Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Canonical recipes bind 1433 on all interfaces with the example SA password

未关闭
  • 哪里不对？
#163 1 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

维护者通常 1 天内回复

@ascarter 已经在做这个了。

开始于 2026年9月22日。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
68/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
docker, docker-compose, shell
领域
devops, documentation, security

调研方向

Start by reviewing the listed recipe files, especially the Docker, Podman, and Compose examples in the references and SKILL.md files, then inspect skills/azuresql-db-container/scripts/verify.sh. Run a canonical recipe and docker port to confirm the current binding. Done means every host-published port is explicitly loopback-scoped and password handling is consistent across the documented recipes and verification script.

由索引模型根据 Issue 内容生成。

描述

Summary

Every canonical start recipe in this repo publishes the engine's SQL port without a loopback prefix — -p "1433:1433", -p "$HOST_PORT:1433", compose ports: "1433:1433" — which per Docker's documented -p semantics binds 0.0.0.0 (all interfaces) on the host. In the same recipe lines, the sa password is the repo-public example constant YourStr0ng_Passw0rd.

The combination means: anyone on the same LAN as a developer who paste-runs a canonical recipe, and who has read this public repo, can connect as sa to the running engine and read/write whatever dev data it holds — zero guessing required. The docs already tell users not to seed real PII and not to commit secrets, but the network path sidesteps both: the data only has to exist in the container for the exposure to apply.

Sites (main @ c1e8167e)

file lines shape
skills/azuresql-db-container/references/run-the-container.md 28-29 docker run … -e "MSSQL_SA_PASSWORD=YourStr0ng_Passw0rd" -p "$HOST_PORT:1433" …
same 58 podman variant -p "1433:1433" + the same password
same 76-78 compose MSSQL_SA_PASSWORD: "YourStr0ng_Passw0rd" + ports: - "1433:1433"
skills/azuresql-db-container/references/environment-variables.md 21-22 docker run … -e "MSSQL_SA_PASSWORD=YourStr0ng_Passw0rd" -p "1433:1433" …
skills/azuresql-db-container/references/entra-auth.md 57-65 Entra recipe carries the same password + -p "1433:1433"
skills/azuresql-db-container/SKILL.md 84-88 compose block: same password + ports: - "1433:1433" # optional; only to reach it from the host
skills/azuresql-db-sidecar/SKILL.md 84-88 same shape
skills/azuresql-db-from-sql-server/references/migrate-compose.md 12-16, 41-45 two compose blocks, same shape
skills/azuresql-db-container/scripts/verify.sh 22 SA_PASSWORD="${MSSQL_SA_PASSWORD:-YourStr0ng_Passw0rd}"
same 80-84 docker run … -e "MSSQL_SA_PASSWORD=$SA_PASSWORD" -p "$HOST_PORT:1433"

How to observe

Paste-run any recipe above, then:

$ docker port sqldb
1433/tcp -> 0.0.0.0:1433

With the documented default -p semantics there is no loopback qualifier, so the mapping binds 0.0.0.0 (the # only to reach it from the host comment on the compose line suggests loopback was the intent — the published mapping is broader than that intent). From another machine on the same LAN, sqlcmd -S <host-lan-ip>,1433 -U sa -P YourStr0ng_Passw0rd -C then authenticates.

Scope, honestly

  • This is a dev engine in a disposable container; per the repo's own docs this build has no xp_cmdshell / sp_configure surface, so sa here is data-plane access, not OS execution.
  • All connection-string examples correctly point at localhost — the host-side examples are fine; it is the published bind + public constant that combine into the exposure.
  • On Docker Desktop (Windows/macOS) the LAN reachability additionally depends on the host firewall and the "allow access" prompt; on a typical Linux Docker host the 0.0.0.0 bind is directly LAN-reachable.

Suggested change

  1. Loopback prefix in the canonical recipes: -p "127.0.0.1:$HOST_PORT:1433", compose 127.0.0.1:1433:1433. The compose comments already frame the port mapping as "only to reach it from the host" — the prefix makes that statement true. Anyone who genuinely needs LAN reach can still write the broader form explicitly.
  2. Per-run generated password in verify.sh and the canonical recipe (an MSSQL_SA_PASSWORD="$(openssl rand -base64 18)" step, echoed once for the session), keeping YourStr0ng_Passw0rd only as a clearly-marked placeholder in prose.

Both are small diffs across the files listed above — happy to send a PR.

主要语言
Shell
星标
17
派生
4
平均合并
12 小时 8 分钟
30 天内合并 PR
12

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

microsoft/azure-sql-database-container 的其他 Issue

查看 microsoft/azure-sql-database-container 的全部 Issue

相似的 Issue

更多 Shell/Bash Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。