|
| 1 | +FROM ubi10/s2i-core |
| 2 | + |
| 3 | +# PostgreSQL image for OpenShift. |
| 4 | +# Volumes: |
| 5 | +# * /var/lib/pgsql/data - Database cluster for PostgreSQL |
| 6 | +# Environment: |
| 7 | +# * $POSTGRESQL_USER - Database user name |
| 8 | +# * $POSTGRESQL_PASSWORD - User's password |
| 9 | +# * $POSTGRESQL_DATABASE - Name of the database to create |
| 10 | +# * $POSTGRESQL_ADMIN_PASSWORD (Optional) - Password for the 'postgres' |
| 11 | +# PostgreSQL administrative account |
| 12 | + |
| 13 | +ENV POSTGRESQL_VERSION=16 \ |
| 14 | + POSTGRESQL_PREV_VERSION=15 \ |
| 15 | + HOME=/var/lib/pgsql \ |
| 16 | + PGUSER=postgres \ |
| 17 | + APP_DATA=/opt/app-root |
| 18 | + |
| 19 | +ENV SUMMARY="PostgreSQL is an advanced Object-Relational database management system" \ |
| 20 | + DESCRIPTION="PostgreSQL is an advanced Object-Relational database management system (DBMS). \ |
| 21 | +The image contains the client and server programs that you'll need to \ |
| 22 | +create, run, maintain and access a PostgreSQL DBMS server." |
| 23 | + |
| 24 | +LABEL summary="$SUMMARY" \ |
| 25 | + description="$DESCRIPTION" \ |
| 26 | + io.k8s.description="$DESCRIPTION" \ |
| 27 | + io.k8s.display-name="PostgreSQL 16" \ |
| 28 | + io.openshift.expose-services="5432:postgresql" \ |
| 29 | + io.openshift.tags="database,postgresql,postgresql16,postgresql-16" \ |
| 30 | + io.openshift.s2i.assemble-user="26" \ |
| 31 | + name="rhel10/postgresql-16" \ |
| 32 | + com.redhat.component="postgresql-16-container" \ |
| 33 | + version="1" \ |
| 34 | + com.redhat.license_terms="https://www.redhat.com/en/about/red-hat-end-user-license-agreements#rhel" \ |
| 35 | + usage="podman run -d --name postgresql_database -e POSTGRESQL_USER=user -e POSTGRESQL_PASSWORD=pass -e POSTGRESQL_DATABASE=db -p 5432:5432 rhel10/postgresql-16" \ |
| 36 | + maintainer="SoftwareCollections.org <sclorg@redhat.com>" |
| 37 | + |
| 38 | +EXPOSE 5432 |
| 39 | + |
| 40 | +COPY root/usr/libexec/fix-permissions /usr/libexec/fix-permissions |
| 41 | + |
| 42 | +# This image must forever use UID 26 for postgres user so our volumes are |
| 43 | +# safe in the future. This should *never* change, the last test is there |
| 44 | +# to make sure of that. |
| 45 | +RUN INSTALL_PKGS="rsync tar gettext-envsubst bind-utils nss_wrapper-libs glibc-locale-source xz" && \ |
| 46 | + PSQL_PKGS="postgresql16-server postgresql16-contrib" && \ |
| 47 | + INSTALL_PKGS="$INSTALL_PKGS pgaudit" && \ |
| 48 | + INSTALL_PKGS="$INSTALL_PKGS procps-ng util-linux postgresql-upgrade" && \ |
| 49 | + yum -y --setopt=tsflags=nodocs install $INSTALL_PKGS $PSQL_PKGS && \ |
| 50 | + rpm -V $INSTALL_PKGS && \ |
| 51 | + postgres -V | grep -qe "$POSTGRESQL_VERSION\." && echo "Found VERSION $POSTGRESQL_VERSION" && \ |
| 52 | + yum -y clean all --enablerepo='*' && \ |
| 53 | + localedef -f UTF-8 -i en_US en_US.UTF-8 && \ |
| 54 | + test "$(id postgres)" = "uid=26(postgres) gid=26(postgres) groups=26(postgres)" && \ |
| 55 | + mkdir -p /var/lib/pgsql/data && \ |
| 56 | + mkdir -p /run/postgresql && \ |
| 57 | + /usr/libexec/fix-permissions /var/lib/pgsql /run/postgresql |
| 58 | + |
| 59 | +# Get prefix path and path to scripts rather than hard-code them in scripts |
| 60 | +ENV CONTAINER_SCRIPTS_PATH=/usr/share/container-scripts/postgresql \ |
| 61 | + ENABLED_COLLECTIONS= |
| 62 | + |
| 63 | +COPY root / |
| 64 | +COPY ./s2i/bin/ $STI_SCRIPTS_PATH |
| 65 | + |
| 66 | +# Hard links are not supported in Testing Farm approach during sync to guest |
| 67 | +# operation system. Therefore tests are failing on error |
| 68 | +# /usr/libexec/s2i/run no such file or directory |
| 69 | +RUN ln -s /usr/bin/run-postgresql $STI_SCRIPTS_PATH/run |
| 70 | + |
| 71 | +# Not using VOLUME statement since it's not working in OpenShift Online: |
| 72 | +# https://github.com/sclorg/httpd-container/issues/30 |
| 73 | +# VOLUME ["/var/lib/pgsql/data"] |
| 74 | + |
| 75 | +# S2I permission fixes |
| 76 | +# -------------------- |
| 77 | +# 1. unless specified otherwise (or - equivalently - we are in OpenShift), s2i |
| 78 | +# build process would be executed as 'uid=26(postgres) gid=26(postgres)'. |
| 79 | +# Such process wouldn't be able to execute the default 'assemble' script |
| 80 | +# correctly (it transitively executes 'fix-permissions' script). So let's |
| 81 | +# add the 'postgres' user into 'root' group here |
| 82 | +# |
| 83 | +# 2. we call fix-permissions on $APP_DATA here directly (UID=0 during build |
| 84 | +# anyways) to assure that s2i process is actually able to _read_ the |
| 85 | +# user-specified scripting. |
| 86 | +RUN usermod -a -G root postgres && \ |
| 87 | + /usr/libexec/fix-permissions --read-only "$APP_DATA" |
| 88 | + |
| 89 | +USER 26 |
| 90 | + |
| 91 | +ENTRYPOINT ["container-entrypoint"] |
| 92 | +CMD ["run-postgresql"] |
0 commit comments