SYSDBA password in SYSDBA.password is a build-time constant shared by all containers of an image #48

Activity

1. fdcastel commented on Sep 26, 2026

   

   fdcastel

   on Sep 26, 2026

   MemberAuthor

   More actions

   This is implemented in #52, and an unofficial test image is available. Feedback from anyone following this issue is welcome.

   Unofficial test image

   ghcr.io/fdcastel/firebird (Debian Trixie, amd64), with tags 5 / 5.0.4, 4 / 4.0.7 and 3 / 3.0.14. It is for testing only: it is built from a branch that combines #52 with #49 (issue #47) and #51 (issue #46).

   How it works

   • If FIREBIRD_ROOT_PASSWORD is set, nothing changes: SYSDBA gets that password.
   • Otherwise, on the container's first start, the entrypoint generates a random 20-character password and sets it for SYSDBA (also with Legacy_UserManager when FIREBIRD_USE_LEGACY_AUTH=true). It stores the password in /opt/firebird/SYSDBA.password, in the same format the Firebird installer uses.
   • The password itself is never printed to the container log. The log only says where it is stored:

     Generating random SYSDBA password.
     SYSDBA password stored in /opt/firebird/SYSDBA.password.
     

   • "First start" is detected by comparing the security database with a checksum recorded at image build time. Restarting the same container keeps its password, and a recreated container gets a new one.
   • A security database that was already changed, for example one bind-mounted by the user, is never touched.
   • Note: Legacy_Auth only checks the first 8 characters of a password (a Firebird limitation).

   Examples

   docker run -d --name fb -p 3050:3050 ghcr.io/fdcastel/firebird:5
   docker logs fb
   docker exec fb cat /opt/firebird/SYSDBA.password
   
   # Restarting keeps the password
   docker restart fb && docker exec fb grep ISC_PASSWORD= /opt/firebird/SYSDBA.password
   
   # A new container gets a different password
   docker run -d --name fb2 ghcr.io/fdcastel/firebird:5
   docker exec fb2 grep ISC_PASSWORD= /opt/firebird/SYSDBA.password

   Connecting with the generated password:

   PW=$(docker exec fb awk -F= '/^ISC_PASSWORD/{print $2}' /opt/firebird/SYSDBA.password)
   docker exec fb bash -c "echo \"CREATE DATABASE 'localhost:/var/lib/firebird/data/test.fdb' USER 'SYSDBA' PASSWORD '$PW';\" | isql -q"

   Please test it with your usual setup (Docker, Compose, Kubernetes, bind-mounted security databases, FIREBIRD_USE_LEGACY_AUTH) and report back here, especially if the password is regenerated when you don't expect it, or is not regenerated when you do.