Manage Docker Postgres
By: Oktis Lumbantoruan
Tags: Postgres, Docker, Database Administration, Database, Postgresql

Port Exposed

In previous article, we already learn how to connect to database postgres docker container through the bash docker exec -ti postgresdb bash . Now we will try to direct connect to the database without bash. First, we will create the new container.

Pada artikel sebelumnya kita sudah belajar koneksi database melalui bash ke container docker postgres docker exec -ti postgresdb bash . Kali ini kita akan coba masuk ke databasenya langsung tanpa melalui bash. Tapi sebelumnya kita create dahulu container yang baru.

# docker container create --name postgresdb -e POSTGRES_PASSWORD=[PASSWORDHERE] postgres:11-alpine

1499fc5ff2bb8378cf33a2af90a884462f8da30f015c11cf72ebcf0f2521ce52 # docker ps

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

1499fc5ff2bb postgres:11-alpine "docker-entrypoint.s…" 2 minutes ago Up About a minute 5432/tcp postgresdb

Then we will try direct connect without bash.

Kemudian kita coba connect langsung tanpa melalui bash.

# psql -d postgres -h localhost -U postgres -p 5432

psql: could not connect to server: Connection refused

Is the server running on host "localhost" (127.0.0.1) and accepting

TCP/IP connections on port 5432?

could not connect to server: Network is unreachable

Is the server running on host "localhost" (::1) and accepting

TCP/IP connections on port 5432?

So it is failed. So how to do the direct connect? By doing the Port Exposed, which binding the server’s port with the docker postgres port (default 5432).

Ternyata kita gagal connect langsung ke database. Terus bagaimana caranya melakukan koneksi langsung? Dengan Port Exposed, yaitu membinding port di server kita dengan port di docker postgres (default 5432).

docker run --name postgresdb5433 -e POSTGRES_PASSWORD=[PASSWORDHERE] -d -p 5433:5432 postgres:11-alpine

6bffd9c50e2a468f9b19d9ec4c76433de6a2757a1a8806b5fa5c59b2205d9551

In above sample, we binding the our server’s port 5433 with the docker postgres port 5432. That’s mean we will do direct connect through port 5433.

Pada contoh diatas kita membinding port server 5433 ke port 5432 docker postgres. Artinya kita akan dapat mengakses db tersebut melalui port 5433.

# docker ps

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

17fae2f1794a postgres:11-alpine "docker-entrypoint.s…" About a minute ago Up 23 seconds 5432/tcp postgresdb5433

Now we will try direct connect with the port 5433.

Sekarang kita akan mencoba koneksi langsung dengan port 5433.

# psql -h localhost -p 5433 -d postgres -W

Password:

psql (10.12 (Ubuntu 10.12-0ubuntu0.18.04.1), server 11.8)

WARNING: psql major version 10, server major version 11.

Some psql features might not work.

Type "help" for help.

postgres=# create database dockerpostgres;

CREATE DATABASE postgres=# \q

Success! But it will be failed if we run through the port 5432, because no database run at that port.

Berhasil! Tapi akan gagal jika connect ke port 5432, karena tidak ada database yang berjalan di port tersebut.

# psql -h localhost -p 5432 -d postgres -W

Password:

psql: could not connect to server: Connection refused

Is the server running on host "localhost" (127.0.0.1) and accepting

TCP/IP connections on port 5432?

could not connect to server: Network is unreachable

Is the server running on host "localhost" (::1) and accepting

TCP/IP connections on port 5432?

How if we try connect from other ip than localhost?

Bagaimana jika kita mencoba dari ip lain selain localhost?

# psql -h PUTSERVERIPHERE -p 5433 -d postgres -W

Password:

psql (11.6 (Ubuntu 11.6-1.pgdg18.04+1), server 11.8)

Type "help" for help. # postgres=# \c dockerpostgres

Password for user postgres:

psql (11.6 (Ubuntu 11.6-1.pgdg18.04+1), server 11.8)

You are now connected to database "dockerpostgres" as user "postgres".

dockerpostgres=#

Still connect! But this is dangerous because the default pg_hba will allow connection from others ip segment like 172.21. So how to edit the pg_hba and restrict the connection?

Tetap berhasil! Tapi ini cukup membahayakan karena default pg_hba akan mengijinkan koneksi dari segment ip lain seperti 172.21. Jadi bagaimana cara kita mengubah pg_hba nya dan memperketat koneksi yang masuk?

Manage pg_hba Docker Postgres

We know in postgres, to restrict the connection, we can specify which ip that allowed / rejected in pg_hba. Inside of docker postgres, we can find the pg_hba in /var/lib/postgresql/data/ , through the bash command. Now we will try to reject the segment 172.21 in pg_hba.

Kita tau bahwa di postgres untuk membatasi koneksi yang masuk adalah dengan mengubah ip yang diijinkan / ditolak di pg_hba. Di dalam docker postgres, pg_hba terletak di path berikut /var/lib/postgresql/data/ , melalui bash. Berikut kita akan coba menolak ip dengan segment 172.21.

bash-5.0# vi /var/lib/postgresql/data/pg_hba.conf host all all 172.21.0.0/16 reject

Then reload the configuration through database.

Kemudian reload config nya melalui database.

postgres=# select pg_reload_conf();

Then login again from servers with segment 172.21.

Kemudian login lagi dari server segment ip 172.21.

psql -h PUTSERVERIPHERE -p 5433 -d postgres -W

Password:

psql: FATAL: pg_hba.conf rejects connection for host "172.21.xxx.xxx", user "postgres", database "postgres", SSL off

Voila!! We can restrict the connection! But how if the connection from local?

Berhasil!! Kita berhasil menolak aksesnya! Lalu bagaimana jika dari local?

psql -h localhost -p 5433 -d postgres -W

Password:

psql (10.12 (Ubuntu 10.12-0ubuntu0.18.04.1), server 11.8)

WARNING: psql major version 10, server major version 11.

Some psql features might not work.

Type "help" for help. postgres=# \q

Voila again! This means that now only localhost can access the database.

Berhasil lagi! Artinya koneksi yang diijinkan sekarang hanya dari localhost.