Rabbitmq: RABBITMQ_DEFAULT_USER/PASS environment variables not taken into account

[thijscobben]

My docker-setup is:

    mq:
        image: rabbitmq:3.6
        restart: "always"
        ports:
            - "15672"
            - "5672"
        environment:
            - "RABBITMQ_DEFAULT_PASS=pass"
            - "RABBITMQ_DEFAULT_USER=user"
            - "RABBITMQ_DEFAULT_VHOST='vhost'"
        read_only: false
        volumes:
            - "${B2SHARE_DATADIR}/rabbitmq-data:/var/lib/rabbitmq"
        entrypoint:
            - "rabbitmq-server"
            - "--hostname"
            - "mq"

From the docker-compose logs I see:

mq_1             | =INFO REPORT==== 12-Apr-2017::08:27:11 ===
mq_1             | Creating user 'guest'
mq_1             | 
mq_1             | =INFO REPORT==== 12-Apr-2017::08:27:11 ===
mq_1             | Setting user tags for user 'guest' to [administrator]
mq_1             | 
mq_1             | =INFO REPORT==== 12-Apr-2017::08:27:11 ===
mq_1             | Setting permissions for 'guest' in '/' to '.*', '.*', '.*'

when I docker-compose exec mq /bin/bash
I see

root@481b33f49db1:/# env
RABBITMQ_DEFAULT_PASS=pass
RABBITMQ_VERSION=3.6.9
HOSTNAME=481b33f49db1
TERM=xterm
RABBITMQ_DEBIAN_VERSION=3.6.9-1
RABBITMQ_SASL_LOGS=-
PATH=/usr/lib/rabbitmq/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
RABBITMQ_DEFAULT_USER=user
PWD=/
RABBITMQ_LOGS=-
SHLVL=1
HOME=/var/lib/rabbitmq
GOSU_VERSION=1.7
RABBITMQ_DEFAULT_VHOST='vhost'
_=/usr/bin/env

when I do rabbitmqctl list_users I only see the guest user

and when my service (python app) tries to do something with mq it gets (consistent with startup log and rabbitmqctl output) a permission denied.

I would have expected that the default user would not be guest/guest but user/pass. Also, I think that guest user is prevented from accessing other than localhost. This blocks my system. What am I doing wrong? Or can this be fixed?

[tianon]

I can't seem to reproduce:

$ docker pull rabbitmq:3.6
3.6: Pulling from library/rabbitmq
Digest: sha256:9f5536f8bf6243b6dfd74dd9fb13d460f55b8e633d20f9a970c228c61b07f987
Status: Image is up to date for rabbitmq:3.6
$ docker run -it --rm -e RABBITMQ_DEFAULT_USER=user -e RABBITMQ_DEFAULT_PASS=pass -e RABBITMQ_DEFAULT_VHOST=vhost rabbitmq:3.6 rabbitmq-server --hostname mq

              RabbitMQ 3.6.9. Copyright (C) 2007-2016 Pivotal Software, Inc.
  ##  ##      Licensed under the MPL.  See http://www.rabbitmq.com/
  ##  ##
  ##########  Logs: tty
  ######  ##        tty
  ##########
              Starting broker...

...

=INFO REPORT==== 25-Apr-2017::22:04:19 ===
Adding vhost 'vhost'

=INFO REPORT==== 25-Apr-2017::22:04:19 ===
Creating user 'user'

=INFO REPORT==== 25-Apr-2017::22:04:19 ===
Setting user tags for user 'user' to [administrator]

=INFO REPORT==== 25-Apr-2017::22:04:19 ===
Setting permissions for 'user' in 'vhost' to '.*', '.*', '.*'

...

=INFO REPORT==== 25-Apr-2017::22:04:19 ===
Server startup complete; 0 plugins started.

