Add custom pg_hba.conf in postgres docker container?

Question

. 。 Answers to this question are eligible for a +50 reputation bounty. Andrius wants to to this question. 这个问题。

I want to expose 5432 port to be accessible externally, but before doing that I want to limit it to only specific IPs, so I want to do that via pg_hba.conf

If I use docker default settings, communication between containers, works fine (by specified.networks).

But if I specify pg_hba.conf :

# TYPE  DATABASE        USER            ADDRESS                 METHOD

# "local" is for Unix domain socket connections only
local   all             all                                     trust
# IPv4 local connections:
host    all             all             127.0.0.1/32            trust
# IPv6 local connections:
host    all             all             ::1/128                 trust
# Allow replication connections from localhost, by a user with the
# replication privilege.
local   replication     all                                     trust
host    replication     all             127.0.0.1/32            trust
host    replication     all             ::1/128                 trust

host    all             all             all                     md5

And try to use this pg_hba.conf file (which is actually straight copy from container itself):

psycopg2.OperationalError: could not translate host name "db" to address: Temporary failure in name resolution (where db is postgres db service in docker-compose.yml).

My compose has this for postgres:

  other: # other service that connects to postgres using psycopg2
    networks:
      - backend
  db:
    image: postgres:13
    command: ["postgres", "-c", "config_file=/etc/postgresql.conf"]
    ports:
      - 5432:5432  # for external communications
    volumes:
      - db-data:/var/lib/postgresql/data
      - path/to/cfg:/etc/postgresql.conf
      - path/to/hba:/etc/postgresql/pg_hba.conf
  networks:
    - backend

  networks:
    backend:

And then in postgresql.conf I have edited this line:

hba_file = '/etc/postgresql/pg_hba.conf'

Also config has this set: listen_addresses = '*'

Inspecting docker.network:

docker network inspect bridge 
[
    {
        "Name": "bridge",
        "Id": "fe4fe8b8eb4e0c06d43428eadd2bb3f44a2ac581fe55618b4c70c5c28c107b8d",
        "Created": "2022-11-26T09:34:03.461094956+02:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.17.0.0/16",
                    "Gateway": "172.17.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {},
        "Options": {
            "com.docker.network.bridge.default_bridge": "true",
            "com.docker.network.bridge.enable_icc": "true",
            "com.docker.network.bridge.enable_ip_masquerade": "true",
            "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
            "com.docker.network.bridge.name": "docker0",
            "com.docker.network.driver.mtu": "1500"
        },
        "Labels": {}
    }
]

PS I checked

PostgreSQL in Docker - pg_hba.conf to allow access from host to container

And How can I allow connections by specifying docker-compose host names in postgres's pg_hba.conf file?

But none seem to make any difference.

UPDATE:

I retried again, using same thing. Just specifying pg_hba.conf and now I don't get that error. Not sure how it was solved. But pg_hba.conf is picked up just fine and I can limit access with it.

Answer 1

Try to keep both config files on the default place (in /var/lib/postgresql/data) and revert the change for hba_file location. Make sure the files have the same permission and ownership as in container: 600 postgres:postgres (999:999)

EDIT:

Just looked in the docs . They start pg with custom config like this:

$ docker run -d --name some-postgres -v "$PWD/my-postgres.conf":/etc/postgresql/postgresql.conf -e POSTGRES_PASSWORD=mysecretpassword postgres -c 'config_file=/etc/postgresql/postgresql.conf'

where postgres before "-c" is the image name. I think you should redirect "-c" part to entrypoint.

EDIT2:

You're right, according to the entrypoint script this call with "postgres" as a parameter also works.

Answer 2

You need to add the POSTGRES_PASSWORD as an environment variable on the docker-compose.yml for the the db container, otherwise the postgres will failed with:

tmp-db-1     | Error: Database is uninitialized and superuser password is not specified.
tmp-db-1     |        You must specify POSTGRES_PASSWORD to a non-empty value for the
tmp-db-1     |        superuser. For example, "-e POSTGRES_PASSWORD=password" on "docker run".
tmp-db-1     |
tmp-db-1     |        You may also use "POSTGRES_HOST_AUTH_METHOD=trust" to allow all
tmp-db-1     |        connections without a password. This is *not* recommended.
tmp-db-1     |
tmp-db-1     |        See PostgreSQL documentation about "trust":
tmp-db-1     |        https://www.postgresql.org/docs/current/auth-trust.html

If it still fails could you share the logs of the db container?