Skip to content

fix: write Erlang cookie to disk for CLI tool authentication #59

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
paudley merged 1 commit into from
Mar 2, 2026
Merged

fix: write Erlang cookie to disk for CLI tool authentication #59

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions rabbitmq/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,18 @@ export RABBITMQ_MANAGEMENT_PORT="${RABBITMQ_MANAGEMENT_PORT:-15672}"
unset RABBITMQ_DEFAULT_PASS_FILE
unset RABBITMQ_ERLANG_COOKIE_FILE

# Write the cookie to disk so CLI tools (rabbitmqctl, rabbitmq-diagnostics)
# invoked via "docker compose exec" can authenticate with the broker.
# The env var is only visible to PID 1; exec'd shells read the file.
# The file may already exist read-only (0400) from a previous run, so
# widen permissions before overwriting, then lock back down.
cookie_file="${RABBITMQ_MNESIA_DIR:-/var/lib/rabbitmq}/.erlang.cookie"

Copilot AI Mar 2, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cookie location: Erlang CLI tools generally read the cookie from the invoking user’s home directory ("$HOME/.erlang.cookie"). Using RABBITMQ_MNESIA_DIR here can write the cookie somewhere else if that env var is set, which would still break docker compose exec rabbitmqctl .... Consider basing the path on $HOME (or explicitly /var/lib/rabbitmq) instead of the mnesia dir.

Suggested change
cookie_file="${RABBITMQ_MNESIA_DIR:-/var/lib/rabbitmq}/.erlang.cookie"
cookie_file="${HOME:-/var/lib/rabbitmq}/.erlang.cookie"

Copilot uses AI. Check for mistakes.
if [ -f "${cookie_file}" ]; then
chmod 600 "${cookie_file}" 2>/dev/null || true

@gemini-code-assist gemini-code-assist Bot Mar 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Suppressing errors from chmod with 2>/dev/null || true can hide underlying problems, such as incorrect file ownership. This makes debugging more difficult if the script fails later at the printf command. Since the if [ -f ... ] guard on the preceding line already prevents chmod from failing on a non-existent file, the error suppression is not necessary and it's safer to let the script fail immediately if chmod encounters an unexpected error.

Suggested change
chmod 600 "${cookie_file}" 2>/dev/null || true
chmod 600 "${cookie_file}"

fi
printf '%s' "${cookie}" > "${cookie_file}"
chmod 400 "${cookie_file}"
Comment on lines +58 to +60

Copilot AI Mar 2, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The cookie file is created with whatever the current umask allows, and only tightened afterward. That can briefly create a world-readable cookie (e.g., umask 022 -> 0644) during startup. Consider setting a restrictive umask (as done in other entrypoints in this repo) before writing the cookie so it’s never created with broader perms.

Suggested change
fi
printf '%s' "${cookie}" > "${cookie_file}"
chmod 400 "${cookie_file}"
fi
old_umask=$(umask)
umask 077
printf '%s' "${cookie}" > "${cookie_file}"
chmod 400 "${cookie_file}"
umask "${old_umask}"

Copilot uses AI. Check for mistakes.

Comment on lines +56 to +61

Copilot AI Mar 2, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the cookie file already exists and you chmod it to 0600, then a subsequent failure while writing (disk full, permission issue, etc.) will cause the script to exit (set -e) and leave the cookie less restricted than intended. Consider writing via a temporary file + atomic rename and/or using a trap to always restore permissions to 0400 on exit.

Suggested change
if [ -f "${cookie_file}" ]; then
chmod 600 "${cookie_file}" 2>/dev/null || true
fi
printf '%s' "${cookie}" > "${cookie_file}"
chmod 400 "${cookie_file}"
tmp_cookie_file="${cookie_file}.tmp.$$"
printf '%s' "${cookie}" > "${tmp_cookie_file}"
chmod 400 "${tmp_cookie_file}"
mv -f "${tmp_cookie_file}" "${cookie_file}"

Copilot uses AI. Check for mistakes.
entrypoint="/opt/rabbitmq/sbin/docker-entrypoint.sh"
if [ ! -x "${entrypoint}" ]; then
entrypoint="$(command -v docker-entrypoint.sh || true)"
Expand Down
Loading