Skip to content

Commit 212c394

Browse files
yosifkityosifkit
committed
Error when POSTGRES_PASSWORD is unset like mysql
Add POSTGRES_DISABLE_PASSWORDS to bring back old behavior and mirror MYSQL_ALLOW_EMPTY_PASSWORD, but add warning when it is used since it disables all passwords
1 parent 0d0485c commit 212c394

13 files changed

+273
-130
lines changed

‎10/alpine/docker-entrypoint.sh‎

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,9 @@ docker_init_database_dir() {
8787
fi
8888
}
8989

90-
# print large warning if POSTGRES_PASSWORD is empty
90+
# print large warning if POSTGRES_PASSWORD is long
91+
# error if both POSTGRES_PASSWORD and POSTGRES_DISABLE_PASSWORDS are not set
92+
# print large warning if POSTGRES_DISABLE_PASSWORDS is set
9193
docker_verify_minimum_env() {
9294
# check password first so we can output the warning before postgres
9395
# messes it up
@@ -103,22 +105,31 @@ docker_verify_minimum_env() {
103105
104106
EOWARN
105107
fi
106-
if [ -z "$POSTGRES_PASSWORD" ]; then
108+
if [ -z "$POSTGRES_PASSWORD" ] && [ -z "$POSTGRES_DISABLE_PASSWORDS" ]; then
107109
# The - option suppresses leading tabs but *not* spaces. :)
110+
cat >&2 <<-'EOE'
111+
Error: Database is uninitialized and superuser password is not specified.
112+
You must specify either POSTGRES_PASSWORD or POSTGRES_DISABLE_PASSWORDS
113+
Use "-e POSTGRES_PASSWORD=password" to set it in "docker run".
114+
EOE
115+
exit 1
116+
fi
117+
if [ -n "$POSTGRES_DISABLE_PASSWORDS" ]; then
108118
cat >&2 <<-'EOWARN'
109119
****************************************************
110-
WARNING: No password has been set for the database.
120+
WARNING: POSTGRES_DISABLE_PASSWORDS has been set.
111121
This will allow anyone with access to the
112-
Postgres port to access your database. In
113-
Docker's default configuration, this is
122+
Postgres port to access your database without
123+
a password, even if POSTGRES_PASSWORD is set.
124+
In Docker's default configuration, this is
114125
effectively any other container on the same
115126
system.
116127
117-
Use "-e POSTGRES_PASSWORD=password" to set
118-
it in "docker run".
128+
It is not recommended to use POSTGRES_DISABLE_PASSWORDS.
129+
Use "-e POSTGRES_PASSWORD=password" instead to
130+
set a password in "docker run".
119131
****************************************************
120132
EOWARN
121-
122133
fi
123134
}
124135

@@ -193,10 +204,10 @@ docker_setup_env() {
193204
fi
194205
}
195206

196-
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_PASSWORD
207+
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_DISABLE_PASSWORDS
197208
pg_setup_hba_conf() {
198209
local authMethod='md5'
199-
if [ -z "$POSTGRES_PASSWORD" ]; then
210+
if [ -n "$POSTGRES_DISABLE_PASSWORDS" ]; then
200211
authMethod='trust'
201212
fi
202213

‎10/docker-entrypoint.sh‎

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,9 @@ docker_init_database_dir() {
8787
fi
8888
}
8989

