Is there a way to deploy a Postgres Database using Pulumi and Docker while keeping the password secure?

Question

Is there a way to deploy a Postgres Database using Pulumi and Docker while keeping the password secure?

How can I securely provision a Postgres database using Docker with Pulumi without exposing the password?

I need to ensure that the password is not visible when inspecting the container's environment variables.

import * as docker from '@pulumi/docker'
import * as pulumi from '@pulumi/pulumi'
import network from '../network'
import { Volume } from '../volumes'

const container_name = `${pulumi.getProject()}-postgres`

const postgresConfig = new pulumi.Config('postgres')

const postgres = pulumi
    .all([postgresConfig.requireSecret('password')])
    .apply(([password]) => {
        const env = {
            POSTGRES_DB: postgresConfig.require('db'),
            POSTGRES_USER: postgresConfig.require('user'),
            POSTGRES_PASSWORD: password,
        }

        return new docker.Container(container_name, {
            name: container_name,
            image: 'postgres:latest',
            restart: 'always',
            ports: [
                {
                    internal: 5432,
                    external: 5432,
                },
            ],
            networksAdvanced: [
                {
                    name: network.name,
                },
            ],
            volumes: [
                {
                    volumeName: Volume.postgres,
                    containerPath: '/var/lib/postgres/data',
                },
            ],
            healthcheck: {
                interval: '10s',
                retries: 10,
                tests: ['pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB'],
                timeout: '2s',
            },
            envs: [
                `POSTGRES_DB=${env.POSTGRES_DB}`,
                `POSTGRES_USER=${env.POSTGRES_USER}`,
                `POSTGRES_PASSWORD=${env.POSTGRES_PASSWORD}`,
            ],
        })
    })

export default postgres

javascript typescript postgresql docker pulumi

Answer 1

Answer №1

Your scenario involves encryption of secrets by Pulumi to ensure they are not visible in plaintext. However, once passed to the Docker container, these secrets become accessible in plaintext through environment variables.

To prevent passwords from being exposed in plaintext, you can utilize a Docker Secret for encrypting these values. It's important to note that Docker secrets functionality is restricted to Docker Swarm.

A relevant quote from the documentation:

Docker secrets are exclusive to swarm services and not stand-alone containers. For utilizing this feature, it's advisable to configure your container to operate as a service. Stateful containers typically function efficiently with a scale of 1 without necessitating modifications to the container code.

If you opt to proceed with Docker Swarm, you can initialize it on a standalone node using the following command:

docker swarm init

Afterwards, define your container as a service, as demonstrated below:

import * as pulumi from "@pulumi/pulumi";
import * as docker from "@pulumi/docker";

const container_name = `${pulumi.getProject()}-postgres`;
const postgresConfig = new pulumi.Config("postgres");

const password = postgresConfig.requireSecret("password");
const env = {
  POSTGRES_DB: postgresConfig.require("db"),
  POSTGRES_USER: postgresConfig.require("user"),
  POSTGRES_PASSWORD: password,
};

const secret = new docker.Secret("password", {
    name: "postgres-password",
    data: password.apply((pwd) => Buffer.from(pwd, 'utf8').toString('base64'))
})

const svc = new docker.Service(container_name, {
    endpointSpec: {
        ports: [{
            targetPort: 5432,
            publishedPort: 5432,
            publishMode: "ingress"
        }]
    },
    taskSpec: {
        containerSpec: {
            image: "postgres:latest",
            secrets: [{
                secretId: secret.id,
                fileName: "postgres-password",
                secretName: secret.name,
            }],
            env: {
                POSTGRES_DB: env.POSTGRES_DB,
                POSTGRES_USER: env.POSTGRES_USER,
                POSTGRES_PASSWORD_FILE: "/run/secrets/postgres-password",
            },
        }
    }
})

Answer 2

Your scenario involves encryption of secrets by Pulumi to ensure they are not visible in plaintext. However, once passed to the Docker container, these secrets become accessible in plaintext through environment variables.

To prevent passwords from being exposed in plaintext, you can utilize a Docker Secret for encrypting these values. It's important to note that Docker secrets functionality is restricted to Docker Swarm.

A relevant quote from the documentation:

Docker secrets are exclusive to swarm services and not stand-alone containers. For utilizing this feature, it's advisable to configure your container to operate as a service. Stateful containers typically function efficiently with a scale of 1 without necessitating modifications to the container code.

If you opt to proceed with Docker Swarm, you can initialize it on a standalone node using the following command:

docker swarm init

Afterwards, define your container as a service, as demonstrated below:

import * as pulumi from "@pulumi/pulumi";
import * as docker from "@pulumi/docker";

const container_name = `${pulumi.getProject()}-postgres`;
const postgresConfig = new pulumi.Config("postgres");

const password = postgresConfig.requireSecret("password");
const env = {
  POSTGRES_DB: postgresConfig.require("db"),
  POSTGRES_USER: postgresConfig.require("user"),
  POSTGRES_PASSWORD: password,
};

const secret = new docker.Secret("password", {
    name: "postgres-password",
    data: password.apply((pwd) => Buffer.from(pwd, 'utf8').toString('base64'))
})

const svc = new docker.Service(container_name, {
    endpointSpec: {
        ports: [{
            targetPort: 5432,
            publishedPort: 5432,
            publishMode: "ingress"
        }]
    },
    taskSpec: {
        containerSpec: {
            image: "postgres:latest",
            secrets: [{
                secretId: secret.id,
                fileName: "postgres-password",
                secretName: secret.name,
            }],
            env: {
                POSTGRES_DB: env.POSTGRES_DB,
                POSTGRES_USER: env.POSTGRES_USER,
                POSTGRES_PASSWORD_FILE: "/run/secrets/postgres-password",
            },
        }
    }
})

Is there a way to deploy a Postgres Database using Pulumi and Docker while keeping the password secure?

Answer №1

Similar questions

Initializing an HTML5 video player directly from an Array

Angular 2: Transforming File into Byte Array

Issue with Readonly modifier not functioning as expected in Angular/Typescript

Error occurred while making a request in React using Axios: TypeError - Unable to retrieve the 'token' property as it is undefined

Creating a Wireframe in Three.js Using a RawShaderMaterial with LineSegments

The JestImportMeta interface is mistakenly extending the ImportMeta interface, causing an error

Typescript eliminates the need for unnecessary source code compilation

Incorporate loading spinner to enhance search functionality

Filtering MUI Data Grid by array elements

Struggling with JQuery to revert an element back to its original position after the mouseout event

Is there a way to transform a string property into a custom type in a TypeScript array?

What is the process of connecting a Yarn module to a Docker container in another repository?

Load a page and sprinkle some contents with a slide effect

Issue with migrating TypeOrm due to raw SQL statement

What steps do I need to take in order to transform this code into a MUI component complete with

Adjust the value of a variable within a module using Angular JS

Capturing authorization issues in Firebase using ngrx effects

What is the method in AngularJS2 for using TypeScript to inject dependencies into components?

What could be causing my click() function to only work properly after resizing?

Diversifying collection of entities