Phase one of addressing exposed passwords.

[lathama]

Phase one of addressing exposed passwords.

• For database password is shown in ps!!!! #334
• Enable users to see what configuration settings they can/should set for databases
• Prepare for excluding the password from the command which is visible from the host machine.

The problem

lathama@hostsystemnotthedockercontainer: $ ps ax | grep '/bin/odoo'
/usr/bin/python3 /usr/bin/odoo --db_host db --db_port 5432 --db_user odoo --db_password odoo

The goal

lathama@hostsystemnotthedockercontainer: $ ps ax | grep '/bin/odoo'
/usr/bin/python3 /usr/bin/odoo

Related

• How to connect to the host database？ #343
• [Feature Request] Improve security by using docker secret for password #302
• [All] entrypoint.sh: Does not allow Unix Sockets #265
• questions about docker secrets #424

[lathama]

@odony and or @d-fence I will ask for some help getting this going.

[lathama]

Additional, I am in all the CLAs as lathama going back to the beginning if it is needed on this repo.

[amh-mw]

Passing --db-password on the command line is a convenience for local development. There are already multiple mechanisms for doing this more securely.

1. Mount an entire odoo.conf into the container, replacing these defaults and adding your password in the config file.

    # docker-compose.yaml
    volumes:
      - ./odoo.conf:/etc/odoo/odoo.conf

2. Expose sensitive values as environment variables:

    # docker-compose.yaml
    environment:
      - POSTGRES_PASSWORD=odoo
      - POSTGRES_USER=odoo

I generally find this pull request without merit and think it should be closed.

[amh-mw]

--database > db_name setting

database(s) used when installing or updating modules. Providing a comma-separated list restrict access to databases provided in list.

Setting a default db_name here unexpectedly restricts available databases, breaking current expectations.

[lathama]

Note to viewers, the CLI wins over the config file in some cases like db config. Read more at https://github.com/odoo/odoo/blob/17.0/odoo/tools/config.py#L448-L484