90-
# print large warning if POSTGRES_PASSWORD is empty
90+
# print large warning if POSTGRES_PASSWORD is long
91+
# error if both POSTGRES_PASSWORD and POSTGRES_DISABLE_PASSWORDS are not set
92+
# print large warning if POSTGRES_DISABLE_PASSWORDS is set
9193
docker_verify_minimum_env() {
9294
# check password first so we can output the warning before postgres
9395
# messes it up
@@ -103,22 +105,31 @@ docker_verify_minimum_env() {
103105
104106
EOWARN
105107
fi
106-
if [ -z "$POSTGRES_PASSWORD" ]; then
108+
if [ -z "$POSTGRES_PASSWORD" ] && [ -z "$POSTGRES_DISABLE_PASSWORDS" ]; then
107109
# The - option suppresses leading tabs but *not* spaces. :)
110+
cat >&2 <<-'EOE'
111+
Error: Database is uninitialized and superuser password is not specified.
112+
You must specify either POSTGRES_PASSWORD or POSTGRES_DISABLE_PASSWORDS
113+
Use "-e POSTGRES_PASSWORD=password" to set it in "docker run".
114+
EOE
115+
exit 1
116+
fi
117+
if [ -n "$POSTGRES_DISABLE_PASSWORDS" ]; then
108118
cat >&2 <<-'EOWARN'
109119
****************************************************
110-
WARNING: No password has been set for the database.
120+
WARNING: POSTGRES_DISABLE_PASSWORDS has been set.
111121
This will allow anyone with access to the
112-
Postgres port to access your database. In
113-
Docker's default configuration, this is
122+
Postgres port to access your database without
123+
a password, even if POSTGRES_PASSWORD is set.
124+
In Docker's default configuration, this is
114125
effectively any other container on the same
115126
system.
116127
117-
Use "-e POSTGRES_PASSWORD=password" to set
118-
it in "docker run".
128+
It is not recommended to use POSTGRES_DISABLE_PASSWORDS.
129+
Use "-e POSTGRES_PASSWORD=password" instead to
130+
set a password in "docker run".
119131
****************************************************
120132
EOWARN
121-
122133
fi
123134
}
124135

@@ -193,10 +204,10 @@ docker_setup_env() {
193204
fi
194205
}
195206

196-
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_PASSWORD
207+
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_DISABLE_PASSWORDS
197208
pg_setup_hba_conf() {
198209
local authMethod='md5'
199-
if [ -z "$POSTGRES_PASSWORD" ]; then
210+
if [ -n "$POSTGRES_DISABLE_PASSWORDS" ]; then
200211
authMethod='trust'
201212
fi
202213

‎11/alpine/docker-entrypoint.sh‎

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,9 @@ docker_init_database_dir() {
8787
fi
8888
}
8989

90-
# print large warning if POSTGRES_PASSWORD is empty
90+
# print large warning if POSTGRES_PASSWORD is long
91+
# error if both POSTGRES_PASSWORD and POSTGRES_DISABLE_PASSWORDS are not set
92+
# print large warning if POSTGRES_DISABLE_PASSWORDS is set
9193
docker_verify_minimum_env() {
9294
# check password first so we can output the warning before postgres
9395
# messes it up
@@ -103,22 +105,31 @@ docker_verify_minimum_env() {
103105
104106
EOWARN
105107
fi
106-
if [ -z "$POSTGRES_PASSWORD" ]; then
108+
if [ -z "$POSTGRES_PASSWORD" ] && [ -z "$POSTGRES_DISABLE_PASSWORDS" ]; then
107109
# The - option suppresses leading tabs but *not* spaces. :)
110+
cat >&2 <<-'EOE'
111+
Error: Database is uninitialized and superuser password is not specified.
112+
You must specify either POSTGRES_PASSWORD or POSTGRES_DISABLE_PASSWORDS
113+
Use "-e POSTGRES_PASSWORD=password" to set it in "docker run".
114+
EOE
115+
exit 1
116+
fi
117+
if [ -n "$POSTGRES_DISABLE_PASSWORDS" ]; then
108118
cat >&2 <<-'EOWARN'
109119
****************************************************
110-
WARNING: No password has been set for the database.
120+
WARNING: POSTGRES_DISABLE_PASSWORDS has been set.
111121
This will allow anyone with access to the
112-
Postgres port to access your database. In
113-
Docker's default configuration, this is
122+
Postgres port to access your database without
123+
a password, even if POSTGRES_PASSWORD is set.
124+
In Docker's default configuration, this is
114125
effectively any other container on the same
115126
system.
116127
117-
Use "-e POSTGRES_PASSWORD=password" to set
118-
it in "docker run".
128+
It is not recommended to use POSTGRES_DISABLE_PASSWORDS.
129+
Use "-e POSTGRES_PASSWORD=password" instead to
130+
set a password in "docker run".
119131
****************************************************
120132
EOWARN
121-
122133
fi
123134
}
124135

@@ -193,10 +204,10 @@ docker_setup_env() {
193204
fi
194205
}
195206

196-
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_PASSWORD
207+
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_DISABLE_PASSWORDS
197208
pg_setup_hba_conf() {
198209
local authMethod='md5'
199-
if [ -z "$POSTGRES_PASSWORD" ]; then
210+
if [ -n "$POSTGRES_DISABLE_PASSWORDS" ]; then
200211
authMethod='trust'
201212
fi
202213

‎11/docker-entrypoint.sh‎

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,9 @@ docker_init_database_dir() {
8787
fi
8888
}
8989

90-
# print large warning if POSTGRES_PASSWORD is empty
90+
# print large warning if POSTGRES_PASSWORD is long
91+
# error if both POSTGRES_PASSWORD and POSTGRES_DISABLE_PASSWORDS are not set
92+
# print large warning if POSTGRES_DISABLE_PASSWORDS is set
9193
docker_verify_minimum_env() {
9294
# check password first so we can output the warning before postgres
9395
# messes it up
@@ -103,22 +105,31 @@ docker_verify_minimum_env() {
103105
104106
EOWARN
105107
fi
106-
if [ -z "$POSTGRES_PASSWORD" ]; then
108+
if [ -z "$POSTGRES_PASSWORD" ] && [ -z "$POSTGRES_DISABLE_PASSWORDS" ]; then
107109
# The - option suppresses leading tabs but *not* spaces. :)
110+
cat >&2 <<-'EOE'
111+
Error: Database is uninitialized and superuser password is not specified.
112+
You must specify either POSTGRES_PASSWORD or POSTGRES_DISABLE_PASSWORDS
113+
Use "-e POSTGRES_PASSWORD=password" to set it in "docker run".
114+
EOE
115+
exit 1
116+
fi
117+
if [ -n "$POSTGRES_DISABLE_PASSWORDS" ]; then
108118
cat >&2 <<-'EOWARN'
109119
****************************************************
110-
WARNING: No password has been set for the database.
120+
WARNING: POSTGRES_DISABLE_PASSWORDS has been set.
111121
This will allow anyone with access to the
112-
Postgres port to access your database. In
113-
Docker's default configuration, this is
122+
Postgres port to access your database without
123+
a password, even if POSTGRES_PASSWORD is set.
124+
In Docker's default configuration, this is
114125
effectively any other container on the same
115126
system.
116127
117-
Use "-e POSTGRES_PASSWORD=password" to set
118-
it in "docker run".
128+
It is not recommended to use POSTGRES_DISABLE_PASSWORDS.
129+
Use "-e POSTGRES_PASSWORD=password" instead to
130+
set a password in "docker run".
119131
****************************************************
120132
EOWARN
121-
122133
fi
123134
}
124135

@@ -193,10 +204,10 @@ docker_setup_env() {
193204
fi
194205
}
195206

196-
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_PASSWORD
207+
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_DISABLE_PASSWORDS
197208
pg_setup_hba_conf() {
198209
local authMethod='md5'
199-
if [ -z "$POSTGRES_PASSWORD" ]; then
210+
if [ -n "$POSTGRES_DISABLE_PASSWORDS" ]; then
200211
authMethod='trust'
201212
fi
202213

‎12/alpine/docker-entrypoint.sh‎

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,9 @@ docker_init_database_dir() {
8787
fi
8888
}
8989

90-
# print large warning if POSTGRES_PASSWORD is empty
90+
# print large warning if POSTGRES_PASSWORD is long
91+
# error if both POSTGRES_PASSWORD and POSTGRES_DISABLE_PASSWORDS are not set
92+
# print large warning if POSTGRES_DISABLE_PASSWORDS is set
9193
docker_verify_minimum_env() {
9294
# check password first so we can output the warning before postgres
9395
# messes it up
@@ -103,22 +105,31 @@ docker_verify_minimum_env() {
103105
104106
EOWARN
105107
fi
106-
if [ -z "$POSTGRES_PASSWORD" ]; then
108+
if [ -z "$POSTGRES_PASSWORD" ] && [ -z "$POSTGRES_DISABLE_PASSWORDS" ]; then
107109
# The - option suppresses leading tabs but *not* spaces. :)
110+
cat >&2 <<-'EOE'
111+
Error: Database is uninitialized and superuser password is not specified.
112+
You must specify either POSTGRES_PASSWORD or POSTGRES_DISABLE_PASSWORDS
113+
Use "-e POSTGRES_PASSWORD=password" to set it in "docker run".
114+
EOE
115+
exit 1
116+
fi
117+
if [ -n "$POSTGRES_DISABLE_PASSWORDS" ]; then
108118
cat >&2 <<-'EOWARN'
109119
****************************************************
110-
WARNING: No password has been set for the database.
120+
WARNING: POSTGRES_DISABLE_PASSWORDS has been set.
111121
This will allow anyone with access to the
112-
Postgres port to access your database. In
113-
Docker's default configuration, this is
122+
Postgres port to access your database without
123+
a password, even if POSTGRES_PASSWORD is set.
124+
In Docker's default configuration, this is
114125
effectively any other container on the same
115126
system.
116127
117-
Use "-e POSTGRES_PASSWORD=password" to set
118-
it in "docker run".
128+
It is not recommended to use POSTGRES_DISABLE_PASSWORDS.
129+
Use "-e POSTGRES_PASSWORD=password" instead to
130+
set a password in "docker run".
119131
****************************************************
120132
EOWARN
121-
122133
fi
123134
}
124135

@@ -193,10 +204,10 @@ docker_setup_env() {
193204
fi
194205
}
195206

196-
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_PASSWORD
207+
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_DISABLE_PASSWORDS
197208
pg_setup_hba_conf() {
198209
local authMethod='md5'
199-
if [ -z "$POSTGRES_PASSWORD" ]; then
210+
if [ -n "$POSTGRES_DISABLE_PASSWORDS" ]; then
200211
authMethod='trust'
201212
fi
202213

‎12/docker-entrypoint.sh‎

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,9 @@ docker_init_database_dir() {
8787
fi
8888
}
8989

90-
# print large warning if POSTGRES_PASSWORD is empty
90+
# print large warning if POSTGRES_PASSWORD is long
91+
# error if both POSTGRES_PASSWORD and POSTGRES_DISABLE_PASSWORDS are not set
92+
# print large warning if POSTGRES_DISABLE_PASSWORDS is set
9193
docker_verify_minimum_env() {
9294
# check password first so we can output the warning before postgres
9395
# messes it up
@@ -103,22 +105,31 @@ docker_verify_minimum_env() {
103105
104106
EOWARN
105107
fi
106-
if [ -z "$POSTGRES_PASSWORD" ]; then
108+
if [ -z "$POSTGRES_PASSWORD" ] && [ -z "$POSTGRES_DISABLE_PASSWORDS" ]; then
107109
# The - option suppresses leading tabs but *not* spaces. :)
110+
cat >&2 <<-'EOE'
111+
Error: Database is uninitialized and superuser password is not specified.
112+
You must specify either POSTGRES_PASSWORD or POSTGRES_DISABLE_PASSWORDS
113+
Use "-e POSTGRES_PASSWORD=password" to set it in "docker run".
114+
EOE
115+
exit 1
116+
fi
117+
if [ -n "$POSTGRES_DISABLE_PASSWORDS" ]; then
108118
cat >&2 <<-'EOWARN'
109119
****************************************************
110-
WARNING: No password has been set for the database.
120+
WARNING: POSTGRES_DISABLE_PASSWORDS has been set.
111121
This will allow anyone with access to the
112-
Postgres port to access your database. In
113-
Docker's default configuration, this is
122+
Postgres port to access your database without
123+
a password, even if POSTGRES_PASSWORD is set.
124+
In Docker's default configuration, this is
114125
effectively any other container on the same
115126
system.
116127
117-
Use "-e POSTGRES_PASSWORD=password" to set
118-
it in "docker run".
128+
It is not recommended to use POSTGRES_DISABLE_PASSWORDS.
129+
Use "-e POSTGRES_PASSWORD=password" instead to
130+
set a password in "docker run".
119131
****************************************************
120132
EOWARN
121-
122133
fi
123134
}
124135

@@ -193,10 +204,10 @@ docker_setup_env() {
193204
fi
194205
}
195206

196-
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_PASSWORD
207+
# append md5 or trust auth to pg_hba.conf based on existence of POSTGRES_DISABLE_PASSWORDS
197208
pg_setup_hba_conf() {
198209
local authMethod='md5'
199-
if [ -z "$POSTGRES_PASSWORD" ]; then
210+
if [ -n "$POSTGRES_DISABLE_PASSWORDS" ]; then
200211
authMethod='trust'
201212
fi
202213

0 commit comments

Comments
 (0)