enable scram-sha-256 password encryption

[birkb]

• if $POSTGRES_HOST_AUTH_METHOD is set
• without that update new users are unable to logon,
  because the password would still be saved as md5,
  but the host auth is set to scram-sha-256 in pg_hba.conf

[birkb]

All FORCE_DEB_BUILD=1 builds have been failed. Is sed not available in your Debian image?

[birkb]

The VERSION=12 FORCE_DEB_BUILD=1 build fails, but version 12.2-2.pgdg100+1 is available in the repo.

[birkb]

http://apt.postgresql.org/pub/repos/apt/dists/buster-pgdg/12/binary-amd64/Packages does not contain the 12.2-2.pgdg100+1 package

[birkb]

apt-cache search postgresql-12 inside the build container shows no packages. apt-cache search postgresql-11 lists 64 packages.

[yosifkit]

No, we do not want to add anything to the image to change postgresql.conf based on env vars (everything that can be specified in the config can just be passed as docker run arguments). pg_hba.conf is only done because there is no other way to set it.

POSTGRES_HOST_AUTH_METHOD was added in #658 and so it looks like the fix for this is just documentation; to change the auth method to another hashing method, you need to also inform initdb so that the postgres user is created with the proper authentication method:

This works with the current image:

docker run -it --rm \
	-e POSTGRES_HOST_AUTH_METHOD=scram-sha-256 \
	-e POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256 \
	-e POSTGRES_PASSWORD=12345 \
	--network posty \
	--name post \
	postgres

[birkb]

Thanks for the POSTGRES_INITDB_ARGS hint. That has solved the problem.

[nicexe]

It might be more proper to modify the initialization script to check if POSTGRES_HOST_AUTH_METHOD is set to scram-sha-256 instead of setting 2 variables to achieve this

[minalexcorporation]

Official docker image for version 13 was driving me crazy until I found this thread - please consider updating the docker hub page to include the POSTGRES_INIT_DB_ARGS... entry as required for setting scram-sha-256 to work. I spun it up using docker-compose and burned several hours trying to figure out what I was getting wrong....

[tianon]

Great idea -- docker-library/docs#1857