How to enable authentication on MongoDB through Docker

Question

I want to spin-up a docker for mongodb latest but allow only certain user s  to access certain db s   i e  enable --auth   No one else should access mongodb whatsoever  How should I do this as part of the docker initiation   BTW  data directory sits on the host by utilising the following command during initiation  -v  my own datadir  data db

User · Answer

The Dockerfile for the official mongo image is here. The default command is mongod but you can override to add the --auth switch assuming user's are already configured.

docker run -d .... mongodb:latest mongod --auth

If the user has to be created then you need to volume mount a startup script into /entrypoint.sh to replace the default startup script and then have that script create users and start mongo with the auth switch.

docker run -d .... -v $PWD/my_custom_script.sh:/entrypoint.sh mongodb:latest

User · Answer

a  You can use environment variables via terminal     docker run -d --name container name         -e MONGO INITDB ROOT USERNAME admin         -e MONGO INITDB ROOT PASSWORD password         mongo   If you like to test if everything works      ssh into the running container    Change container name if necessary   docker exec -it mongo  bin bash     Enter into mongo shell   mongo     Caret will change when you enter successfully    Switch to admin database   gt  use admin   gt  db auth  admin   passwordPrompt        Show available databases   gt  show dbs   If you like to instantiate a database on first run  check option b   b  You can use environment variables in your docker stack deploy file or compose file for versions 3 4 through 4 1   As it is explained on the quick reference section of the official mongo image set MONGO INITDB ROOT USERNAME and MONGO INITDB ROOT PASSWORD in your yaml file   mongo      image  mongo     environment        MONGO INITDB ROOT USERNAME  admin       MONGO INITDB ROOT PASSWORD  password   docker-entrypoint sh file in mongo image checks for the existence of these two variables and sets --auth flag accordingly   c  You can also use docker secrets   MONGO INITDB ROOT USERNAME and MONGO INITDB ROOT PASSWORD is set indirectly by docker-entrypoint sh from MONGO INITDB ROOT USERNAME FILE and MONGO INITDB ROOT PASSWORD FILE variables   mongo      image  mongo     environment          - MONGO INITDB ROOT USERNAME FILE  run secrets db root username         - MONGO INITDB ROOT PASSWORD FILE  run secrets db root password     secrets        - db root username       - db root password   docker-entrypoint sh converts MONGO INITDB ROOT USERNAME FILE and MONGO INITDB ROOT PASSWORD FILE to MONGO INITDB ROOT USERNAME and MONGO INITDB ROOT PASSWORD    You can use MONGO INITDB ROOT USERNAME and MONGO INITDB ROOT PASSWORD in your  sh or  js scripts in docker-entrypoint-initdb d folder while initializing database instance   When a container is started for the first time it will execute files with extensions  sh and  js that are found in  docker-entrypoint-initdb d  Files will be executed in alphabetical order   js files will be executed by mongo using the database specified by the MONGO INITDB DATABASE variable  if it is present  or test otherwise  You may also switch databases within the  js script   This last method is not in the reference docs  so it may not survive an update

User · Answer

I want to comment but don t have enough reputation   The user-adding executable script shown above has to be modified with  --authenticationDatabase admin and NEWDATABASENAME   mongo --authenticationDatabase admin --host localhost -u USER PREVIOUSLY DEFINED -p PASS YOU PREVIOUSLY DEFINED NEWDATABASENAME --eval  db createUser  user   NEWUSERNAME   pwd   PASSWORD   roles    role   readWrite   db   NEWDATABASENAME          https   i stack imgur com MdyXo png

User · Answer

Better solutions for furthering    https   blog madisonhub org setting-up-a-mongodb-server-with-auth-on-docker    https   docs mongodb com v2 6 tutorial add-user-administrator    Here s what I did for the same problem  and it worked    Run the mongo docker instance on your server  docker run -d -p 27017 27017 -v   dataMongo  data db mongo  Open bash on the running docker instance   docker ps      CONTAINER IDIMAGE   COMMAND  CREATED STATUS  PORTS  NAMES      b07599e429fb   mongo    docker-entrypoint       35 minutes ago  Up 35 minutes   0 0 0 0 27017- 27017 tcp   musing stallman   docker exec -it b07599e429fb bash root b07599e429fb      Reference- https   github com arunoda meteor-up-legacy wiki Accessing-the-running-Mongodb-docker-container-from-command-line-on-EC2 Enter the mongo shell by typing mongo   root b07599e429fb    mongo  For this example  I will set up a user named ian and give that user read  amp  write access to the cool db database    gt  use cool db   gt  db createUser       user   ian       pwd   secretPassword       roles     role   readWrite   db  cool db         Reference  https   ianlondon github io blog mongodb-auth   First point only  Exit from mongod shell and bash  Stop the docker instance using the below command   docker stop mongo  Now run the mongo docker with auth enabled   docker run -d -p 27017 27017 -v   dataMongo  data db mongo mongod --auth   Reference  How to enable authentication on MongoDB through Docker   Usman Ismail s answer to this question  I was able to connect to the instance running on a Google Cloud server from my local windows laptop using the below command   mongo  lt ip gt  27017 cool db -u ian -p secretPassword   Reference  how can I connect to a remote mongo server from Mac OS terminal

