mirror of
https://github.com/kevinveenbirkenbach/docker-volume-backup.git
synced 2026-08-20 13:12:48 +00:00
Kevin Veen-Birkenbach
f791046c02
36b2336 matched postgres and mariadb against the image's repository path. That name is not a property of the software: a dedicated Postgres inside an app's own stack is tagged <app>-database or postgis/postgis and carries no engine token at all, so it was never recognised, never dumped, and its data directory was copied as files without a single warning - the fallback notice hangs on found_db, which stayed false.
The container is now asked what it can run. pg_dumpall, mariadb-dump and mysqldump are probed by executing them, not by asking a shell for them, because a distroless image has no shell and would deny every tool it ships. The verdict is cached per image ID rather than per container, so replicas of one image cost a single probe.
Because the probe names the tool it found, the dump uses it instead of the hardcoded /usr/bin/mariadb-dump, which makes an image that ships only mysqldump dumpable rather than silently file-copied.
image_name and has_image are gone with their registry-host and tag stripping; the trap they worked around cannot occur when nothing reads the name. get_image_info stays, since the --images-* lists match exact references.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
87 lines
2.6 KiB
Python
87 lines
2.6 KiB
Python
import tempfile
|
|
import unittest
|
|
from unittest.mock import patch
|
|
|
|
import pandas
|
|
|
|
from baudolo.backup import db as db_mod
|
|
|
|
|
|
def _df(rows):
|
|
return pandas.DataFrame(
|
|
rows, columns=["instance", "database", "username", "password"]
|
|
)
|
|
|
|
|
|
def _capture_commands(*, db_type, rows, container, dump_tool="mariadb-dump"):
|
|
captured = []
|
|
|
|
def _capture(cmd):
|
|
captured.append(cmd)
|
|
return []
|
|
|
|
with (
|
|
tempfile.TemporaryDirectory() as td,
|
|
patch.object(db_mod, "execute_shell_command", side_effect=_capture),
|
|
):
|
|
db_mod.backup_database(
|
|
container=container,
|
|
volume_dir=td,
|
|
db_type=db_type,
|
|
dump_tool=dump_tool,
|
|
databases_df=_df(rows),
|
|
database_containers=[container],
|
|
)
|
|
return captured
|
|
|
|
|
|
class TestMariaDBDumpUsesTCP(unittest.TestCase):
|
|
# Regression guard for 'Access denied for user <user>@localhost' when only
|
|
# '<user>'@'%' is granted: the in-container mariadb-dump MUST force TCP so
|
|
# the connection is auth-matched against '%' instead of socket->localhost.
|
|
|
|
def test_mariadb_dump_forces_tcp_loopback(self):
|
|
captured = _capture_commands(
|
|
db_type="mariadb",
|
|
rows=[("mariadb", "appdb", "appuser", "s3cret")],
|
|
container="mariadb",
|
|
)
|
|
dump_cmds = [c for c in captured if "mariadb-dump" in c]
|
|
self.assertEqual(
|
|
len(dump_cmds), 1, f"expected one dump command, got: {captured}"
|
|
)
|
|
|
|
cmd = dump_cmds[0]
|
|
self.assertIn("-h 127.0.0.1", cmd)
|
|
self.assertIn("--protocol=tcp", cmd)
|
|
self.assertIn("-u appuser", cmd)
|
|
self.assertIn("-ps3cret", cmd)
|
|
self.assertIn(" appdb", cmd)
|
|
|
|
def test_the_probed_client_is_the_one_invoked(self):
|
|
captured = _capture_commands(
|
|
db_type="mariadb",
|
|
rows=[("mariadb", "appdb", "appuser", "s3cret")],
|
|
container="mariadb",
|
|
dump_tool="mysqldump",
|
|
)
|
|
dump_cmds = [c for c in captured if "mysqldump" in c]
|
|
self.assertEqual(
|
|
len(dump_cmds), 1, f"expected one dump command, got: {captured}"
|
|
)
|
|
self.assertNotIn("mariadb-dump", dump_cmds[0])
|
|
|
|
def test_postgres_dump_unaffected(self):
|
|
captured = _capture_commands(
|
|
db_type="postgres",
|
|
rows=[("pg", "appdb", "appuser", "s3cret")],
|
|
container="pg",
|
|
)
|
|
dump_cmds = [c for c in captured if "pg_dump" in c and "pg_dumpall" not in c]
|
|
self.assertEqual(len(dump_cmds), 1)
|
|
self.assertNotIn("--protocol=tcp", dump_cmds[0])
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main(verbosity=2)
|