[zoidbergwill]

I think the reporter's environment should be a map, not an array:

        environment:
            RABBITMQ_DEFAULT_PASS: pass
            RABBITMQ_DEFAULT_USER: user
            RABBITMQ_DEFAULT_VHOST: 'vhost'

[Gsantomaggio]

Made a quick test and seems that when you set the entrypoint it does not create the config file:

ex:

   environment:
     - "RABBITMQ_DEFAULT_PASS=pass"
     - "RABBITMQ_DEFAULT_USER=user"
     - "RABBITMQ_DEFAULT_VHOST='vhost'"
    entrypoint:
     - "rabbitmq-server"

result:

root@655f2e427736:/# cat /etc/rabbitmq/rabbitmq.config
cat: /etc/rabbitmq/rabbitmq.config: No such file or directory

removing the endpoint

version: "2"
services:
  mq1:
    image: rabbitmq:3.6
    restart: "always"
    ports:
      - "15672"
      - "5672"
    environment:
     - "RABBITMQ_DEFAULT_PASS=pass"
     - "RABBITMQ_DEFAULT_USER=user"
     - "RABBITMQ_DEFAULT_VHOST='vhost'"

it works

root@9b7a6254462c:/# cat /etc/rabbitmq/rabbitmq.config
[ { rabbit, [
    { loopback_users, [ ] },
    { tcp_listeners, [ 5672 ] },
    { ssl_listeners, [ ] },
    { default_pass, <<"pass">> },
    { default_user, <<"user">> },
    { default_vhost, <<"'vhost'">> },
    { hipe_compile, false }
] } ].
root@9b7a6254462c:/#

[zoidbergwill]

Oh yeah, totally missed that. That makes sense.

@thijscobben probably meant to override command and not entrypoint.

[stavling]

Hey!

I have a _similar_ problem in my setup. This is my compose file:

services:
  rabbitmq:
    image: "rabbitmq:3-management"
    ports:
      - "5672:5672"
      - "15672:15672"
    environment:
      - RABBITMQ_DEFAULT_PASS=${RABBITMQ_DEFAULT_PASS}
      - RABBITMQ_DEFAULT_USER=${RABBITMQ_DEFAULT_USER}
    hostname: "rabbit_mnesia"
    volumes:
    - ~/docker_compose/d/rabbitdb:/var/lib/rabbitmq/mnesia

The config looks like:

[
    { rabbit, [
        { loopback_users, [ ] },
        { tcp_listeners, [ 5672 ] },
        { ssl_listeners, [ ] },
        { default_pass, <<"correct_password">> },
        { default_user, <<"correct_user">> },
        { hipe_compile, false }
    ] },
    { rabbitmq_management, [ { listener, [
        { port, 15672 },
        { ssl, false }
    ] } ] }
].

I can open up the management-GUI, but I can only login with guest:guest

Docker info:

docker-compose version 1.14.0, build c7bdf9e
docker-py version: 2.3.0
CPython version: 2.7.12
OpenSSL version: OpenSSL 1.0.2j  26 Sep 2016

Running on macOS Sierra, 10.12.5 (16F73)

Anyone have any ideas?

[stavling]

If I bash into the container and manually restart the rabbitmq-node, the config works? Is it possible the the rabbitmq-node starts before the new config is set?

[Jarlotee]

Bump, experiencing this as well, any movement?

[stavling]

@Jarlotee Unfortunately, I don't think I can help. It was a long time ago, and if I remember correctly, it suddenly just started working out of nowhere and I did not dig into it any further.

[tesarm]

@stavling @Jarlotee I fixed this by removing the old container and started everything again.

docker stop rabbitmq && docker rm rabbitmq && docker-compose up

[tianon]

Since the original issue appears solved, I'm going to close.

For further help debugging, I'd recommend trying the Docker Community Forums, the Docker Community Slack, or Stack Overflow. Thanks!

[timabbott]

I ran into what appears to be this exact same problem. If you boot a RabbitMQ container with one value of RABBITMQ_DEFAULT_PASS, stop the container, change that RABBITMQ_DEFAULT_PASS to a new password, and start a new container, then connecting with the old password works, and the new password doesn't. The /etc/rabbitmq/rabbitmq.conf has the new password in it, so that part is working.

This suggests an explanation like https://github.com/docker-library/rabbitmq/issues/150#issuecomment-314987897, where the container isn't reliable about the ordering between doing configuration and starting rabbitmq.

Can this issue be reopened? I don't think it's been fixed.

