MIME-Version: 1.0
References: <31b00cee-fc14-4872-aef1-f6151c7cd1ee@comcast.net>
In-Reply-To: <31b00cee-fc14-4872-aef1-f6151c7cd1ee@comcast.net>
From: =?UTF-8?Q?Roland_M=C3=BCller?= <rolmur@gmail.com>
Date: Tue, 14 Apr 2026 08:51:59 +0300
Message-ID: 
 <CA+8p0G2gDTZTqAV6d-5oEVc7i-ZgASqCCPWXUH+2CocVTLY=Ug@mail.gmail.com>
Subject: Re: sslmode - detecting local docker
To: AJ Weber <aweber@comcast.net>
Cc: pgsql-admin@lists.postgresql.org
Content-Type: multipart/alternative; boundary="00000000000055168a064f65337f"
Archived-At: 
 <https://www.postgresql.org/message-id/CA%2B8p0G2gDTZTqAV6d-5oEVc7i-ZgASqCCPWXUH%2B2CocVTLY%3DUg%40mail.gmail.com>
Precedence: bulk

--00000000000055168a064f65337f
Content-Type: text/plain; charset="UTF-8"

With docker or podman you can list the networks and inspect them one by one
to get their subnets. This information could then be used in pg_hba.conf.

E.g. using podman , docker should be the same except name of the command:

$ podman network ls
NETWORK ID    NAME        DRIVER
2f259bab93aa  podman      bridge
$podman inspect  2f259bab93aa
...
          "subnets": [
               {
                    "subnet": "SOME_IP_NET/SOME_MASK",
                    "gateway": "SOME_IP_ADDR"
               }
          ],
...

Am Mo., 13. Apr. 2026 um 16:09 Uhr schrieb AJ Weber <aweber@comcast.net>:

> I'm trying to configure my custom JDBC connection to be as safe as
> practical.
>
> Years gone by, I would simply check if the URL (configured-property) had
> "localhost" in it, and do nothing. Recently I decided I'd check for
> localhost AND see if any "ssl" was explicitly already set in the URL.
> If not, I tried adding ssl=true as a connection param.  This fails when
> using a postgresql docker container, because they typically are not
> configured for SSL, but the hostname is also not "localhost".
>
> Besides changing my logic to add "sslmode=prefer" (instead of "true",
> which may be the default anyway), does anyone have a good way to
> determine if the JDBC URL is actually a docker container running on the
> same host?
>
> Currently running v16.x, but these modes haven't changed in a long time,
> so I suppose this question applies across currently supported versions.
>
> Thanks in advance,
>
> AJ
>
>
>
>

--00000000000055168a064f65337f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div>With docker or podman you can list t=
he networks and inspect them one by one to get their subnets. This informat=
ion could then be used in=C2=A0pg_hba.conf.</div><div><br></div><div>E.g. u=
sing podman , docker should be the same except name of the command:</div><d=
iv><br></div><div>$ podman network ls</div><div>NETWORK ID =C2=A0 =C2=A0NAM=
E =C2=A0 =C2=A0 =C2=A0 =C2=A0DRIVER<br>2f259bab93aa =C2=A0podman =C2=A0 =C2=
=A0 =C2=A0bridge<br></div><div>$podman inspect=C2=A0
2f259bab93aa</div><div>...</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 &qu=
ot;subnets&quot;: [<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0{<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 &quot;subnet&quot;: &quot;SOME_IP_NET/SOME_MASK&quot;,<br>=C2=A0 =C2=A0=
 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 &quot;gateway&quot=
;: &quot;SOME_IP_ADDR&quot;<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0}<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ],<br>...</div></div><=
br><div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=
=3D"gmail_attr">Am Mo., 13. Apr. 2026 um 16:09=C2=A0Uhr schrieb AJ Weber &l=
t;<a href=3D"mailto:aweber@comcast.net">aweber@comcast.net</a>&gt;:<br></di=
v><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;borde=
r-left:1px solid rgb(204,204,204);padding-left:1ex">I&#39;m trying to confi=
gure my custom JDBC connection to be as safe as <br>
practical.<br>
<br>
Years gone by, I would simply check if the URL (configured-property) had <b=
r>
&quot;localhost&quot; in it, and do nothing. Recently I decided I&#39;d che=
ck for <br>
localhost AND see if any &quot;ssl&quot; was explicitly already set in the =
URL.=C2=A0 <br>
If not, I tried adding ssl=3Dtrue as a connection param.=C2=A0 This fails w=
hen <br>
using a postgresql docker container, because they typically are not <br>
configured for SSL, but the hostname is also not &quot;localhost&quot;.<br>
<br>
Besides changing my logic to add &quot;sslmode=3Dprefer&quot; (instead of &=
quot;true&quot;, <br>
which may be the default anyway), does anyone have a good way to <br>
determine if the JDBC URL is actually a docker container running on the <br=
>
same host?<br>
<br>
Currently running v16.x, but these modes haven&#39;t changed in a long time=
, <br>
so I suppose this question applies across currently supported versions.<br>
<br>
Thanks in advance,<br>
<br>
AJ<br>
<br>
<br>
<br>
</blockquote></div></div>

--00000000000055168a064f65337f--