postgresql - 如何让 postgres docker 容器在任何连接上使用 scram-sha-256 进行初始化？

Question

我正在尝试设置 POSTGRES_USER & POSTGRES_PASSWORD 使用 pg_hba.conf 使用 docker postgres 配置& postgresql.conf文件:

docker run --name pg \
-e POSTGRES_USER=myUser \
-e POSTGRES_PASSWORD=myPassword \
-e POSTGRES_DB=myDb \
-v $PWD/pg_hba.conf:/etc/postgresql/pg_hba.conf \
-v $PWD/postgresql.conf:/etc/postgresql/postgresql.conf \
--network data-talk \
-d postgres \
-c config_file=/etc/postgresql/postgresql.conf \
-c hba_file=/etc/postgresql/pg_hba.conf

pg_hba.conf

# "local" is for Unix domain socket connections only
local   all             all                                     scram-sha-256
# IPv4 local connections:
host    all             all             127.0.0.1/32            scram-sha-256
host    all             all             172.19.0.0/16           scram-sha-256
# IPv6 local connections:
host    all             all             ::1/128                 scram-sha-256
# Allow replication connections from localhost, by a user with the
# replication privilege.
local   replication     all                                     scram-sha-256
host    replication     all             127.0.0.1/32            scram-sha-256
host    replication     all             ::1/128                 scram-sha-256

postgresql.conf

listen_addresses = '*'
password_encryption = 'scram-sha-256'       # md5 or scram-sha-256

从这里 https://hub.docker.com/_/postgres

Note 1: The PostgreSQL image sets up trust authentication locally so you may notice a password is not required when connecting from localhost (inside the same container). However, a password will be required if connecting from a different host/container.

我想在包括本地在内的任何/每个连接上都需要密码。通过更改 pg_hba.conf我以为我可以满足这个要求。我正在使用 172.19.0.0/16因为这是 docker 网络的子网。

当我运行上面的 docker 命令时，我检查日志以找到这个 psql: error: could not connect to server: FATAL: password authentication failed for user “myUser” .

关于如何让它发挥作用的任何想法？我也试过

docker run --name pg \
-e POSTGRES_PASSWORD=password \
-v $PWD/pg_hba.conf:/etc/postgresql/pg_hba.conf \
-v $PWD/postgresql.conf:/etc/postgresql/postgresql.conf \
--network data-talk \
-d postgres \
-c config_file=/etc/postgresql/postgresql.conf \
-c hba_file=/etc/postgresql/pg_hba.conf

它运行到完成但是当我尝试在本地登录时出错:

$ docker exec -it pg sh
psql -U postgres
Password for user postgres:
psql: error: could not connect to server: FATAL:  password authentication failed for user "postgres"

Answer 1

关注这里 https://github.com/docker-library/postgres/blob/master/12/docker-entrypoint.sh#L202我假设在第一次运行和设置数据库时，身份验证方法是 md5 , 完成后 pg_hba.conf文件将其设置为 scram-sha-256使其无法进行身份验证。

通过设置 POSTGRES_INITDB_ARGS并传递参数以将初始身份验证方法设置为 scram-sha-256密码设置为 scram-sha-256用于数据库的初始化，并且可以正常工作。

docker run --name pg \
-e POSTGRES_USER=myUser \
-e POSTGRES_PASSWORD=myPassword \
-e POSTGRES_DB=myDb \
-e POSTGRES_INITDB_ARGS="--auth-host=scram-sha-256 --auth-local=scram-sha-256" \
-v $PWD/pg_hba.conf:/etc/postgresql/pg_hba.conf \
-v $PWD/postgresql.conf:/etc/postgresql/postgresql.conf \
--network data-talk \
-d postgres \
-c config_file=/etc/postgresql/postgresql.conf \
-c hba_file=/etc/postgresql/pg_hba.conf

POSTGRES_INITDB_ARGS

This optional environment variable can be used to send arguments to postgres initdb. The value is a space separated string of arguments as postgres initdb would expect them. This is useful for adding functionality like data page checksums: -e POSTGRES_INITDB_ARGS="--data-checksums"

这里的关键是在 initdb