[timabbott]

OK, I figured out what's going on here. The RabbitMQ image is storing the RabbitMQ database across restarts, and that's why the password from the first boot is preserved even after one changes the environment. We don't declare any volumes in our config, but I did notice this line in the Dockerfile for the RabbitMQ image:

• https://github.com/docker-library/rabbitmq/blob/master/3.7/debian/Dockerfile#L132

As a result, one has to do e.g. a docker-compose rm rabbitmq after editing the environment variables in order to change the password on the volume.

Here's the docker-compose config I'm using, for reference:
https://github.com/zulip/docker-zulip/blob/master/docker-compose.yml

At the very least, this land mine with changing the credentials for this image should be documented.

[TheFonz2017]

I think, this is still an issue. I am facing similar problems, when I am overriding the CMD.
The /etc/rabbitmq/rabbit.conf is not created and hence the default user and password are not available for login via the Web UI.

My docker-compose.yml is as follows:

---
version: '2.3'

#################################################################################
#    For more information on the syntax and features of docker-compose files,   #
#    see: https://docs.docker.com/compose/compose-file/                         #
#################################################################################

# Declaration of the network nodes.
services:
    rabbit-1:
        build: 
          context: .                                       # directory to build from.
          dockerfile: Dockerfile-rabbit                    # Dockerfile name for rabbit container.
        command:  bash -c 'ip route add 172.2.0.0/16 via 172.1.0.2 && ip route add 172.3.0.0/16 via 172.1.0.2 && rabbitmq-server'
        privileged: true                                   # required so that routing tables can be manipulated.
        hostname: rabbit-1                                 # hostname will be used by RabbitMQ to name the server instance.
        ports:
            - "7777:15672"                                 # map local port 7777 to the web management console's internal port 15672
        volumes:                                           # mount files into rabbit containers.
            - type: bind
              source: ./enabled_plugins                    # mount enabled_plugins file into rabbit 
              target: /etc/rabbitmq/enabled_plugins        # for inspection at startup.
        environment:
            RABBITMQ_DEFAULT_VHOST: rabbit-vhost-1         # Change default Vhost name of RabbitMQ server.
            RABBITMQ_DEFAULT_USER: test                    # Default user name (for management console).
            RABBITMQ_DEFAULT_PASS: test1234                # Default password (for management console).
            #RABBITMQ_ERLANG_COOKIE: 'secret cookie here'  # Erlang Cookie for Clustering. See: https://www.rabbitmq.com/clustering.html#erlang-cookie.
            #RABBITMQ_HIPE_COMPILE: 1                      # Enable HiPE compiler - pre-compiling parts of RabbitMQ in a JIT fashion to speed up throughput
        networks:
            network-1:
                ipv4_address: 172.1.0.3

    rabbit-2:
        build:                                              
          context: .                                       # directory to build from.
          dockerfile: Dockerfile-rabbit                    # Dockerfile name for rabbit container.
        command: bash -c 'ip route add 172.1.0.0/16 via 172.2.0.2 && ip route add 172.3.0.0/16 via 172.2.0.2 && rabbitmq-server'
        privileged: true                                   # required so that routing tables can be manipulated.
        hostname: rabbit-2                                 # hostname will be used by RabbitMQ to name the server instance.
        ports:
            - "7778:15672"                                 # map local port 7778 to the web management console's internal port 15672
        volumes:                                           # mount files into rabbit containers.
            - type: bind
              source: ./enabled_plugins                    # mount enabled_plugins file into rabbit 
              target: /etc/rabbitmq/enabled_plugins        # for inspection at startup.
        environment:
            RABBITMQ_DEFAULT_VHOST: rabbit-vhost-2         # Change default Vhost name of RabbitMQ server.
            RABBITMQ_DEFAULT_USER: test                    # Default user name (for management console).
            RABBITMQ_DEFAULT_PASS: test1234                # Default password (for management console).
            #RABBITMQ_ERLANG_COOKIE: 'secret cookie here'  # Erlang Cookie for Clustering. See: https://www.rabbitmq.com/clustering.html#erlang-cookie.
            #RABBITMQ_HIPE_COMPILE: 1                      # Enable HiPE compiler - pre-compiling parts of RabbitMQ in a JIT fashion to speed up throughput
        networks:
            network-2:
                ipv4_address: 172.2.0.3

