Skip to content

PostgreSQL (CloudNativePG) PostgreSQL (CloudNativePG) PostgreSQL (CloudNativePG)

Description / nameInput element
Container Registry
Container Configuration Root Path
PostgreSQL (CloudNativePG) Host Port
PostgreSQL (CloudNativePG) /var/lib/postgresql/data Path

Build Status Last Commit OCI Pulls sysvipc Required

PostgreSQL on FreeBSD, compatible with the CloudNativePG Kubernetes operator. Includes pgvector, pgaudit, and pg_failover_slots.
Port 5432
Registry ghcr.io/daemonless/cnpg-postgres
Daemonless daemonless/cnpg-postgres
Source www.postgresql.org/
Website cloudnative-pg.io

Version Tags

Tag Description Best For
17 / 17-standard FreeBSD Quarterly. Uses stable, tested packages. Production stability.
18 / 18-standard / latest / standard FreeBSD Quarterly. Uses stable, tested packages. Most users — recommended.

Before deploying, ensure your host environment is ready. See the Quick Start Guide for host setup instructions, including the security model for host vs. container privileges.

Deployment

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
services:
  cnpg-postgres:
    image: "ghcr.io/daemonless/cnpg-postgres:latest"
    container_name: cnpg-postgres
    volumes:
      - "/path/to/containers/cnpg-postgres:/var/lib/postgresql/data"
    ports:
      - "5432:5432"
    annotations:
      org.freebsd.jail.allow.sysvipc: "true"
    # always (not unless-stopped) so FreeBSD's podman rc.d auto-starts it at boot
    restart: always

Save as compose.yaml, then run podman-compose up -d.

1
2
3
4
5
podman run -d --name cnpg-postgres \
  -p 5432:5432 \
  --annotation 'org.freebsd.jail.allow.sysvipc=true' \
  -v /path/to/containers/cnpg-postgres:/var/lib/postgresql/data \
  ghcr.io/daemonless/cnpg-postgres:latest

Save as run.sh, then run sh run.sh.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
- name: Deploy cnpg-postgres
  containers.podman.podman_container:
    name: cnpg-postgres
    image: "ghcr.io/daemonless/cnpg-postgres:latest"
    state: started
    restart_policy: always
    ports:
      - "5432:5432"
    volumes:
      - "/path/to/containers/cnpg-postgres:/var/lib/postgresql/data"
    annotation:
      org.freebsd.jail.allow.sysvipc: "true"

Save as cnpg-postgres-deploy.yaml, then run ansible-playbook cnpg-postgres-deploy.yaml.

Warning

Exposing ports in AppJail means that your service can be reached from remote hosts. If that is not your intention, do not expose the ports and communicate with the service using the jail's IPv4 address or hostname assigned by the virtual network.

1
2
3
# .env

DIRECTOR_PROJECT=cnpg-postgres

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
# appjail-director.yml

options:
  - virtualnet: ':<random> default'
  - nat:
services:
  cnpg-postgres:
    name: cnpg_postgres
    options:
      - container: 'args:--pull'
      - expose: '5432:5432 proto:tcp'
      - template: !ENV '${PWD}/template.conf'
    volumes:
      - CNPG_POSTGRES_DATA_PATH: /var/lib/postgresql/data
volumes:
  CNPG_POSTGRES_DATA_PATH:
    device: '/path/to/containers/cnpg-postgres'

1
2
3
4
5
6
7
# Makejail

ARG tag=latest

OPTION container=boot
OPTION overwrite=force
OPTION from=ghcr.io/daemonless/cnpg-postgres:${tag}

1
2
3
4
5
6
7
# template.conf

exec.start: "/bin/sh /etc/rc"
exec.stop: "/bin/sh /etc/rc.shutdown jail"
mount.devfs
persist
allow.sysvipc

Save the files above, then run appjail-director up.

1
2
3
4
5
6
7
8
9
appjail oci run -Pd \
  -o overwrite=force \
  -o container="args:--pull" \
  -o virtualnet=":<random> default" \
  -o nat \
  -o template=template.conf \
  -o expose="5432:5432 proto:tcp" \
  -o fstab="/path/to/containers/cnpg-postgres /var/lib/postgresql/data <pseudofs>" \
  ghcr.io/daemonless/cnpg-postgres:latest cnpg-postgres

template.conf: 

1
2
3
4
5
6
7
# template.conf

exec.start: "/bin/sh /etc/rc"
exec.stop: "/bin/sh /etc/rc.shutdown jail"
mount.devfs
persist
allow.sysvipc

Save the files above, then run sh run.sh.

Experimental

Bastille's OCI support is experimental. It requires buildah and shares the host network stack (inherit). Mount volumes with --volume HOST JAIL; without it, image-declared volumes are stored under ${bastille_volumesdir}/${jail}.

1
2
3
4
5
6
7
8
services:
  cnpg-postgres:
    name: cnpg-postgres
    image: "ghcr.io/daemonless/cnpg-postgres:latest"
    network:
      - mode: host
    volumes:
      - "/path/to/containers/cnpg-postgres:/var/lib/postgresql/data"

Save as bastille-compose.yml, then run bastille up.

1
2
3
bastille create -O \
  --volume /path/to/containers/cnpg-postgres /var/lib/postgresql/data \
  cnpg-postgres ghcr.io/daemonless/cnpg-postgres:latest inherit

Interactive Configuration

Parameters

Volumes

Path Description
/var/lib/postgresql/data Database data directory

Ports

Port Protocol Description
5432 TCP PostgreSQL port

Implementation Details

  • Architectures: amd64
  • User: bsd (UID/GID set via PUID/PGID). Defaults to 1000:1000.
  • Base: Built on ghcr.io/daemonless/base (FreeBSD 15.1).
  • sysvipc: Requires --annotation 'org.freebsd.jail.allow.sysvipc=true' (ocijail 0.5.0+)

Need help? Join our Discord community.