Dockerized postgres restarts `postgres` user password.

[adamwojt]

I’m running web app and postgres in docker containers inside VM and every once in a little while postgres docker resets user password but data remains. This makes application fails calling postgres db. I’d have to access ssh and run ALTER USER postgres WITH PASSWORD ‘postgres’; to fix it every time them it’d run fine for a day or two sometimes more.

Here is the log before the error occurs:
https://imgur.com/FxwiDMY

Has anyone seen any similar problems or any idea what’s going on?

My docker-compose.yml :

version: '3.4'
  
services:
  postgres:
    image: postgres:latest
    environment:
      - POSTGRES_USER=postgres
      - POSTGRES_PASSWORD=postgres
      - POSTGRES_DB=postgres
    volumes:
      - db-data:/var/lib/postgresql/data
    ports:
      - ${POSTGRES_PORT:-5432}:${POSTGRES_PORT:-5432}
  redis:
  ...
  web:
  ...

volumes:
  db-data:
    driver: local

EDIT: I copied wording from here since this was exactly the same problem I am facing. https://www.digitalocean.com/community/questions/postgres-docker-in-droplet-resets-user-password-on-its-own

[wglambert]

Hmm... that's a pretty weird issue where user credentials get changed, after some arbitrary time-delay. Yet the database is still intact.
From the logs screenshot what I gather is Postgres doesn't like some new PID: PID 10998 is not a PostgreSQL server process. And then the frontend protocol changes versions to 16 oddly, when Postgres only supports 2 & 3.

[wglambert]

Next time this happens could you do a ps aux in the container to show all the processes running (you'll need to apt update && apt install procps)

[yosifkit]

Is your actual password that insecure? With the ports: section, the PostgreSQL container is accessible from the internet and so likely to be targeted by an attacker.

Edit: remove the ports: section from the postgres service and you will likely never see the problem again.

[adamwojt]

@yosifkit I didn't realize that docker actually changes iptables and that everything was public. Good thing that this was just dev server for my hobby project (nothing serious). 😄

Thanks for your help!

More on it for interested people here: moby/moby#22054