From e6b65070999a3c3d46d3786c34ce18bd76bd21bc Mon Sep 17 00:00:00 2001 From: Bitnami Bot Date: Mon, 25 May 2026 17:00:06 +0200 Subject: [PATCH] [bitnami/influxdb] Release 3.9.2-debian-12-r5 (#93989) Signed-off-by: Bitnami Bot --- bitnami/influxdb/3/debian-12/Dockerfile | 4 +- .../rootfs/opt/bitnami/scripts/libinfluxdb.sh | 44 ++++++++++++++++--- 2 files changed, 39 insertions(+), 9 deletions(-) diff --git a/bitnami/influxdb/3/debian-12/Dockerfile b/bitnami/influxdb/3/debian-12/Dockerfile index 78023023638a..586c16e5f2b3 100644 --- a/bitnami/influxdb/3/debian-12/Dockerfile +++ b/bitnami/influxdb/3/debian-12/Dockerfile @@ -7,7 +7,7 @@ ARG DOWNLOADS_URL="downloads.bitnami.com/files/stacksmith" ARG TARGETARCH LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \ - org.opencontainers.image.created="2026-05-23T08:19:23Z" \ + org.opencontainers.image.created="2026-05-25T14:45:46Z" \ org.opencontainers.image.description="Application packaged by Broadcom, Inc." \ org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/influxdb/README.md" \ org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/influxdb" \ @@ -50,7 +50,7 @@ COPY rootfs / RUN /opt/bitnami/scripts/influxdb/postunpack.sh ENV APP_VERSION="3.9.2" \ BITNAMI_APP_NAME="influxdb" \ - IMAGE_REVISION="4" \ + IMAGE_REVISION="5" \ LD_LIBRARY_PATH="/opt/bitnami/python/lib:$LD_LIBRARY_PATH" \ PATH="/opt/bitnami/influxdb/bin:/opt/bitnami/common/bin:$PATH" diff --git a/bitnami/influxdb/3/debian-12/rootfs/opt/bitnami/scripts/libinfluxdb.sh b/bitnami/influxdb/3/debian-12/rootfs/opt/bitnami/scripts/libinfluxdb.sh index 01968054e63f..716d018ab3a0 100644 --- a/bitnami/influxdb/3/debian-12/rootfs/opt/bitnami/scripts/libinfluxdb.sh +++ b/bitnami/influxdb/3/debian-12/rootfs/opt/bitnami/scripts/libinfluxdb.sh @@ -210,12 +210,27 @@ influxdb_create_primary_setup() { --org "${INFLUXDB_ADMIN_ORG}" --bucket "${INFLUXDB_ADMIN_BUCKET}" --username "${INFLUXDB_ADMIN_USER}" - --password "${INFLUXDB_ADMIN_USER_PASSWORD}" --retention "${INFLUXDB_ADMIN_RETENTION}" ) + # Avoid passing credentials as arguments to influx CLI, to avoid leaking them + # given a local observer with /proc read access can read them + # Instead, we can read them from temporary files + local admin_user_password_file + admin_user_password_file="$(mktemp)" + chmod 0600 "$admin_user_password_file" + echo "$INFLUXDB_ADMIN_USER_PASSWORD" > "$admin_user_password_file" + # shellcheck disable=SC2064 + trap "rm -f $admin_user_password_file" RETURN ERR INT TERM + args+=('--password' "$(<"$admin_user_password_file")") if [ -n "${INFLUXDB_ADMIN_USER_TOKEN}" ]; then - args+=('--token' "${INFLUXDB_ADMIN_USER_TOKEN}") + local admin_user_token_file + admin_user_token_file="$(mktemp)" + chmod 0600 "$admin_user_token_file" + echo "$INFLUXDB_ADMIN_USER_TOKEN" > "$admin_user_token_file" + # shellcheck disable=SC2064 + trap "rm -f $admin_user_token_file" RETURN ERR INT TERM + args+=('--token' "$(<"$admin_user_token_file")") fi local setup_command=("$(influxdb_cli_binary)" setup "${args[@]}") @@ -238,7 +253,6 @@ influxdb_run_upgrade() { --org "${INFLUXDB_ADMIN_ORG}" --bucket "${INFLUXDB_ADMIN_BUCKET}" --username "${INFLUXDB_ADMIN_USER}" - --password "${INFLUXDB_ADMIN_USER_PASSWORD}" --retention "${INFLUXDB_ADMIN_RETENTION}" --v2-config-path "${INFLUXDB_CONF_FILE}" --influx-configs-path "${INFLUX_CONFIGS_PATH}" @@ -249,15 +263,31 @@ influxdb_run_upgrade() { --v1-dir "${INFLUXDB_INIT_V1_DIR}" ) + # Avoid passing credentials as arguments to influx CLI, to avoid leaking them + # given a local observer with /proc read access can read them + # Instead, we can read them from temporary files + local admin_user_password_file + admin_user_password_file="$(mktemp)" + chmod 0600 "$admin_user_password_file" + echo "$INFLUXDB_ADMIN_USER_PASSWORD" > "$admin_user_password_file" + # shellcheck disable=SC2064 + trap "rm -f $admin_user_password_file" RETURN ERR INT TERM + args+=('--password' "$(<"$admin_user_password_file")") + if [ -n "${INFLUXDB_ADMIN_USER_TOKEN}" ]; then - args+=('--token' "${INFLUXDB_ADMIN_USER_TOKEN}") + local admin_user_token_file + admin_user_token_file="$(mktemp)" + chmod 0600 "$admin_user_token_file" + echo "$INFLUXDB_ADMIN_USER_TOKEN" > "$admin_user_token_file" + # shellcheck disable=SC2064 + trap "rm -f $admin_user_token_file" RETURN ERR INT TERM + args+=('--token' "$(<"$admin_user_token_file")") fi local logLevel="info" is_boolean_yes "${BITNAMI_DEBUG}" && logLevel="debug" args+=('--log-level' "${logLevel}") - local upgrade_command=("$(influxdb_binary)" upgrade "${args[@]}") am_i_root && upgrade_command=("run_as_user" "$INFLUXDB_DAEMON_USER" "${upgrade_command[@]}") debug_execute "${upgrade_command[@]}" @@ -445,8 +475,8 @@ influxdb3_create_admin_token() { local create_command=("$(influxdb_binary)" "create" "token" "--admin" "--host" "http://127.0.0.1:${INFLUXDB_HTTP_PORT_NUMBER}" "--format" "json") info "Creating admin token..." - "${create_command[@]}" | jq -r ".token" > "$INFLUXDB_AUTOGEN_ADMIN_TOKEN_FILE" - chmod 600 "$INFLUXDB_AUTOGEN_ADMIN_TOKEN_FILE" + install -m 600 /dev/null "$INFLUXDB_AUTOGEN_ADMIN_TOKEN_FILE" + "${create_command[@]}" | jq -r ".token" >> "$INFLUXDB_AUTOGEN_ADMIN_TOKEN_FILE" warn "Auto-generated admin token saved in ${INFLUXDB_AUTOGEN_ADMIN_TOKEN_FILE} for later use. Please, ensure you use it to regenerate it and remove the file afterwards." }