Repository navigation
Conversation
The official PostgreSQL, MySQL, MariaDB, ClickHouse and Neo4j images allow credentials to be provided through *_FILE variables (Docker secrets). Docker Compose support does not read these files, as decided in spring-projectsgh-37188, and the MongoDB and Elasticsearch environments already reject them with a clear "is not supported" message. The other environments silently ignored them instead. Depending on the variable, this either produced a misleading error ("No PostgreSQL password found" when POSTGRES_PASSWORD_FILE is set) or connected with a default value: POSTGRES_USER_FILE fell back to the "postgres" user and NEO4J_AUTH_FILE fell back to no authentication, so the failure only surfaced later at connection time. Fail fast with a "<NAME>_FILE is not supported" message in these cases. The check only applies when the plain variable that would have been used is absent, so setups that combine a *_FILE variable with a plain one that Spring Boot actually uses (for example MYSQL_ROOT_PASSWORD_FILE with MYSQL_USER and MYSQL_PASSWORD) keep working. Signed-off-by: DDINGJOO <173995233+DDINGJOO@users.noreply.github.com>
spring-projects-issues
added
the
status: waiting-for-triage
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The official PostgreSQL, MySQL, MariaDB, ClickHouse and Neo4j images accept credentials through
*_FILEvariables (Docker secrets). Docker Compose support doesn't read those files, which was decided in #37188. The MongoDB and Elasticsearch environments already reject them with a clear... is not supportedmessage, but the other environments silently ignore them:POSTGRES_PASSWORD_FILENo PostgreSQL password found, which is misleading because a password was providedPOSTGRES_USER_FILEpostgresuserNEO4J_AUTH_FILEAuthTokens.none()MYSQL_*_FILE,MARIADB_*_FILE,CLICKHOUSE_PASSWORD_FILENo ... password found/No ..._DATABASE defined, or a silent default userIn the silent cases the application starts and only fails later, when it connects.
This PR makes these environments fail fast with
<NAME>_FILE is not supported, matching MongoDB and Elasticsearch. The check only applies when the plain variable that would have been used is absent. Setups that combine a*_FILEvariable with a plain variable that Spring Boot actually uses keep working, for exampleMYSQL_ROOT_PASSWORD_FILEwithMYSQL_USERandMYSQL_PASSWORD, orPOSTGRES_PASSWORD_FILEwithPOSTGRES_HOST_AUTH_METHOD=trust. Tests cover both the rejected and the unchanged cases.The JDBC and R2DBC copies of each environment class are updated identically.
I looked at the official images' entrypoints to confirm which
*_FILEvariables they support (file_envin docker-library postgres/mysql,_mariadb_file_envin mariadb-docker,CLICKHOUSE_PASSWORD_FILEin the ClickHouse entrypoint, and the genericNEO4J_*_FILEhandling in the Neo4j entrypoint).