gokrazy-postgres

A gokrazy appliance that runs PostgreSQL 17 (Alpine) in a podman container. PostgreSQL listens only on a Unix socket — no TCP, no exposed ports.

How it works

On startup the program:

1. Creates /perm/postgres-data (survives reboots) and /run/postgresql (socket dir)
2. Removes any leftover container from a previous boot
3. Pulls docker.io/library/postgres:17-alpine (cached after the first pull)
4. Starts the container with --network none, mounting both directories
5. Polls the Unix socket until PostgreSQL is ready
6. Blocks until SIGTERM/SIGINT, then runs podman stop --time 10 for a clean shutdown

Configuration

Environment variables prefixed with POSTGRES_ are forwarded to the container. Any value starting with file: is replaced by the contents of that file, keeping secrets off the command line:

POSTGRES_USER=miniflux
POSTGRES_PASSWORD=file:/perm/secrets/pg-password
POSTGRES_DB=miniflux

Flag	Default	Description
-image	docker.io/library/postgres:17-alpine	Container image to pull and run