mirror of https://github.com/pgadmin-org/pgadmin4.git synced 2026-08-19 01:15:04 -05:00

Files

T

Ashesh Vashi 0d11dbc173 fix(docker): make CAP_NET_BIND_SERVICE optional for restricted runtimes (#9985 )

The container previously applied CAP_NET_BIND_SERVICE to the python
interpreter so the non-root pgadmin user could bind to ports 80/443.
Some platforms refuse to honor file capabilities:

  - --cap-drop=ALL / OpenShift restricted-v2 SCC zero the bounding set,
    so the kernel returns EPERM on exec of any capability-tagged binary.
    This makes the image fail to start (issue #9657).
  - --security-opt=no-new-privileges / allowPrivilegeEscalation: false
    causes the kernel to silently strip file capabilities on exec, so
    the binary runs but a subsequent bind() to <1024 still fails.

Split the interpreter so neither default behavior nor restricted-runtime
support has to give up the other:

  - Dockerfile copies python3.X to /usr/local/bin/python3-cap and applies
    setcap to the copy. /usr/local/bin/python3.X stays un-capped, so
    /venv/bin/python3 (which symlinks to it) execs cleanly under
    restricted SCCs. A parallel /venv/bin/python3-cap symlink keeps the
    venv activation working when the capped interpreter is used.
  - entrypoint.sh reads /proc/self/status at startup. If NoNewPrivs is
    set, or CAP_NET_BIND_SERVICE is missing from the bounding set,
    gunicorn is invoked through the un-capped python and (when
    PGADMIN_LISTEN_PORT is unset) the default port falls back to 8080
    for plain HTTP or 8443 for TLS. A startup message records the
    choice.
  - Existing deployments with the default 80/443 mapping are unaffected:
    on every unrestricted runtime the bounding set still contains
    NET_BIND_SERVICE and gunicorn runs through the capped interpreter
    exactly as before.
  - PGADMIN_LISTEN_PORT, if set, is honored in both paths.

Docs gain a "Restricted Security Contexts" subsection covering the new
auto-detected fallback and the OpenShift / --cap-drop=ALL invocation.

Fixes #9657

2026-05-28 19:31:55 +05:30

entrypoint.sh

fix(docker): make CAP_NET_BIND_SERVICE optional for restricted runtimes (#9985 )

2026-05-28 19:31:55 +05:30

gunicorn_config.py

Supports JSON logging for gunicorn process within Docker. #8665

2025-06-03 13:33:09 +05:30

README.md

Fix filenames.

2021-02-09 16:15:13 +00:00

run_pgadmin.py

Update container build to use Alpine Linux and Gunicorn instead of CentOS and Apache. Fixes #3246

2018-04-04 16:18:17 +01:00

README.md

pgAdmin Docker Container Builds

This directory contains the files required to create a docker container running pgAdmin.

Building

From the top level directory of the pgAdmin source tree, simply run:

docker build .

You can also run make docker, which will call docker build . but also tag the image like:

pgadmin4 pgadmin4:latest pgadmin4:4 pgadmin4:4.12

WARNING

The build should be run in a CLEAN source tree. Whilst some potentially dangerous files such as config_local.py or log files will be explicitly excluded from the final image, other files will not be.

Running

See the documentation at docs/en_US/container_deployment.rst for information on running the container.