search

gavodachs / docker-dachs

Docker image for GAVO DaCHS
https://hub.docker.com/r/gavodachs/dachs/
GNU General Public License v2.0
8 stars 7 forks source link

Accept network access in pghba from a wider subnet #10

Closed gmella closed 3 years ago

gmella commented 5 years ago

Hi, I would suggest to replace hardcoded subnet to the whole private network range so each dynamic ip allocation for containers on 172.16 172.17 172.18... could get an access to postgres server.

Here is the additionnal line that I use to build a more spectific image : RUN sed -i "s@172.17.0.0/24@172.16.0.0/12@g" /etc/postgresql/${PG_VERSION}/main/pg_hba.conf

This could be done in your Dockerfile ? https://github.com/chbrandt/docker-dachs/blob/79c8efdaa32aeac74a91ff0e2722d08c8b486be2/dockerfile/Dockerfile#L32

I don't think that open a real security problem...

Regards, Guillaume

msdemlei commented 3 years ago

Sorry for letting this linger for so long -- we're now trying to triage the bugs.

Do you still need this? And if so, what for?

gmella commented 3 years ago

No pb. This was for a try, but I noticed some connections issues during my tests. I now use the postgres images without any issue. BTW you can close all my issues and retain what seems ok on your side. Thx