RABBITMQ_DEFAULT_USER/PASS environment variables not taken into account

[thijscobben]

My docker-setup is:

    mq:
        image: rabbitmq:3.6
        restart: "always"
        ports:
            - "15672"
            - "5672"
        environment:
            - "RABBITMQ_DEFAULT_PASS=pass"
            - "RABBITMQ_DEFAULT_USER=user"
            - "RABBITMQ_DEFAULT_VHOST='vhost'"
        read_only: false
        volumes:
            - "${B2SHARE_DATADIR}/rabbitmq-data:/var/lib/rabbitmq"
        entrypoint:
            - "rabbitmq-server"
            - "--hostname"
            - "mq"

From the docker-compose logs I see:

mq_1             | =INFO REPORT==== 12-Apr-2017::08:27:11 ===
mq_1             | Creating user 'guest'
mq_1             | 
mq_1             | =INFO REPORT==== 12-Apr-2017::08:27:11 ===
mq_1             | Setting user tags for user 'guest' to [administrator]
mq_1             | 
mq_1             | =INFO REPORT==== 12-Apr-2017::08:27:11 ===
mq_1             | Setting permissions for 'guest' in '/' to '.*', '.*', '.*'

when I docker-compose exec mq /bin/bash
I see

root@481b33f49db1:/# env
RABBITMQ_DEFAULT_PASS=pass
RABBITMQ_VERSION=3.6.9
HOSTNAME=481b33f49db1
TERM=xterm
RABBITMQ_DEBIAN_VERSION=3.6.9-1
RABBITMQ_SASL_LOGS=-
PATH=/usr/lib/rabbitmq/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
RABBITMQ_DEFAULT_USER=user
PWD=/
RABBITMQ_LOGS=-
SHLVL=1
HOME=/var/lib/rabbitmq
GOSU_VERSION=1.7
RABBITMQ_DEFAULT_VHOST='vhost'
_=/usr/bin/env

when I do rabbitmqctl list_users I only see the guest user

and when my service (python app) tries to do something with mq it gets (consistent with startup log and rabbitmqctl output) a permission denied.

I would have expected that the default user would not be guest/guest but user/pass. Also, I think that guest user is prevented from accessing other than localhost. This blocks my system. What am I doing wrong? Or can this be fixed?

[tianon]

I can't seem to reproduce:

$ docker pull rabbitmq:3.6
3.6: Pulling from library/rabbitmq
Digest: sha256:9f5536f8bf6243b6dfd74dd9fb13d460f55b8e633d20f9a970c228c61b07f987
Status: Image is up to date for rabbitmq:3.6
$ docker run -it --rm -e RABBITMQ_DEFAULT_USER=user -e RABBITMQ_DEFAULT_PASS=pass -e RABBITMQ_DEFAULT_VHOST=vhost rabbitmq:3.6 rabbitmq-server --hostname mq

              RabbitMQ 3.6.9. Copyright (C) 2007-2016 Pivotal Software, Inc.
  ##  ##      Licensed under the MPL.  See http://www.rabbitmq.com/
  ##  ##
  ##########  Logs: tty
  ######  ##        tty
  ##########
              Starting broker...

...

=INFO REPORT==== 25-Apr-2017::22:04:19 ===
Adding vhost 'vhost'

=INFO REPORT==== 25-Apr-2017::22:04:19 ===
Creating user 'user'

=INFO REPORT==== 25-Apr-2017::22:04:19 ===
Setting user tags for user 'user' to [administrator]

=INFO REPORT==== 25-Apr-2017::22:04:19 ===
Setting permissions for 'user' in 'vhost' to '.*', '.*', '.*'

...

=INFO REPORT==== 25-Apr-2017::22:04:19 ===
Server startup complete; 0 plugins started.

[zoidyzoidzoid]

I think the reporter's environment should be a map, not an array:

        environment:
            RABBITMQ_DEFAULT_PASS: pass
            RABBITMQ_DEFAULT_USER: user
            RABBITMQ_DEFAULT_VHOST: 'vhost'

[Gsantomaggio]

