres' ]; then
44+
mkdir -p "$PGDATA"
3945

4046
# look specifically for PG_VERSION, as it is expected in the DB dir
4147
if [ ! -s "$PGDATA/PG_VERSION" ]; then
48+
chown -R "$(id -u)" "$PGDATA" 2>/dev/null || :
49+
4250
file_env 'POSTGRES_INITDB_ARGS'
43-
eval "gosu postgres initdb $POSTGRES_INITDB_ARGS"
51+
eval "initdb --username=postgres $POSTGRES_INITDB_ARGS"
4452

4553
# check password first so we can output the warning before postgres
4654
# messes it up
@@ -68,11 +76,12 @@ if [ "$1" = 'postgres' ]; then
6876
authMethod=trust
6977
fi
7078

71-
{ echo; echo "host all all all $authMethod"; } | gosu postgres tee -a "$PGDATA/pg_hba.conf" > /dev/null
79+
{ echo; echo "host all all all $authMethod"; } | tee -a "$PGDATA/pg_hba.conf" > /dev/null
7280

7381
# internal start of server in order to allow set-up using psql-client
7482
# does not listen on external TCP/IP and waits until start finishes
75-
gosu postgres pg_ctl -D "$PGDATA" \
83+
PGUSER="${PGUSER:-postgres}" \
84+
pg_ctl -D "$PGDATA" \
7685
-o "-c listen_addresses='localhost'" \
7786
-w start
7887

@@ -111,14 +120,13 @@ if [ "$1" = 'postgres' ]; then
111120
echo
112121
done
113122

114-
gosu postgres pg_ctl -D "$PGDATA" -m fast -w stop
123+
PGUSER="${PGUSER:-postgres}" \
124+
pg_ctl -D "$PGDATA" -m fast -w stop
115125

116126
echo
117127
echo 'PostgreSQL init process complete; ready for start up.'
118128
echo
119129
fi
120-
121-
exec gosu postgres "$@"
122130
fi
123131

124132
exec "$@"

‎9.4/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ RUN mkdir -p /var/run/postgresql && chown -R postgres:postgres /var/run/postgres
5858

5959
ENV PATH /usr/lib/postgresql/$PG_MAJOR/bin:$PATH
6060
ENV PGDATA /var/lib/postgresql/data
61-
RUN mkdir -p "$PGDATA" && chown -R postgres:postgres "$PGDATA" && chmod 700 "$PGDATA"
61+
RUN mkdir -p "$PGDATA" && chown -R postgres:postgres "$PGDATA" && chmod 777 "$PGDATA" # this 777 will be replaced by 700 at runtime (allows semi-arbitrary "--user" values)
6262
VOLUME /var/lib/postgresql/data
6363

6464
COPY docker-entrypoint.sh /

‎9.4/alpine/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ RUN mkdir -p /var/run/postgresql && chown -R postgres:postgres /var/run/postgres
122122

123123
ENV PATH /usr/lib/postgresql/$PG_MAJOR/bin:$PATH
124124
ENV PGDATA /var/lib/postgresql/data
125-
RUN mkdir -p "$PGDATA" && chown -R postgres:postgres "$PGDATA" && chmod 700 "$PGDATA"
125+
RUN mkdir -p "$PGDATA" && chown -R postgres:postgres "$PGDATA" && chmod 777 "$PGDATA" # this 777 will be replaced by 700 at runtime (allows semi-arbitrary "--user" values)
126126
VOLUME /var/lib/postgresql/data
127127

128128
COPY docker-entrypoint.sh /

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy