How to execute docker-entrypoint.sh with a different user as root within docker swarm?

[fentas]

This pull #289 broke my setup completely. As a quick fix, I had to build an image with a version of docker-enytrypoint.sh before this pull.

I am using Postgres within my docker swarm setup (docker-compose stack deploy). Before this pull, I just added init DB scripts into /docker-entrypoint-initdb.d/ and all worked fine. But now docker-enytrypoint.sh will never come to this point because the entry point is executed as root user which will terminate it at line 40. Additionally $PGDATA/pg_hba.conf is never configured, which was before.

Is there a way to tackle this? I tried

• to set user: postgres
• to create a custom entrypoint and executed /docker-entrypoint.sh with postgres user
• to create a custom Dockerfile and set USER postgres

All failed in some way. :/ Thanks a lot!

[tianon]

I cannot reproduce a failure in /docker-entrypoint-initdb.d scripts not executing with the current image (either Alpine or non-Alpine variants) -- can you elaborate on exactly what you're doing and how it's failing? Getting logs from a failing container would also be helpful.

$ cat > init.sh <<'EOF'
> echo hello from initdb
> EOF

$ chmod +x init.sh

$ docker pull postgres:9.5
9.5: Pulling from library/postgres
Digest: sha256:52454eb168c77c9f0b93139dfe107ada1131a506f9be982d97a3b386736a4e6d
Status: Image is up to date for postgres:9.5

$ docker run -it --rm -v "$PWD":/docker-entrypoint-initdb.d:ro postgres:9.5 | grep initdb
--auth-local and --auth-host, the next time you run initdb.
/usr/local/bin/docker-entrypoint.sh: running /docker-entrypoint-initdb.d/init.sh
hello from initdb

$ docker pull postgres:9.5-alpine9.5-alpine: Pulling from library/postgres
Digest: sha256:abdbe49005e0b0ea16b275ee0bfc731e29d78d61fa0383b7e93529eabfc88a45
Status: Image is up to date for postgres:9.5-alpine

$ docker run -it --rm -v "$PWD":/docker-entrypoint-initdb.d:ro postgres:9.5-alpine | grep initdb
--auth-local and --auth-host, the next time you run initdb.
/usr/local/bin/docker-entrypoint.sh: running /docker-entrypoint-initdb.d/init.sh
hello from initdb

[fentas]

Sorry for my impression. I wrote a quick test env.

Dockerfile

FROM postgres:9-alpine
COPY init-db.sh /docker-entrypoint-initdb.d/init-db.sh

init-db.sh

#!/bin/bash
set -e
psql -v ON_ERROR_STOP=1 --username "root" <<-EOSQL
  CREATE DATABASE mydb;
  GRANT ALL PRIVILEGES ON DATABASE mydb TO root;
EOSQL

docker-compose.yml

version: "3.3"

services:
  psql:
    image: 127.0.0.1:5000/psql:latest
    build: .
    environment:
      - POSTGRES_USER=root
      - POSTGRES_PASSWORD_FILE=/run/secrets/psql.user.root
    secrets:
      - source: psql.user.root
        uid: '999'
        mode: 0400
    volumes:
      - type: volume
        source: psql.data
        target: /var/lib/postgresql/data

volumes:
  psql.data:
    external:
      name: psql.data

secrets:
  psql.user.root:
    external:
      name: psql.user.root

run.sh

#!/bin/usr/env bash
docker service create --detach --name registry --publish 5000:5000 registry:2

echo "testtest" | docker secret create psql.user.root -
docker volume create psql.data

docker-compose build
docker-compose push

docker stack deploy --compose-file docker-compose.yml mystack

Now, this will resolve in the behavior I described before.

LOG:  database system was shut down at 2017-10-05 07:51:02 UTC
LOG:  MultiXact member wraparound protections are now enabled
LOG:  database system is ready to accept connections
LOG:  autovacuum launcher started

That's all I got from logs and all is as described before.

---

But what was interesting as I wrote this test env. If I create basically the same service manually (not docker-compose) it seems to work.

echo "testtest" | docker secret create psql.user.root -
docker volume create psql.data2
docker build -t mypsql .

docker service create \
  --name postgres_1 \
  --secret psql.user.root \
  --mount "type=volume,source=psql.data2,destination=/var/lib/postgresql/data" \
  -e POSTGRES_USER=root \
  -e POSTGRES_PASSWORD_FILE=/run/secrets/psql.user.root \
  mypsql

The files belonging to this database system will be owned by user "postgres".
This user must also own the server process.