User · Answer

jbochniak  Thanks  although at first read I thought I ve already discovered all of this  it turned out that your example  esp  the version of the Mongo Docker image  helped me out   That version  v3 4 2  and the v3 4  currently corresponding to v3 4 3  still support  MONGO INITDB ROOT  specified through those variables  as of v3 5  at least tags  3  and  latest   DON T work as described in your answer and in the docs   I quickly had a look at the code on GitHub  but saw similar usage of these variables and couldn t find the bug immediately  should do so before filing this as a bug

User · Answer

Just dropping a  js file into the entry point init folder works for this  e g  entrypoint js  var db   connect  mongodb   localhost admin     db createUser                user   yourAdminUserName           pwd   yourAdminPassword           roles      role   userAdminAnyDatabase   db   admin                docker-compose yml   db    image  mongo 3 2   volumes     -  my own datadir  data db    -    mongo-entrypoint  docker-entrypoint-initdb d   Doing the rest by hand or more of the same works   If you want to you can also drop a  sh file into the init folder to clean up the files so they are not laying around  zz-cleanup sh

User · Answer

use this images to fix   With docker-compose yml  services    db      image  aashreys mongo-auth latest     environment        - AUTH yes       - MONGODB ADMIN USER admin       - MONGODB ADMIN PASS admin123       - MONGODB APPLICATION DATABASE sample       - MONGODB APPLICATION USER aashrey       - MONGODB APPLICATION PASS admin123     ports        -  27017 27017          more configuration    aashreys mongo-auth - Docker Hub aashreys docker-mongo-auth  Easily setup authentication on Docker s Official MongoDB image

User · Answer

I have hard time when trying to   Create other db than admin Add new users and enable authentication to the db above   So I made 2020 answer here  My directory looks like this   -- docker-compose yml  -- mongo-entrypoint      -- entrypoint js   My docker-compose yml looks like this  version   3 4  services    mongo-container        If you need to connect to your db from outside this container      network mode  host     image  mongo 4 2     environment          - MONGO INITDB ROOT USERNAME admin         - MONGO INITDB ROOT PASSWORD pass     ports        -  27017 27017      volumes        -   PWD mongo-entrypoint   docker-entrypoint-initdb d       command  mongod   Please change admin and pass with your need   Inside mongo-entrypoint  I have entrypoint js file with this content   var db   connect  mongodb   admin pass localhost 27017 admin     db   db getSiblingDB  new db       we can not use  use  statement here to switch db  db createUser                user   user           pwd   pass           roles      role   readWrite   db   new db              passwordDigestor   server             Here again you need to change admin pass to your root mongo credentials in your docker-compose yml that you stated before  In additional you need to change new db  user  pass to your new database name and credentials that you need   Now you can   docker-compose up -d   And connect to this db from localhost  please note that I already have mongo cli  you can install it or you can exec to the container above to use mongo command   mongo new db -u user -p pass   Or you can connect from other computer  mongo host 27017 new db -u user -p pass   My git repository  https   github com sexydevops docker-compose-mongo  Hope it can help someone  I lost my afternoon for this

User · Answer

If you take a look at    https   github com docker-library mongo blob master 4 2 Dockerfile https   github com docker-library mongo blob master 4 2 docker-entrypoint sh L303-L313   you will notice that there are two variables used in the docker-entrypoint sh    MONGO INITDB ROOT USERNAME MONGO INITDB ROOT PASSWORD   You can use them to setup root user  For example you can use following docker-compose yml file   mongo-container    image  mongo 3 4 2   environment          provide your credentials here       - MONGO INITDB ROOT USERNAME root       - MONGO INITDB ROOT PASSWORD rootPassXXX   ports      -  27017 27017    volumes          if you wish to setup additional user accounts specific per DB or with different roles you can use following entry point     -   PWD mongo-entrypoint   docker-entrypoint-initdb d       no --auth is needed here as presence of username and password add this option automatically   command  mongod   Now when starting the container by docker-compose up you should notice following entries       I CONTROL   initandlisten  options    net    bindIp   127 0 0 1     processManagement    fork  true    security    authorization   enabled     systemLog    destination   file   path    proc 1 fd 1          I ACCESS    conn1  note  no users configured in admin system users  allowing localhost access     Successfully added user         user     root        roles                             role     root                db     admin                      To add custom users apart of root use the entrypoint exectuable script  placed under  PWD mongo-entrypoint dir as it is mounted in docker-compose to entrypoint       usr bin env bash echo  Creating mongo users     mongo admin --host localhost -u USER PREVIOUSLY DEFINED -p PASS YOU PREVIOUSLY DEFINED --eval  db createUser  user   ANOTHER USER   pwd   PASS   roles    role   readWrite   db   xxx       db createUser  user   admin   pwd   PASS   roles    role   userAdminAnyDatabase   db   admin        echo  Mongo users created     Entrypoint script will be executed and additional users will be created

User · Answer

you can use env variables to setup username and password for mongo MONGO INITDB ROOT USERNAME MONGO INITDB ROOT PASSWORD  using simple docker command docker run -e MONGO INITDB ROOT USERNAME my-user MONGO INITDB ROOT PASSWORD my-password mongo  using docker-compose version   3 1   services     mongo      image  mongo     restart  always     environment        MONGO INITDB ROOT USERNAME  my-user       MONGO INITDB ROOT PASSWORD  my-password  and the last option is to manually access the container and set the user and password inside the mongo docker container docker exec -it mongo-container bash  now you can use mongo shell command to configure everything that you want

[mongodb] How to enable authentication on MongoDB through Docker?

Examples related to mongodb

Examples related to docker