Database backups require gzip/shell inside the DB container, breaking hardened images (e.g. Docker Hardened Images)

Open
  • Is something wrong?
#5,524 2 comments 1 reaction 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
55/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
docker, mariadb, mysql, postgresql
Domain
databases, devops, infrastructure

Research direction

Trace the current Postgres, MySQL, and MariaDB backup and restore entry points, focusing on the docker exec bash -c commands described in the issue. Compare the backup and restore flows and verify them with a hardened image lacking gzip and a shell. Done means dumps and restores work with host-side compression and direct dump-binary execution without weakening the database image.

Written by the indexing model from the issue text.

Description

enhancement
What problem will this feature address?

Postgres/MySQL/MariaDB backups execute <dump> | gzip inside the database container via docker exec ... bash -c. Hardened/minimal images (DHI, distroless, Chainguard) intentionally ship without gzip, a package manager, or sometimes a shell, so backups fail. The only workarounds if you want to leverage the built-in backup feature are to add gzip to the image or install it at container start, both of which weaken the hardening.

Describe the solution you'd like
  1. Run only the dump binary in the container and do compression on the Dokploy host: docker exec -e PGPASSWORD=... <c> pg_dump -Fc ... | gzip | rclone rcat .... The output format doesn't change, so it's backward compatible.
  2. Exec the dump binary directly (argv form), not via bash -c.
  3. Optional: a compression setting (gzip / none / native pg_dump --compress), since -Fc is already compressed.
  4. Mirror this in restore: decompress on the host and stream to docker exec -i <c> pg_restore ....
Describe alternatives you've considered

Tested workaround on 18-debian-dev which includes apt-get. Used the Command/Args to have gzip installed at startup via base -c apt-get update && apt-get install -y gzip && exec docker-entrypoint.sh

This works but again, defeats the purpose of using a hardened image by needing to use the -dev with more CVEs and also installing gzip on each redeploy. Many reason why gzip is not included in even the -dev version of this secure container.

Additional context

Tested on Dokploy v0.30.6 with dhi.io/postgres:18-debian image

Will you send a PR to implement it?

Maybe, need help

Dominant language
TypeScript
Stars
38.2k
Forks
3.1k
Avg merge
2d 11h
Merged PRs (30d)
65

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Dokploy/dokploy

All issues in Dokploy/dokploy

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.