Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dockerfile: include zero-config mysql client #737

Merged
merged 3 commits into from
Mar 21, 2019
Merged

dockerfile: include zero-config mysql client #737

merged 3 commits into from
Mar 21, 2019

Conversation

erizocosmico
Copy link
Contributor

Fixes #733

With this change, users won't even have to install the MySQL client
on their machines or care about setting the parameters every single
time they use it. By just docker exec -it $IMAGE_NAME mysql it
will connect to gitbase without requiring any kind of configuration.

Connection details are stored in $HOME/.my.cnf, which is generated
at the start of the gitbase server. Because gitbase user and password
can change when you run it, not only when you build the image, this
needs to be done on startup. That's why init.sh has been included,
which just creates the configuration for MySQL client and starts the
gitbase server.

Fixes #733

With this change, users won't even have to install the MySQL client
on their machines or care about setting the parameters every single
time they use it. By just `docker exec -it $IMAGE_NAME mysql` it
will connect to gitbase without requiring any kind of configuration.

Connection details are stored in `$HOME/.my.cnf`, which is generated
at the start of the gitbase server. Because gitbase user and password
can change when you run it, not only when you build the image, this
needs to be done on startup. That's why `init.sh` has been included,
which just creates the configuration for MySQL client and starts the
gitbase server.

Signed-off-by: Miguel Molina <miguel@erizocosmi.co>
@erizocosmico erizocosmico requested a review from a team March 19, 2019 14:14
@ajnavarro
Copy link
Contributor

I'm concerned that this can be a security issue in the future... WDYT @smola ?

@erizocosmico
Copy link
Contributor Author

erizocosmico commented Mar 20, 2019

@ajnavarro you need access to the container to use this. If you have access to the container, there's bigger fish to fry that being able to query gitbase 😛. If you mean because you're able to access gitbase without user/password, if you can docker exec this, you can docker exec echo "$GITBASE_PASSWORD".
How do you think this could be exploited?

@smola
Copy link
Contributor

smola commented Mar 20, 2019

Indeed. I don't see this as a security problem. docker exec access means root access in any case. You could just print the password or access the repositories volume directly.

See the equivalent with postgres container, for example:

$ docker run --name my-postgres --rm postgres:11-alpine
$ docker exec --user postgres -it my-postgres psql

@smola
Copy link
Contributor

smola commented Mar 20, 2019

Reminder: docker run access in practice means full root on the host. docker exec access means full root on any container, possibly also on the host.

@ajnavarro ajnavarro merged commit 3068d27 into src-d:master Mar 21, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants