allow to use db user apart from db SA account

[mastertIT]

Allow the ability to use a DB user apart from the SA root mariadb user.

this allows the container to utilize a server on the network without requiring the root SA account (which is a security risk)

[DanielRadlAMR]

First of all, just to clarify:
Sites themselves do not use the root user—they use a site-specific user.

Only bench uses the root user, for example, when creating a new site (i.e., creating a new database).

Therefore, I think the actual security risk here is minimal.

Your usecase is still problematic, but from v16 onwards, you can specify a different DB user with the --db-user flag in bench operations.

[mastertIT]

Is there the ability to declare the db user as an environment variable or not yet?

[DanielRadlAMR]

I’m not sure I fully understand what you mean. From what I understood, you’re not running the DB in a container but instead using an already existing one on the network. Why would you want to set the user and password as environment variables?

You can just use the flag mentioned in the bench commands.

[mastertIT]

correct, running mariadb on the network elsewhere.
however the ability to push the db user and password into the container on a 'compose up' would allow the ability to deploy a new container without additional post config.

from a corp network perspective that's pretty standard. i.e have a db user that has permissions to create tables that isn't the SA root.

[DanielRadlAMR]

As mentioned, a user is created during site creation.
The root user shouldn't be needed from that point on.

[mastertIT]

Still an issue when the root sa is shared with other databases...
Why is there not a way to manually create the user with the correct db permissions and set it as the softwares default db user...

I don't understand why basic role based access control at the backend level isn't taken seriously by the new era of software development

[DanielRadlAMR]

as already mentioned the site uses its own user, NOT the root user

[adithyaappu]

There are site specific users. The username and password of of a site specific DB user is usually stored in the site config JSON. This user will not have access to anything else than the respective site.

Now your question may have a point, if you mean why root user is needed for a specific application. In other words if you mean is it possible to create a non-root user, who will have higher permissions like create db, and use it as the common-admin/default user of Frappe.

I'm not really sure if this is possible, as the document says root user, and I use docker based deployment, so never checked it. But theoretically it may be possible to have a non-root limited user which kind of act as the common-admin/default user. If you have setup for this, can you test and say the if it works?

[mastertIT]

@adithyaappu yes I am setup for this implementation however there isn't an ability to specify the 'root' db user. If there was then this would work and give per application security isolation from access to other databases on the same MySQL server.

[adithyaappu]

Did you try the db-root-username and db-root-password as specified here? https://docs.frappe.io/framework/user/en/bench/reference/new-site#options

[mastertIT]

are these variables able to be presented via docker?
according to the original yaml i don't see that.
in the original dockerfile i see
bench set-config -g db_user $$DB_USER

i could replace that with the below, but i don't see those are allowed for the set config / set common config i.e bench config set-common-config -c

   --db-root-username {user}
   --db-root-password {pass}

just would like to be able to spin up a docker container with a non root sql user and password