postgres

I'm fully aware why it's an issue with official image. But even with debian (or any other "packaging") there are hoops to be hopped through due to said missing upgrade handling which IMHO is very annoying. They do handle minor versions upgrade so the code handling upgrading is there but devs seems to be quite adamant against adding major version upgrade. I (well, a lot of people judging from votes and comments in https://github.com/docker-library/postgres/issues/37 and stars in https://github.com/tianon/docker-postgres-upgrade) would love that, and only between subsequent version would be more than enough…

Yeah, we've offered to make that happen but there's been zero response: https://github.com/docker-library/postgres/issues/37#issueco... Btw, what do you find convoluted about our project (pgautoupgrade)? It started out as super simple like you mention above... but it also started out using Alpine images so didn't work so well for people coming from Debian based ones. We've added support for Debian based ones now too, but that's introduced more complexity to the README (as has other options). o_O

Sometimes, following a security vulnerability, users end up in intense discussions with the maintainers of Docker images. It's challenging to navigate such situations effectively. The apparent simplicity of Docker images can be deceptive and pose risks. It's important to exercise caution to avoid potential problems. See: "Docker Hub image for version 12.4 contains a cryptominer [Confirmed!]" https://github.com/docker-library/postgres/issues/770

Weak password + Open ports ---> Malware attack ( kinsing , etc ) so use "-p 127.0.0.1:5432:5432" - https://github.com/docker-library/postgres/issues/770 - https://sysdig.com/blog/zoom-into-kinsing-kdevtmpfsi - https://sysdig.com/blog/cloud-defense-in-depth/ - https://thenewstack.io/kinsing-malware-targets-kubernetes/ - https://stackoverflow.com/search?q=kinsing - https://github.com/search?q=repo%3Adocker-library%2Fpostgres... ----------- https://docs.docker.com/network/packet-filtering-firewalls/ "On Linux, Docker manipulates iptables rules to provide network isolation. While this is an implementation detail and you should not modify the rules Docker inserts into your iptables policies, it does have some implications on what you need to do if you want to have your own policies in addition to those managed by Docker. If you're running Dock

There is an occasional downside with the Postgres container though... no automatic upgrade path between major versions: https://github.com/docker-library/postgres/issues/37 So, if you want to keep on a supported version of PostgreSQL then every few years you'll need to figure something out. Hopefully that gets fixed at some point though. My in-development "automatically upgraded PostgreSQL" container is about ~400MB though, which is ~200MB more than the standard one. For my use-cases the extra space isn't relevant, but for other people it probably would be.

Tragedy of the commons - only need a few bad actors to ruin it all for us. Almost all distributors face this problem, from Docker Hub to PyPI. This also reminded me of official Postgres Docker image running a cryptominer in the background [1] [1] - https://github.com/docker-library/postgres/issues/770

GNU awk and jq are at the heart of the templating engine used by a number of Docker Official Images: https://github.com/docker-library/bashbrew/blob/master/scrip... https://github.com/docker-library/postgres/blob/master/apply... https://github.com/docker-library/postgres/blob/master/Docke...

It looks like the postgres docker containers were updated about 1pm pacific, which is around when we started to see issues. there's a new PR merged into the github repo to fix a bug caused by the above merge: https://github.com/docker-library/postgres/commit/41bd7bf3f4... I bet they'll be pushing out new containers shortly.

Both my professional experience, and public examples would seem to suggest that's the norm. Example, here's the official postgres Dockerfile: https://github.com/docker-library/postgres/blob/3bb48045b4dc.... Do you work in an environment that maintains custom copies of every dependency in company managed repos? If so, my experience suggests your the outlier, not the people running apt, npm, etc inside their Dockerfiles.

Well I use the official Postgresql docker image ;) Also it looks like this is not new https://github.com/docker-library/postgres/issues/37

In the simple case, yes it is, but it scales poorly; consider ex. https://github.com/docker-library/postgres/blob/b9c080857b88... which is 112 lines run together like that to keep things in a single layer. This is pretty bad for readability. Also, as sibling comment notes, that only works for RUN commands, not other or mixed groups of commands.

It looks like you didn't accept the answers in the previous github issue https://github.com/docker-library/postgres/issues/767 and opened a new one with the same claim adding '[confirmed]' without further proof.

> Re upgrades, have you tried pg_upgrade for upgrades in place? This only works when you have both versions available at the same time, which seems likely to break when a package manager jumps major versions, and also doesn't work when running postgres in Docker (https://github.com/docker-library/postgres/issues/37).

keep in mind that the "official" docker images are "offical" in the sense of docker inc marking them as official, not in the sense of "the upstream provides these". This is the repo for the Dockerfiles https://github.com/docker-library/postgres and it begins with: > This is the Git repo of the Docker "Official Image" for postgres (not to be confused with any official postgres image provided by postgres upstream)