Database User Permissions:

MySQL:

CREATE USER 'tenangdb_backup'@'localhost' IDENTIFIED BY 'strong_password_here';
GRANT SELECT, LOCK TABLES, SHOW VIEW, EVENT, TRIGGER ON *.* TO 'tenangdb_backup'@'localhost';
GRANT RELOAD, SUPER ON *.* TO 'tenangdb_backup'@'localhost';
FLUSH PRIVILEGES;

PostgreSQL:

CREATE ROLE tenangdb_backup WITH LOGIN PASSWORD 'strong_password_here';
GRANT pg_read_all_data TO tenangdb_backup;

Directory Permissions:

sudo chmod 640 /etc/tenangdb/config.yaml

Binary Security:

sha256sum /tenangdb

Container runs as non-root user (uid 1001) by default.

Read-only mounts:

volumes:
  - ./config.yaml:/config.yaml:ro

Resource limits in docker-compose:

services:
  tenangdb:
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M

database:
  username: tenangdb_backup
  password: "${TENANGDB_DB_PASSWORD}"

sudo chmod 640 /etc/tenangdb/.my.cnf

database:
  host: localhost
  ssl_mode: "PREFERRED"

# Monitor for errors
tail -f /var/log/tenangdb/tenangdb.log | grep -E "(FAILED|ERROR)"

metrics:
  enabled: true
  port: 8080

• Database User: Created with minimal required privileges
• File Permissions: All files secured
• Container: Runs as non-root user
• Network: Database connections use localhost or secure networks
• Credentials: No plaintext passwords in config files

# Stop the container
docker compose down

# Check logs
docker compose logs tenangdb

# Rotate credentials
# Change database passwords immediately

• MySQL Security Best Practices
• PostgreSQL Security
• Docker Security

Last Updated: 2025-01-06 Version: 1.0