⏲️ Timescale Cloud in Docker 🐋

A Docker image to ease local development of a Timescale Cloud-hosted database.

The Timescale Cloud service exhibits behaviors which differ from the official Docker images in ways that can make it difficult to reproduce for local development. The Timescale Cloud service does far more than can fit into a single Docker image, so this project is a best-effort mock to minimize "but it worked on my machine!" errors.

Here at Everactive, we use this image both for developing the database itself (we use sqitch for migrations-as-code), and for creating local mocks of that database when developing against it (e.g. for our Public API). We could instead use forks of live databases, but we like our Docker-based workflows and the ability to easily blow away and recreate a local instance. This lets us iterate much more quickly, particularly when writing migrations.

Timescale Cloud has two categories of non-standard behavior we're concerned with:

• it does not provide access to a true SUPERUSER role, but rather a role tsdbadmin that behaves in a similar-but-different fashion
• it provides many extensions which can be installed by non-superusers (in vanilla Postgres <= v13, only superusers have this privilege)

This container also hardcodes several pieces of configuration (database name, passwords) to maximize ease-of-use. This makes this project extremely insecure and unsuitable for use in any production or public environment

Usage

Until we're on DockerHub, this container must be built locally.

docker build . -t timescale-cloud-docker

Then run this image in the background.

docker run --rm -d -p 5432:5432 --name tsdb timescale-cloud-docker

Now you can login without thinking about ports or passwords using docker exec and the in-container psql client:

docker exec -it tsdb psql postgres://tsdbadmin@/defaultdb

External clients will need a bit more information:

psql postgres://tsdbadmin:tsdbadmin@localhost/defaultdb

When you're done, turn it off. We used --rm above, so this will also remove the image.

docker stop tsdb

Feature Details

Pseudo-superuser

The tsdbadmin role Timescale Cloud gives us is not a superuser, but owns most objects the default superuser otherwise would. It also receives permissions to new objects not through default privileges, but via a background job which detects new objects and runs GRANT...TO tsdbadmin statements.

We mimic the default permissions by changing ownership in a startup SQL script. We mimic the new-object-grants with altered default permissions.

Whitelisted Extensions

Timescale Cloud uses pgextwlist to whitelist extensions so ordinary users can activate them. We do the same, though we do not cover all the extensions installed-and-whitelisted by Timescale Cloud.

PG Version

We currently only offer a PG12 image. If you need PG11 instead, simply change the tag for the base image at the top of the Dockerfile. Unfortunately this does not work for PG13, but we would like to offer a PG13 solution in the future.