本地部署Keycloak时Docker容器PostgreSQL角色认证错误求助

我通过命令sudo docker-compose -f file_name.yaml up --build启动本地Keycloak服务器，使用的docker-compose配置如下：

version: "3.9"
services:
  keycloak-postgres:
    image: library/postgres:${KC_POSTGRES_IMAGE_TAG:-14}
    container_name: ${POSTGRES_CONTAINER_NAME:-postgres}
    restart: on-failure
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: postgres
    healthcheck:
      test: pg_isready -d postgres
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 5s
    ports:
      - ${KC_POSTGRES_PORT_MAPPING:-5435}:5432
    deploy:
      resources:
        limits:
          memory: 256M

  keycloak:
    image: quay.io/keycloak/keycloak:20.0.2
    container_name: keycloak
    command:
      - start --auto-build --db postgres --hostname-strict-https false --hostname-strict false --proxy edge --http-enabled true --import-realm --spi-user-profile-legacy-user-profile-read-only-attributes *_RES_ACCESS_MODE
    environment:
      KC_DB_URL: jdbc:postgresql://keycloak-postgres:5432/postgres
      KC_DB_USERNAME: postgres
      KC_DB_PASSWORD: postgres
      KC_DB_SCHEMA: public
      KC_FEATURES: preview
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
    volumes:
      - type: bind
        source: ./realm-export.json
        target: /opt/keycloak/data/import/realm-export.json
        read_only: true
    ports:
      - 8282:8080
    depends_on:
      keycloak-postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://0.0.0.0:8080/realms/master"]
      start_period: 10s
      interval: 30s
      retries: 3
      timeout: 5s

启动过程中出现错误，关键日志如下：

postgres  | 2024-04-11 21:54:28.799 UTC [1] LOG:  database system is ready to accept connections
postgres  | 2024-04-11 21:54:38.880 UTC [42] FATAL:  role "root" does not exist
...
recovery is not enabled. Please enable transaction recovery by setting quarkus.transaction-manager.enable-recovery=true, otherwise data may be lost if the application is terminated abruptly
postgres  | 2024-04-11 21:54:43.032 UTC [43] FATAL:  password authentication failed for user "postgres"
postgres  | 2024-04-11 21:54:43.032 UTC [43] DETAIL:  Role "postgres" does not exist.
postgres  |     Connection matched pg_hba.conf line 100: "host all all all scram-sha-256"
keycloak  | 2024-04-11 21:54:43,035 WARN  [io.agroal.pool] (agroal-11) Datasource '<default>': FATAL: password authentication failed for user "postgres"

我已检查宿主机本地PostgreSQL的角色列表，确认postgres角色存在：

mypc=# \du
                                     List of roles
  Role name   |                         Attributes                         | Member of 
--------------+------------------------------------------------------------+-----------
 mypc | Superuser, Create role, Create DB, Replication, Bypass RLS | {}
 postgres     | Superuser                                                  | {}
 root         | Superuser                                                  | {}

同时执行了修改密码的操作：

ALTER USER postgres WITH PASSWORD 'postgres';

但问题仍未解决，请求帮助。

解决方案 #

1. 清理Docker PostgreSQL容器的持久化数据 #

你检查的是宿主机的PostgreSQL，而docker-compose中使用的是独立的PostgreSQL容器，两者完全隔离。容器内的PostgreSQL可能因旧数据卷残留导致初始化异常，执行以下命令清理后重新启动：

# 停止并移除容器
sudo docker-compose -f file_name.yaml down
# 删除PostgreSQL相关数据卷（会清除容器内所有数据，谨慎操作）
sudo docker volume rm $(sudo docker volume ls -q | grep -E 'postgres|keycloak-postgres')
# 重新构建并启动容器
sudo docker-compose -f file_name.yaml up --build

2. 修正PostgreSQL健康检查命令 #

当前健康检查未指定用户，默认使用root连接导致报错，修改健康检查配置：

healthcheck:
  test: pg_isready -U postgres -d postgres
  interval: 10s
  timeout: 5s
  retries: 3
  start_period: 5s

3. 验证环境变量未被覆盖 #

检查是否有环境变量覆盖了容器的初始化配置：

echo $KC_POSTGRES_IMAGE_TAG $POSTGRES_CONTAINER_NAME $KC_POSTGRES_PORT_MAPPING

若输出非空，确认这些值不会导致容器初始化异常，例如POSTGRES_CONTAINER_NAME是否与其他容器冲突。

4. 确认容器网络连通性 #

docker-compose默认会为服务创建专属网络，Keycloak容器通过服务名keycloak-postgres访问PostgreSQL容器，可进入Keycloak容器测试连通性：

# 进入Keycloak容器
sudo docker exec -it keycloak /bin/bash
# 安装ping工具（若未安装）
microdnf install iputils
# 测试PostgreSQL容器连通性
ping keycloak-postgres

内容的提问来源于stack exchange，提问作者mascai