owner for /var/lib/postgresql and /var/lib/postgresql/18/docker

[felixzhangfb]

I'm using postgres:18-alpine, I see docker-entrypoint.sh has below function:

# used to create initial postgres directories and if run as root, ensure ownership to the "postgres" user
docker_create_db_directories()

So I get a folder structure like below:

d4c37975021b:/var/lib/postgresql# ls -haliF
total 12K
1441820 drwxrwxrwt    3 postgres postgres    4.0K Feb  4 02:24 ./
3300592 drwxr-xr-x    1 root     root        4.0K Jan 29 19:38 ../
1441848 drwxr-xr-x    3 root     root        4.0K Feb  4 02:24 18/

I'm not an expert but it seems not reasonable, the parent folder /var/lib/postgresql is owned by postgres but the child folder var/lib/postgresql/18 is owned by root.

Why I see this as an issue because when I use docker compose, I set volumes as below:

volumes:
  - pg-primary-data:/var/lib/postgresql/18/docker

but due to there is a specified volume {"/var/lib/postgresql":{}} per docker inspect postgres:18-alpine --format="{{json .Config.Volumes}}", I can see an additional anonymous volume in my docker volumes which seems annoying and dirty

$ docker volume ls
DRIVER    VOLUME NAME
local     3249f229cb89fa25bfbec17295178522f7244ec19e59559e1fb1b6ad9c4c40c4
local     my-pg-clusters_pg-primary-data

Could you please advice if this is intended? Is there any best practice to get around this? Or it is something can be optimized later? Thanks!

[Guiorgy]

volumes:
  - pg-primary-data:/var/lib/postgresql/18/docker

In PG 18+ the volume became /var/lib/postgresql, see the Dockerfile:

postgres/Dockerfile-alpine.template

Line 224 in ec0cb67

VOLUME /var/lib/postgresql

It's recommended to use that.

[felixzhangfb]

@Guiorgy @yosifkit Thanks a lot for your explanation. I'm trying to setup a replica instance, so write a replica-entrypoint.sh to replace original docker-entrypoint.sh, and I use PGPASSWORD="${REPLICA_PASSWORD}" gosu postgres pg_basebackup ..., which is creating docker/ as owned by postgres:postgres rather than postgres:root, is there any potential issue?

[Guiorgy]

I don't have any experience with Docker PostgreSQL (😅) replication. Can't you just create and chown+chmod the docker directory in your entrypoint script to the right permissions?

[felixzhangfb]

I don't have any experience with Docker replication. Can't you just create and chown+chmod the docker directory in your entrypoint script to the right permissions?

Oh it's not docker replication, just postgres replication. This is what I have now https://github.com/felixzhangfb/learn-docker-the-hard-way/tree/main/my-pgs, I can add some chown script after setup the pg_basebackup, just don't kown if I need to change the docker/ folder group to root and keep user as postgres

[yosifkit]

It won't hurt for the folder to be owned by postgres:postgres. As long as the postgres user has access (and PostgreSQL scripts/binaries don't complain), it is fine. Our scripts have historically only fixed the user value (and users are likely relying on that behavior now).

[felixzhangfb]

Thanks for the reply and the patience😄, I'll mark this discussion closed.