Made a quick test and seems that when you set the entrypoint it does not create the config file:

ex:

   environment:
     - "RABBITMQ_DEFAULT_PASS=pass"
     - "RABBITMQ_DEFAULT_USER=user"
     - "RABBITMQ_DEFAULT_VHOST='vhost'"
    entrypoint:
     - "rabbitmq-server"

result:

root@655f2e427736:/# cat /etc/rabbitmq/rabbitmq.config
cat: /etc/rabbitmq/rabbitmq.config: No such file or directory

removing the endpoint

version: "2"
services:
  mq1:
    image: rabbitmq:3.6
    restart: "always"
    ports:
      - "15672"
      - "5672"
    environment:
     - "RABBITMQ_DEFAULT_PASS=pass"
     - "RABBITMQ_DEFAULT_USER=user"
     - "RABBITMQ_DEFAULT_VHOST='vhost'"

it works

root@9b7a6254462c:/# cat /etc/rabbitmq/rabbitmq.config
[ { rabbit, [
	{ loopback_users, [ ] },
	{ tcp_listeners, [ 5672 ] },
	{ ssl_listeners, [ ] },
	{ default_pass, <<"pass">> },
	{ default_user, <<"user">> },
	{ default_vhost, <<"'vhost'">> },
	{ hipe_compile, false }
] } ].
root@9b7a6254462c:/#

[zoidyzoidzoid]

Oh yeah, totally missed that. That makes sense.

@thijscobben probably meant to override command and not entrypoint.

[stavling]

Hey!

I have a similar problem in my setup. This is my compose file:

services:
  rabbitmq:
    image: "rabbitmq:3-management"
    ports:
      - "5672:5672"
      - "15672:15672"
    environment:
      - RABBITMQ_DEFAULT_PASS=${RABBITMQ_DEFAULT_PASS}
      - RABBITMQ_DEFAULT_USER=${RABBITMQ_DEFAULT_USER}
    hostname: "rabbit_mnesia"
    volumes:
    - ~/docker_compose/d/rabbitdb:/var/lib/rabbitmq/mnesia

The config looks like:

[
    { rabbit, [
        { loopback_users, [ ] },
        { tcp_listeners, [ 5672 ] },
        { ssl_listeners, [ ] },
        { default_pass, <<"correct_password">> },
        { default_user, <<"correct_user">> },
        { hipe_compile, false }
    ] },
    { rabbitmq_management, [ { listener, [
        { port, 15672 },
        { ssl, false }
    ] } ] }
].

I can open up the management-GUI, but I can only login with guest:guest

Docker info:

docker-compose version 1.14.0, build c7bdf9e
docker-py version: 2.3.0
CPython version: 2.7.12
OpenSSL version: OpenSSL 1.0.2j  26 Sep 2016

Running on macOS Sierra, 10.12.5 (16F73)

Anyone have any ideas?

[stavling]

If I bash into the container and manually restart the rabbitmq-node, the config works? Is it possible the the rabbitmq-node starts before the new config is set?

[Jarlotee]

Bump, experiencing this as well, any movement?

[stavling]

@Jarlotee Unfortunately, I don't think I can help. It was a long time ago, and if I remember correctly, it suddenly just started working out of nowhere and I did not dig into it any further.

[tesarm]

@stavling @Jarlotee I fixed this by removing the old container and started everything again.

docker stop rabbitmq && docker rm rabbitmq && docker-compose up

[tianon]

Since the original issue appears solved, I'm going to close.

For further help debugging, I'd recommend trying the Docker Community Forums, the Docker Community Slack, or Stack Overflow. Thanks!

[timabbott]

I ran into what appears to be this exact same problem. If you boot a RabbitMQ container with one value of RABBITMQ_DEFAULT_PASS, stop the container, change that RABBITMQ_DEFAULT_PASS to a new password, and start a new container, then connecting with the old password works, and the new password doesn't. The /etc/rabbitmq/rabbitmq.conf has the new password in it, so that part is working.

This suggests an explanation like #150 (comment), where the container isn't reliable about the ordering between doing configuration and starting rabbitmq.

Can this issue be reopened? I don't think it's been fixed.

[timabbott]

OK, I figured out what's going on here. The RabbitMQ image is storing the RabbitMQ database across restarts, and that's why the password from the first boot is preserved even after one changes the environment. We don't declare any volumes in our config, but I did notice this line in the Dockerfile for the RabbitMQ image:

• https://github.com/docker-library/rabbitmq/blob/master/3.7/debian/Dockerfile#L132

As a result, one has to do e.g. a docker-compose rm rabbitmq after editing the environment variables in order to change the password on the volume.

Here's the docker-compose config I'm using, for reference:
https://github.com/zulip/docker-zulip/blob/master/docker-compose.yml

At the very least, this land mine with changing the credentials for this image should be documented.