search

bitwarden / self-host

Bitwarden's self-hosted release repository
GNU General Public License v3.0
331 stars 60 forks source link

Discard "docker-compose" in favor of "docker compose" #222

Open sincerelysaucy opened 7 months ago

sincerelysaucy commented 7 months ago

The published "docker-compose" binary is obsolete and unmaintained, and the "docker compose" plugin is actively being supported and built into contemporary releases of docker. Please discard the use of "docker-compose" or at least check for and use "docker compose" first in the bitwarden.sh, run.sh, and run.ps1 files. Its use encourages separately installing and relying on obsolete software, which should not be welcomed for security related software.

Greenderella commented 7 months ago

Hi there,

This report has been escalated for further investigation. If you have more information that can help us, please add it below.

Thanks!

vinnyperella commented 6 months ago

The above issue, https://github.com/bitwarden/self-host/issues/232, is unrelated to this issue.

My instance is successfully using the 'docker compose' binary located in $HOME/.docker/cli-plugins 

bitwarden@bitwarden:/opt/bitwarden$ which docker-compose
bitwarden@bitwarden:/opt/bitwarden$ docker compose version
Docker Compose version v2.26.1
bitwarden@bitwarden:/opt/bitwarden$ ~/.docker/cli-plugins/docker-compose version
Docker Compose version v2.26.1
bitwarden@bitwarden:/opt/bitwarden$ ./bitwarden.sh updateself
 _     _ _                         _            
| |__ (_) |___      ____ _ _ __ __| | ___ _ __  
| '_ \| | __\ \ /\ / / _` | '__/ _` |/ _ \ '_ \ 
| |_) | | |_ \ V  V / (_| | | | (_| |  __/ | | |
|_.__/|_|\__| \_/\_/ \__,_|_|  \__,_|\___|_| |_|

Open source password management solutions
Copyright 2015-2024, 8bit Solutions LLC
https://bitwarden.com, https://github.com/bitwarden

===================================================

bitwarden.sh version 2024.3.0
Docker version 26.0.0, build 2ae903e
Docker Compose version v2.26.1 <=============== latest Docker Compose release from Github

Updated self.
bitwarden@bitwarden:/opt/bitwarden$

I manually update this file using the Docker Compose Github releases page https://github.com/docker/compose/releases.

I do not have the binary that comes with the apt package docker-compose-plugin in my system path so it's not being used.

bitwarden@bitwarden:~$ dpkg -L docker-compose-plugin
/.
/usr
/usr/libexec
/usr/libexec/docker
/usr/libexec/docker/cli-plugins
/usr/libexec/docker/cli-plugins/docker-compose
/usr/share
/usr/share/doc
/usr/share/doc/docker-compose-plugin
/usr/share/doc/docker-compose-plugin/changelog.Debian.gz
bitwarden@bitwarden:~$ /usr/libexec/docker/cli-plugins/docker-compose version
Docker Compose version v2.25.0
bitwarden@bitwarden:~$
sincerelysaucy commented 1 month ago

The #232 actually is related. If you manually install "docker-compose", the "bitwarden.sh" script is written to use it by preference. And it's obsolete and unsupported, and should no longer even be attempted in place of the better supported "docker compose" command.

fuglphoenix commented 2 weeks ago

just adding my experience/pain regarding the use of docker-compose in the bitwarden.sh script 😅
my ubuntu installation contained the snap version of docker-compose. which messed up the bitwarden.sh start command. it would just error out and say something like 

docker-compose.yml file doesn't exists. 
stat /opt/bitwarden/bwdata/docker/docker-compose.yml

even though it actually does exists.
it turns out the env var COMPOSE_FILE didn't work correctly when using docker-compose. the fix was to remove docker-compose

nkadel commented 2 weeks ago

Do you need a pull request for this? Because the old 'docker-compose' binary is now six months older.