Initialization of a user defined database, username, and password using environment variables

Start by reading docker-entrypoint.sh and the documentation describing MONGO_INITDB_DATABASE, then review the referenced issue and pull request for existing behavior. Done means the proposed environment variables have the stated root and user-database semantics, initialization scripts run against the specified user database, and the documentation explains each variable clearly.

This issue (I would call it a bug but perhaps it is a feature request) is that users would like to a la docker-compose.yml and/or environment variables be able to set a database with a username and password they specify upon launch of the image.

Background:

This issue was filed https://github.com/docker-library/mongo/issues/174 and closed because the behavior of a PR https://github.com/docker-library/mongo/pull/145 was mentioned as the solution. What https://github.com/docker-library/mongo/pull/145 actually does and what users expect are entirely different. What PR https://github.com/docker-library/mongo/pull/145 does is set a user with elevated permissions (i.e. "root" user) that has superuser access to the entire MongoDB instance (as mentioned in https://github.com/docker-library/mongo/issues/174#issuecomment-460448991. However what most users expect from these environment variables is that a database they specify is initialized with the username and password they have set. It is confusing that these environment variables (MONGO_INITDB_DATABASE, MONGO_INITDB_ROOT_PASSWORD and MONGO_INITDB_ROOT_USERNAME) pertain to only setting a user with the role root on the database admin and initializing an user specified database for .js and .sh scripts in /docker-entrypoint-initdb.d/ to be run against.

Proposal:

We should make the environment variables very explicitly named in what they do in addition to adding others for the behavior I think most users come to expect when reading the variable names. Since it is the case most users would like their instance initialized with a database of their specification we should add this feature to meet that expectation.

• We keep MONGO_INITDB_ROOT_USERNAME and MONGO_INITDB_ROOT_PASSWORD
• We remove MONGO_INITDB_DATABASE as it is misleading
• We add MONGO_INITDB_ROOT_DATABASE and allow it to override the hardcoded admin database
• We add MONGO_USERDB_ADMIN_USERNAME, MONGO_USERDB_ADMIN_PASSWORD, and MONGO_USERDB_ADMIN_DATABASE
• We update the documentation to state:
  • MONGO_INITDB_ROOT_USERNAME, MONGO_INITDB_ROOT_PASSWORD, and MONGO_INITDB_ROOT_DATABASE will be used for the root role to Mongo
• MONGO_USERDB_ADMIN_USERNAME, MONGO_USERDB_ADMIN_PASSWORD, and MONGO_USERDB_ADMIN_DATABASE will be used to initialize a user specified database
• That all of the .js and .sh scripts a user supplies in /docker-entrypoint-initdb.d/ will be executed against MONGO_USERDB_ADMIN_DATABASE

Reasons for change:

• The variables MONGO_INITDB_ROOT_PASSWORD and MONGO_INITDB_ROOT_USERNAME are only used for the admin database
• Currently all MONGO_INITDB_DATABASE does is have operations used against it whenever a user has dropped in .js or .sh scripts into /docker-entrypoint-initdb.d/. This unclear unless you look at docker-entrypoint.sh in this repository and no where clearly stated in the documentation as such
• The documentation is unclear and the only way to hack in a user initialized database with a username and password on image launch is to also create a script in /docker-entrypoint-initdb.d/ which then places burden on the user to maintain the root role credentials in environment variables which live separately from a custom .js or .sh script which they have to volume into the image

References:

• Issue: https://github.com/docker-library/mongo/issues/174
• PR: https://github.com/docker-library/mongo/pull/145

Involved Persons:

@mmi-rperez
@tianon
@vutran1710
@yosifkit
@lonix1
@johnwyles