artis3n/pgmodeler

Docker image wrapping pgmodeler/pgmodeler. Unlike other containers I've seen for this project, this container is secure by default. There is no --privileged or any capabilities passed to the container. There is a non-root user. You don't over-expose your Xserver. You get the graphical interface for PGModeler and can save project files to a specified volume for persistence with peace of mind. Best of all, this container weighs just under 400 MB!

Download from GitHub Container Registry:

docker pull ghcr.io/artis3n/pgmodeler:latest

I wrote an article explaining in detail how I set up this container to be secure. Check it out!

Usage

First, discover the location of your .Xauthority file. See the above article for details on what we are doing here if you are not familiar and are interested. Then run the container (dropping all of Docker's default Linux capabilities, as they are not needed).

XAUTHORITY=$(xauth info | grep "Authority file" | awk '{ print $3 }')

docker run --rm --cap-drop=all \
    -e DISPLAY \
    -v /tmp/.X11-unix:/tmp/.X11-unix:ro \
    -v $XAUTHORITY:/home/modeler/.Xauthority:ro \
    ghcr.io/artis3n/pgmodeler:latest

❗ To persist your project data, be sure to mount a directory to /app/savedwork

XAUTHORITY=$(xauth info | grep "Authority file" | awk '{ print $3 }')

docker run --rm --cap-drop=all \
    -e DISPLAY \
    -v /tmp/.X11-unix:/tmp/.X11-unix:ro \
    -v $XAUTHORITY:/home/modeler/.Xauthority:ro \
    -v /persistent/local/directory/for/project:/app/savedwork \
    ghcr.io/artis3n/pgmodeler:latest

Then, while working in PGModeler, be sure to save your project files to /app/savedwork. Done!

OSX Hosts

For OSX hosts, you have to install a Linux-compatible X11 server. The most common option is XQuartz.

The steps are:

1. brew install xauth; brew install --cask xquartz
2. open -a XQuartz
   1. Ensure XQuartz is running whenever you want to run this image.
3. XQuartz preferences -> Security -> check "Allow connections from network clients"
4. Set your DISPLAY appropriately

Note that after changing XQuartz's preferences, you will need to quit and re-open XQuartz for the changes to take effect.

# Check to make sure your WiFi device is en0. If not, replace en0 with the appropriate device.
export DISPLAY=$(ifconfig en0 | grep inet | awk '$1=="inet" {print $2}'):0

Now you can run the container with the regular instructions:

XAUTHORITY=$(xauth info | grep "Authority file" | awk '{ print $3 }')

docker run --rm --cap-drop=all \
    -e DISPLAY \
    -v /tmp/.X11-unix:/tmp/.X11-unix:ro \
    -v $XAUTHORITY:/home/modeler/.Xauthority:ro \
    -v /persistent/local/directory/for/project:/app/savedwork \
    ghcr.io/artis3n/pgmodeler:latest