The database cluster will be initialized with locale "en_US.utf8".
The default database encoding has accordingly been set to "UTF8".
The default text search configuration will be set to "english".

Data page checksums are disabled.

fixing permissions on existing directory /var/lib/postgresql/data ... ok
creating subdirectories ... ok
selecting default max_connections ... 100
selecting default shared_buffers ... 128MB
selecting dynamic shared memory implementation ... posix
creating configuration files ... ok
running bootstrap script ... ok
sh: locale: not found
performing post-bootstrap initialization ... No usable system locales were found.
Use the option "--debug" to see details.
ok

WARNING: enabling "trust" authentication for local connections
You can change this by editing pg_hba.conf or using the option -A, or
--auth-local and --auth-host, the next time you run initdb.
syncing data to disk ... ok

Success. You can now start the database server using:

    pg_ctl -D /var/lib/postgresql/data -l logfile start

waiting for server to start....LOG:  could not bind IPv6 socket: Address not available
HINT:  Is another postmaster already running on port 5432? If not, wait a few seconds and retry.
LOG:  database system was shut down at 2017-10-05 08:01:27 UTC
LOG:  MultiXact member wraparound protections are now enabled
LOG:  database system is ready to accept connections
LOG:  autovacuum launcher started
 done
server started
CREATE DATABASE

CREATE ROLE


/usr/local/bin/docker-entrypoint.sh: running /docker-entrypoint-initdb.d/init-db.sh
CREATE DATABASE
GRANT

LOG:  received fast shutdown request
LOG:  aborting any active transactions
LOG:  autovacuum launcher shutting down
LOG:  shutting down
waiting for server to shut down....LOG:  database system is shut down
 done
server stopped

PostgreSQL init process complete; ready for start up.

LOG:  database system was shut down at 2017-10-05 08:01:29 UTC
LOG:  MultiXact member wraparound protections are now enabled
LOG:  database system is ready to accept connections
LOG:  autovacuum launcher started

Now is the question, why is it not working with docker-compose. The docker-entrypoint.sh before --user addition works also with docker-compose without any problems with this setup.

[fentas]

Damn. I guess I got it by myself. Alpine version uses postgres user from alpine (id ~ 27). No permission on /run/secrets/psql.user.root seemed to be the problem.

Update: Yes. After updating permission on the secret all works fine again.
Thanks a lot.

[CoreyCole]

@fentas sorry to hijack this issue, but how did you allow commands as different users to run in a bash script? I'm trying to create two identical schemas under different databases with different users owning them.

db.Dockerfile

# ...
COPY ./src/database/schema/ /scrips/
COPY ./scripts/init.sh /docker-entrypoint-initdb.d
RUN chmod +x /docker-entrypoint-initdb.d/init.sh
# ...

init.sh

#!/usr/bash
set -e

# init db & user
su - postgres -c "psql -c \"CREATE USER user1 WITH PASSWORD 'password';\""
su - postgres -c "psql -c \"CREATE DATABASE db1 WITH OWNER user1 ENCODING 'UTF8';\""

# init test db & user
su - postgres -c "psql -c \"CREATE USER user2 WITH PASSWORD 'password';\""
su - postgres -c "psql -c \"CREATE DATABASE db2 WITH OWNER user2 ENCODING 'UTF8';\""

# init schema
for SCRIPT in /scripts/*.sql
do
	su - postgres -c "psql -d db1 < $SCRIPT"
	su - postgres -c "psql -d db2 < $SCRIPT"
done

# grant access to all tables
su - postgres -c "psql -d db1 -c \"GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public to user1;\""
su - postgres -c "psql -d db2 -c \"GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public to user2;\""

exit 0

But, I'm getting the error:

su: must be run from a terminal

I would just move the *.sql scripts into /docker-entrypoint-initdb.d, but I need to create two identical schemas under different databases.

[fentas]

Copy your shell scripts in /docker-entrypoint-initdb.d. Make sure they are executable (what you do).
Within the init shell script you don't need a user downgrade. Look at my example.
#350 (comment)

Just execute psql directly.

Note: /docker-entrypoint-initdb.d scripts will be only executed on the first DB initialization.