    rabbit-3:
        build: 
          context: .                                       # directory to build from.
          dockerfile: Dockerfile-rabbit                    # Dockerfile name for rabbit container.
        command: bash -c 'ip route add 172.1.0.0/16 via 172.3.0.2 && ip route add 172.2.0.0/16 via 172.3.0.2 && rabbitmq-server'
        privileged: true                                   # required so that routing tables can be manipulated.
        hostname: rabbit-3                                 # hostname will be used by RabbitMQ to name the server instance.
        ports:
            - "7779:15672"                                 # map local port 7777 to the web management console's internal port 15672
        volumes:                                           # mount files into rabbit containers.
            - type: bind
              source: ./enabled_plugins                    # mount enabled_plugins file into rabbit 
              target: /etc/rabbitmq/enabled_plugins        # for inspection at startup.
        environment:
            RABBITMQ_DEFAULT_VHOST: rabbit-vhost-3         # Change default Vhost name of RabbitMQ server.
            RABBITMQ_DEFAULT_USER: test                    # Default user name (for management console).
            RABBITMQ_DEFAULT_PASS: test1234                # Default password (for management console).
            #RABBITMQ_ERLANG_COOKIE: 'secret cookie here'  # Erlang Cookie for Clustering. See: https://www.rabbitmq.com/clustering.html#erlang-cookie.
            #RABBITMQ_HIPE_COMPILE: 1                      # Enable HiPE compiler - pre-compiling parts of RabbitMQ in a JIT fashion to speed up throughput
        networks:
            network-3:
                ipv4_address: 172.3.0.3

    router:
        build:
            context: .                                     # directory to build from.
            dockerfile: Dockerfile-router                  # Dockerfile of the router container.
        tty: true                                          # required to keep the container from exiting immediately.
        privileged: true                                   # required so that routing tables can be manipulated.
        networks:
            network-1:
                ipv4_address: 172.1.0.2
            network-2:
                ipv4_address: 172.2.0.2
            network-3:
                ipv4_address: 172.3.0.2

# Declaration of the networks. 
# These are referenced by the nodes above.
networks:
    network-1:
        driver: "bridge"
        ipam:
            config:
                - subnet: 172.1.0.0/16
                  gateway: 172.1.0.1
    network-2:
        driver: "bridge"
        ipam:
            config:
                - subnet: 172.2.0.0/16
                  gateway: 172.2.0.1
    network-3:
        driver: "bridge"
        ipam:
            config:
                - subnet:  172.3.0.0/16
                  gateway: 172.3.0.1

Funny enough, rabbitmq-server still starts the server, but running it from a shell command (like given above) will not create the rabbit config file. Could this be an issue with the entrypoint script?
If I specify the command in my compose file like this:

command: ["rabbitmq-server"]

... evth. works fine. But then I cannot execute the other commands (ip route add etc. as shown above).

In any case, I think this behaviour is rather unexpected and seems more like a bug.
I think this should be reopened.

EDIT:
I can definitely confirm that this has to do with the docker-entrypoint.sh script.
Using the following in my docker-compose.yml (without any command:) works:

entrypoint: ["bash", "-c", "ip route add 172.2.0.0/16 via 172.1.0.2 && ip route add 172.3.0.0/16 via 172.1.0.2 && docker-entrypoint.sh rabbitmq-server"]  

Note, that I am executing commands before the startup of rabbitmq-server and then execute the docker-entrypoint.sh together with rabbitmq-server.

Still, this is not really ideal.

[tianon]

What you've discovered is exactly the expected behavior. The docker-entrypoint.sh script is responsible for all the additional behavior provided by this image, and it only does anything if the command is rabbitmq-server (so that folks trying to run bash or the like don't get a container that fails to start due to some random environment variable issue).

So your fix is exactly correct (re-executing docker-entrypoint.sh) for how you're trying to run the application (if the behavior provided by this image is something you want applied).

[TheFonz2017]

Well, good to know, thanks. Maybe this should be documented somewhere.
Although, it is now documented here... ;)
Cheers!

[Joe-Heffer-Shef]

I fixed this problem by deleting the RabbitMQ docker volume on the host machine and rebuilding/restarting the image/container. It appears the user info is stored in the persistent settings files somehow.